Configure Existing HSM Wallet Migrated from Manual Software Wallet With PDB

Perform the following steps to migrate your existing HSM wallet to CAKM for Oracle TDE that was once migrated from Software wallet using VKM.

1. Start the database. Check the status of existing wallet in the Oracle database. Execute the following commands.

   sqlplus / as sysdba
   STARTUP;
   COLUMN WRL_PARAMETER FORMAT A50;
   SET LINES 200;
   ALTER PLUGGABLE DATABASE ALL OPEN READ WRITE;
   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

   Output:

   WRL_TYPE	WRL_PARAMETER	WALLET_TYPE	STATUS
   FILE		UNKNOWN	CLOSED
   HSM		HSM	CLOSED

2. Open the hardware keystore.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<domain::cm_user:cm_user_password>" CONTAINER=ALL;
   

   Note

   In the command above, <domain::cm_user:cm_user_password> represents the domain, NAE user name, and its password. The domain, NAE user name, and password are case-sensitive. They must appear in double-quotes (" ") separated by a colon (:).

   The NAE user specified here is the owner of the encryption key created and stored on the CipherTrust Manager.

   You can view the generated master encryption key on the CipherTrust Manager GUI.

3. Check the wallet status. It should be in open state.

   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

   Output:

   WRL_TYPE	WRL_PARAMETER	WALLET_TYPE	STATUS
   FILE		UNKNOWN	CLOSED
   HSM		HSM	OPEN

4. Access the data from column encrypted table or tablespace encrypted tables.

   SELECT * FROM CUSTOMERS;
   

5. (This step is applicable for Oracle RAC.) After running the above steps on the source node, run the following steps on all the destination node(s) to open the wallet.

   • Rename the existing ewallet.p12 file.

   • Copy the ewallet.p12 file from the source node to the destination node in the cluster at the <software_wallet_location>/tde location.

   • Restart the database on the destination node.

   • Open the PDB in read/write mode.

     ALTER PLUGGABLE DATABASE ALL OPEN READ WRITE;
     

   • Open the wallet by executing the following command.

     ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<domain::cm_user:cm_user_password>";
     

This completes the migration of your keystore from VKM to CAKM for Oracle TDE.