Upgrading CAKM for Oracle TDE Provider

This section is applicable for:

• Upgrading from SafeNet ProtectApp Oracle TDE to CAKM for Oracle TDE

• Upgrading CAKM for Oracle TDE from an older version to the latest version

Upgrading from SafeNet ProtectApp Oracle TDE to CAKM for Oracle TDE

Upgrading CAKM for Oracle TDE from an older version to the latest version

To upgrade CAKM for Oracle TDE from 8.10.0 to 8.11.0:

• Upgrade Existing Manual HSM Wallet to New Manual HSM Wallet

• Upgrade Existing Auto-login HSM Wallet to New Auto-login HSM Wallet

• Upgrade Existing Auto-login HSM Wallet with PDB to New Auto-login HSM Wallet with PDB

Upgrade Existing Manual HSM Wallet to New Manual HSM Wallet

To upgrade the existing Manual HSM wallet to Manual HSM wallet, open the Manual HSM wallet using the following command:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "domain::cm_user:cm_user_password";

Upgrade Existing Auto-login HSM wallet to New Auto-login HSM wallet

To upgrade the existing Auto-login HSM wallet to new Auto-login HSM wallet, perform the steps mentioned below:

1. Rename or move the cwallet.sso file.

2. Restart the database. Check the status of existing wallet in the Oracle database. Execute the following commands.

   sqlplus / as sysdba
   SHUTDOWN IMMEDIATE;
   STARTUP;
   COLUMN WRL_PARAMETER FORMAT A50;
   SET LINES 200;
   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

3. Reset the TDE_CONFIGURATION parameter.

   ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE|HSM" scope=both;
   

4. Open the Software Wallet.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<software_keystore_password>";
   

5. Add a secret for HSM. You can do it in two ways:

   • Deleting the previously set secret and adding a new secret for CAKM for Oracle TDE.

     ADMINISTER KEY MANAGEMENT DELETE SECRET FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY "<software_keystore_password>" WITH BACKUP;
     ADMINISTER KEY MANAGEMENT ADD SECRET '<domain::cm_user:cm_user_password>' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY "<software_keystore_password>" WITH BACKUP;
     

   • Updating the previously set secret with the secret for CAKM for Oracle TDE.

     ADMINISTER KEY MANAGEMENT UPDATE SECRET '<domain::cm_user:cm_user_password>' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY "<software_keystore_password>" WITH BACKUP;
     

   If you are changing the username on client side, you must update the same username on CipherTrust Manager for respective master key and Opaque_Object also.

6. Create a new auto-login keystore using the password of the Oracle software wallet.

   ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE IDENTIFIED BY "<software_keystore_password>";
   

7. Reset the TDE_CONFIGURATION parameter and retart the database.

   ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=HSM|FILE" scope=both;
   SHUTDOWN IMMEDIATE;
   STARTUP;
   

8. (This step is applicable for Oracle RAC.) After running the above steps on the source node, run the following steps on all the destination node(s).

   • Rename the existing cwallet.sso file.

   • Copy the cwallet.sso file from the source node to the destination node in the cluster at the same location.

   • Restart the database on the destination node.

Upgrade Existing Auto-login HSM Wallet with PDB to New Auto-login HSM Wallet with PDB

To upgrade the existing Auto-login HSM wallet with PDB to new Auto-login HSM wallet with PDB, perform the steps mentioned below:

1. Rename or move the cwallet.sso file.

2. Restart the database. Check the status of existing wallet in the Oracle database. Execute the following commands.

   sqlplus / as sysdba
   SHUTDOWN IMMEDIATE;
   STARTUP;
   ALTER PLUGGABLE DATABASE ALL OPEN READ WRITE;
   COLUMN WRL_PARAMETER FORMAT A50;
   SET LINES 200;
   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

3. Reset the TDE_CONFIGURATION parameter.

   ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=FILE|HSM" scope=both;
   

4. Open the Software Wallet.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<software_keystore_password>" CONTAINER=<ALL>;
   

5. Add a secret for HSM. You can do it in two ways:

   • Deleting the previously set secret and adding a new secret for CAKM for Oracle TDE.

     ADMINISTER KEY MANAGEMENT DELETE SECRET FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY "<software_keystore_password>" WITH BACKUP;
     ADMINISTER KEY MANAGEMENT ADD SECRET '<domain::cm_user:cm_user_password>' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY "<software_keystore_password>" WITH BACKUP;
     

   • Updating the previously set secret with the secret for CAKM for Oracle TDE.

     ADMINISTER KEY MANAGEMENT UPDATE SECRET '<domain::cm_user:cm_user_password>' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY "<software_keystore_password>" WITH BACKUP;
     

6. Create a new auto-login keystore using the password of the Oracle software wallet.

   ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE IDENTIFIED BY "<software_keystore_password>";
   

7. Reset the TDE_CONFIGURATION parameter and retart the database.

   ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=HSM|FILE" scope=both;
   SHUTDOWN IMMEDIATE;
   STARTUP;
   ALTER PLUGGABLE DATABASE ALL OPEN READ WRITE;
   

8. (This step is applicable for Oracle RAC) After running the above steps on the source node, run the following steps on all the destination node(s).

   • Rename the existing cwallet.sso file.

   • Copy the cwallet.sso file from the source node to the destination node in the cluster at the same location.

   • Restart the database on the destination node.