Configure Existing HSM Wallet Migrated from Manual Software Wallet

Perform the following steps to migrate your existing HSM wallet to CAKM for Oracle TDE that was once migrated from Software wallet using VKM.

1. Start the database. Check the status of existing wallet in the Oracle database. Execute the following commands.

   sqlplus / as sysdba
   STARTUP;
   COLUMN WRL_PARAMETER FORMAT A50;
   SET LINES 200;
   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

   Output:

   WRL_TYPE	WRL_PARAMETER	WALLET_TYPE	STATUS
   FILE		UNKNOWN	CLOSED
   HSM		HSM	CLOSED

2. Open the hardware keystore.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<domain::cm_user:cm_user_password>";
   

   Note

   In the command above, <domain::cm_user:cm_user_password> represents the domain, NAE user name, and its password. The domain, NAE user name, and password are case-sensitive. They must appear in double-quotes (" ") separated by a colon (:).

   The NAE user specified here is the owner of the encryption key created and stored on the CipherTrust Manager.

   You can view the generated master encryption key on the CipherTrust Manager GUI.

3. Check the wallet status by executing the following query. It should be in open state.

   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

   Output:

   WRL_TYPE	WRL_PARAMETER	WALLET_TYPE	STATUS
   FILE		UNKNOWN	CLOSED
   HSM		HSM	OPEN

4. [Optional] Generate a new MEK with CAKM for Oracle TDE.

   ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY  "<domain::cm_user:cm_user_password>";
   

5. View the MEK by executing the following command.

   select masterkeyid from v$database_key_info;
   

   After the MEK is rotated using CAKM for Oracle TDE, you can access the data from column-encrypted tables or tablespace-encrypted tables.

   SELECT * FROM CUSTOMERS;
   

6. (This step is applicable for Oracle RAC.) After running the above steps on the source node, run the following steps on all the destination node(s) to open the wallet.

   • Rename the existing ewallet.p12 file.

   • Copy the ewallet.p12 file from the source node to the destination node in the cluster at the <software_wallet_location>/tde location.

   • Restart the database on the destination node.

   • Open the wallet using the below command.

     ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<domain::cm_user:cm_user_password>";
     

This completes the migration of your keystore from VKM to CAKM for Oracle TDE.