Configure Existing HSM Wallet

Perform the following steps to migrate your existing HSM wallet configured using VKM to CAKM for Oracle TDE.

1. Start the database. Check the status of existing wallet in the Oracle database. Execute the following commands.

   sqlplus / as sysdba
   STARTUP;
   COLUMN WRL_PARAMETER FORMAT A50;
   SET LINES 200;
   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

   Output:

   WRL_TYPE	WRL_PARAMETER	WALLET_TYPE	STATUS
   HSM		UNKNOWN	CLOSED

2. Open the hardware keystore.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<domain::cm_user:cm_user_password>";
   

   Note

   In the command above, <domain::cm_user:cm_user_password> represents the domain, NAE user name, and its password. The domain, NAE user name, and password are case-sensitive. They must appear in double-quotes (" ") separated by a colon (:).

   The NAE user specified here is the owner of the encryption key created and stored on the CipherTrust Manager.

   You can view the generated master encryption key on the CipherTrust Manager GUI.

3. Check the wallet status by executing the following query. It should be in open state.

   SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
   

   Output:

   WRL_TYPE	WRL_PARAMETER	WALLET_TYPE	STATUS
   HSM		HSM	OPEN

4. [Optional] Generate a new MEK with CAKM for Oracle TDE.

   ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY  "<domain::cm_user:cm_user_password>";
   

5. View the MEK by executing the following command.

   select masterkeyid from v$database_key_info;
   

6. (This step is applicable for Oracle RAC.) Repeat the steps 1 and 2 on all the other node(s).

This completes the migration of your keystore from VKM to CAKM for Oracle TDE.