TDE – Make DBA Life Easy

How to Configure Transparent Data Encryption (TDE) In Oracle 11.2

This post demonstrate how to configure TDE in 11.2.

For how to configure Transparent Data Encryption ( TDE ) in 12c or above, please click here:

Configure sqlnet.ora file with Encrypted Wallet Location
Create a Directory for Encrypted Wallet
Set the Master Encryption Key
Open the Wallet
Set up Auto-Login wallet
Create an Encrypted Tablespace
Create a Table with Encrypted Column

Configure sqlnet.ora File Including Encrypted Wallet Location

...
..
.
ENCRYPTION_WALLET_LOCATION=
    (SOURCE=
      (METHOD=FILE)
      (METHOD_DATA=(DIRECTORY=/var/opt/oracle/dbaas_acfs/TESTDB/tde_wallet)))
...
..
.

Create a Directory for Encrypted Wallet

$mkdir -p /var/opt/oracle/dbaas_acfs/TESTDB/tde_wallet

Subscribe to get access

Read more of this content when you subscribe today.

“ORA-28367: wallet does not exist” When Opening TDE Wallet

ORA-28367 error appears when opening the TDE wallet/keystore.

In 11c:

SQL>ALTER SYSTEM SET WALLET OPEN IDENTIFIED BY "software_wallet_password"; 
ALTER SYSTEM SET WALLET OPEN IDENTIFIED BY "software_wallet_password"
*
ERROR at line 1:
ORA-28367: wallet does not exist

in 12c:

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "software_keystore_password";
 ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "software_keystore_password"
*
ERROR at line 1:
ORA-28367: wallet does not exist

CAUSE

1) Please check sqlnet.ora in place.

2) Check the format of “ENCRYPTION_WALLET_LOCATION” in sqlnet.ora right as the following:

ENCRYPTION_WALLET_LOCATION=
    (SOURCE=
      (METHOD=FILE)
      (METHOD_DATA=(DIRECTORY=/var/opt/oracle/dbaas_acfs/TESTDB/tde_wallet)))

How to Configure Transparent Data Encryption (TDE) In Oracle 12c

For 12c TDE, as you have already known the new commands has been introduced for configuring TDE. The command “ADMINISTER KEY MANAGEMENT” has replaced “ALTER SYSTEM SET ENCRYPTION WALLET”.

In 12c, we call KEYSTORE instead of WALLET of previous versions.

Configure sqlnet.ora file for software keystore
Create a Directory for Software Keystore
Create a Password-Based Software Keystore
Open the Software Keystore
Set the Software TDE Master Encryption Key
Set up Auto-Login or Local Auto-Login Software Keystore
Create an Encrypted Tablespace
Create a Table with Encrypted Column

Configure sqlnet.ora File for Software Keystore

...
..
.
ENCRYPTION_WALLET_LOCATION=
    (SOURCE=
      (METHOD=FILE)
      (METHOD_DATA=(DIRECTORY=/var/opt/oracle/dbaas_acfs/TESTDB/tde_wallet)))
...
..
.

Create a Directory for Software Keystore

$mkdir -p /var/opt/oracle/dbaas_acfs/TESTDB/tde_wallet

Subscribe to get access

Read more of this content when you subscribe today.

12c TDE : ORA-28354 ORA-28417: password-based keystore is not open

In 12c, while opening a software keystore and set the software TDE master encryption key, the following errors occur:

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "wallet_password" CONTAINER =all;
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "wallet_password" CONTAINER =all
*
ERROR at line 1:
ORA-28354: Encryption wallet, auto login wallet, or HSM is already open


SQL>ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "wallet_password" WITH BACKUP USING 'first_key_backup' CONTAINER = ALL;

ERROR at line 1:
ORA-28417: password-based keystore is not open

CAUSE

An auto-open wallet is created. It was working fine when the password-based keystore is open.

WORKAROUND

1) Remove the auto-open wallet cwallet.sso

$mv cwallet.sso cwallet.sso.bkp

2) Close the wallet

SQL>administer key management set keystore close;

3) Open the password based wallet

SQL>administer key management set keystore open identified by "wallet_password" ;

4) Retry the original Set Key statement

SQL>ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "wallet_password" WITH BACKUP USING 'first_key_backup' CONTAINER = ALL;

keystore altered.

5) Finally re-enable auto_login

SQL>administer key management create AUTO_LOGIN keystore from keystore '<wallet directory>' identified by  "wallet_password" ;

How To Change SYS Password On ExaCC

Changing Oracle Database SYS user password is more complicated in Exacc Gen 2 environment.

The following should be considered, and takes action appropriately when changing SYS user password:

SYS Password Changing( Not using Alter User …)
ExaCC Database Backup Reconfiguration
A Secure External Password Store (SEPS) SYS Password Update in Keystore
TDE Wallet Password Changing Recommended
DG Standby Site Update

Subscribe to get access

Read more of this content when you subscribe today.

M	T	W	T	F	S	S
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31