{"id":5790,"date":"2026-07-17T04:49:23","date_gmt":"2026-07-16T23:19:23","guid":{"rendered":"https:\/\/w3buddy.com\/?p=5790"},"modified":"2026-07-19T22:13:40","modified_gmt":"2026-07-19T16:43:40","slug":"oracle-tde-wallet-configuration","status":"publish","type":"post","link":"https:\/\/w3buddy.com\/blog\/oracle-tde-wallet-configuration\/","title":{"rendered":"Oracle TDE Wallet Configuration"},"content":{"rendered":"\n

A complete production-ready SOP for configuring Oracle Transparent Data Encryption (TDE) on Linux from scratch. Covers wallet creation, master encryption key generation, tablespace and column encryption, auto-open wallet configuration, wallet backup and recovery, TDE in RAC environments, TDE with Data Guard, and full post-configuration validation \u2014 with real commands, expected outputs, and consultant-level notes for both standard OFA and enterprise custom path conventions.<\/p>\n\n\n\n

\n\n\n\n

1. Document Info<\/h3>\n\n\n\n
Item<\/th>Detail<\/th><\/tr><\/thead>
Oracle Version<\/td>19c (19.3+)<\/td><\/tr>
OS<\/td>Oracle Linux 7.x \/ RHEL 7.x or 8.x<\/td><\/tr>
TDE Type<\/td>Software Keystore (Local Wallet)<\/td><\/tr>
Encryption Algorithm<\/td>AES256 (recommended)<\/td><\/tr>
Wallet Type<\/td>Software Wallet (auto-open)<\/td><\/tr>
MOS Reference<\/td>Doc ID 1285580.1 (TDE Best Practices)<\/td><\/tr>
MOS Reference<\/td>Doc ID 2264784.1 (TDE in 19c)<\/td><\/tr>
MOS Reference<\/td>Doc ID 1944507.1 (TDE with Data Guard)<\/td><\/tr>
MOS Reference<\/td>Doc ID 1526557.1 (TDE in RAC)<\/td><\/tr>
Prepared By<\/td>Oracle DBA \/ Consultant<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

2. TDE \u2014 Concepts You Must Know First<\/h3>\n\n\n\n
\n

\ud83d\udcdd What is Oracle TDE?<\/strong> Transparent Data Encryption (TDE) encrypts sensitive data stored in Oracle database datafiles, redo logs, undo tablespaces, and temporary tablespaces at the storage level. The encryption is completely transparent to applications \u2014 they do not need any modification. Data is automatically encrypted when written to disk and decrypted when read into memory.<\/p>\n<\/blockquote>\n\n\n\n

\n

\ud83d\udcdd Why use TDE?<\/strong> TDE protects data at rest \u2014 meaning if someone physically steals a disk, copies a datafile, or accesses backup tapes, they cannot read the data without the encryption key. TDE is the standard approach for compliance with regulations like PCI-DSS, HIPAA, GDPR that require encryption of sensitive data at rest.<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

Key TDE Concepts<\/h4>\n\n\n\n
Concept<\/th>What It Means<\/th><\/tr><\/thead>
Keystore (Wallet)<\/td>A secure container that stores the TDE Master Encryption Key. Must be open for the database to access encrypted data.<\/td><\/tr>
Master Encryption Key (MEK)<\/td>The top-level key used to encrypt all other encryption keys. Stored in the keystore. If this key is lost, all encrypted data is permanently inaccessible.<\/td><\/tr>
Tablespace Encryption Key (TEK)<\/td>A unique key for each encrypted tablespace. Encrypted by the MEK and stored in the datafile header.<\/td><\/tr>
Column Encryption Key (CEK)<\/td>A unique key for each encrypted column. Encrypted by the MEK.<\/td><\/tr>
Software Keystore<\/td>The default TDE implementation \u2014 key stored in an encrypted wallet file (ewallet.p12) on the OS filesystem.<\/td><\/tr>
Hardware Keystore (HSM)<\/td>Enterprise-grade implementation \u2014 key stored in a Hardware Security Module. Not covered in this SOP.<\/td><\/tr>
Auto-Open Keystore<\/td>A special wallet file (cwallet.sso) that opens automatically when the database starts \u2014 no password required at startup. Essential for unattended restarts.<\/td><\/tr>
Password-Protected Keystore<\/td>The standard wallet that requires a password to open. Created first, then auto-open is derived from it.<\/td><\/tr>
Tablespace Encryption<\/td>Encrypts an entire tablespace \u2014 all objects in it are encrypted. Best for bulk encryption.<\/td><\/tr>
Column Encryption<\/td>Encrypts specific columns in specific tables. More granular but has performance considerations.<\/td><\/tr>
Online Encryption<\/td>In 19c, you can encrypt existing tablespaces online without downtime using ALTER TABLESPACE ... ENCRYPTION ONLINE ENCRYPT<\/code>.<\/td><\/tr>
TDE v1 vs v2<\/td>Two internal TDE architectures. v2 (default in 19c) is more efficient. Check with SELECT wrl_parameter FROM v$encryption_wallet<\/code>.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

TDE Data Flow<\/h4>\n\n\n\n
Application sends query\n        \u2502\n        \u25bc\nOracle SGA (data in memory \u2014 DECRYPTED \u2014 application sees plain text)\n        \u2502\n        \u25bc\nDatabase Writer (DBWn) \u2014 encrypts data using TEK\n        \u2502                (TEK encrypted by MEK in keystore)\n        \u25bc\nDisk (datafiles, redo logs, undo \u2014 all ENCRYPTED on disk)\n\nIf disk is stolen \u2192 attacker sees only encrypted bytes \u2192 useless without MEK<\/code><\/pre>\n\n\n\n
\n\n\n\n
TDE Keystore Types Comparison<\/h4>\n\n\n\n
Type<\/th>Security<\/th>Convenience<\/th>Production Use<\/th><\/tr><\/thead>
Password-Protected Software Wallet<\/td>Good<\/td>Requires manual open after restart<\/td>Small environments<\/td><\/tr>
Auto-Open Software Wallet<\/td>Good<\/td>Opens automatically at DB start<\/td>Most production environments<\/td><\/tr>
HSM (Hardware Security Module)<\/td>Best<\/td>Automatic with HSM<\/td>High-security environments<\/td><\/tr>
Oracle Key Vault<\/td>Best<\/td>Centralized key management<\/td>Enterprise environments<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n
\ud83d\udcdd This SOP covers Software Wallet with Auto-Open<\/strong> \u2014 the most common production configuration for standalone and RAC environments.<\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
3. Environment Details and Path Conventions<\/h3>\n\n\n\n
Item<\/th>Convention A<\/th>Convention B<\/th><\/tr><\/thead>
Oracle Base<\/td>\/u01\/app\/oracle<\/td>\/oracle<\/td><\/tr>
Oracle Home<\/td>\/u01\/app\/oracle\/product\/19.3.0\/dbhome_1<\/td>\/oracle\/RDBMS\/19.31<\/td><\/tr>
Wallet Location<\/td>\/u01\/app\/oracle\/admin\/ORCL\/wallet<\/td>\/oracle\/admin\/ORCL\/wallet<\/td><\/tr>
sqlnet.ora<\/td>$ORACLE_HOME\/network\/admin\/sqlnet.ora<\/td>$ORACLE_HOME\/network\/admin\/sqlnet.ora<\/td><\/tr>
Oracle SID<\/td>ORCL<\/td>ORCL<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n
\ud83d\udcdd Where should the wallet be stored?<\/strong><\/p>\n\n\n\n
    \n
  • Must be on a LOCAL filesystem \u2014 not NFS, not ASM<\/li>\n\n\n\n
  • Must be accessible to the oracle OS user<\/li>\n\n\n\n
  • Must be backed up separately from the database \u2014 if you lose the wallet and the database is encrypted, data is permanently lost<\/li>\n\n\n\n
  • In RAC \u2014 wallet must be on SHARED storage accessible from all nodes OR a copy must exist on each node at the same path<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n
    \n
    \u26a0\ufe0f IMPORTANT:<\/strong> The wallet directory path is hardcoded in sqlnet.ora<\/code>. Every node in a RAC and the standby server in a Data Guard configuration must have the wallet at the same path (or the path configured in their own sqlnet.ora<\/code>).<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    4. Pre-Configuration Checks<\/h3>\n\n\n\n
    \n
    \u26a0\ufe0f IMPORTANT:<\/strong> Complete all pre-checks before enabling TDE. Enabling TDE on a production database without proper planning and pre-checks is one of the most dangerous administrative operations \u2014 a mistake can make the entire database inaccessible.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    4.1 \u2014 Verify Oracle Version Supports TDE Features<\/h4>\n\n\n\n
    \n
    \ud83d\udcdd Why?<\/strong> TDE feature availability varies by Oracle version and edition. Online tablespace encryption (ENCRYPTION ONLINE ENCRYPT<\/code>) requires Oracle 12.2+. TDE column encryption requires Enterprise Edition.<\/p>\n<\/blockquote>\n\n\n\n
    -- Connect to database\nsqlplus \/ as sysdba\n\nset linesize 150\nset pagesize 50\ncol banner for a80\n\n-- Check version\nSELECT banner FROM v$version WHERE banner LIKE 'Oracle%';\n\n-- Check edition\nSELECT * FROM v$version WHERE banner LIKE '%Edition%';<\/code><\/pre>\n\n\n\n
    TDE feature availability:<\/strong><\/p>\n\n\n\n
    Feature<\/th>Minimum Version<\/th>Edition Required<\/th><\/tr><\/thead>
    TDE Tablespace Encryption<\/td>10g R2<\/td>Enterprise<\/td><\/tr>
    TDE Column Encryption<\/td>10g R2<\/td>Enterprise<\/td><\/tr>
    Online Tablespace Encryption<\/td>12.2<\/td>Enterprise<\/td><\/tr>
    Auto-Open Wallet<\/td>11g<\/td>Enterprise<\/td><\/tr>
    TDE in RAC<\/td>11g R2<\/td>Enterprise<\/td><\/tr>
    TDE with Data Guard<\/td>11g R2<\/td>Enterprise<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    4.2 \u2014 Check if TDE is Already Configured<\/h4>\n\n\n\n
    \n
    \ud83d\udcdd Why?<\/strong> In some environments TDE may already be partially configured by a previous DBA. Always check the current state before making changes.<\/p>\n<\/blockquote>\n\n\n\n
    sqlplus \/ as sysdba\n\nset linesize 200\nset pagesize 100\ncol wrl_type    for a15\ncol wrl_parameter for a60\ncol status      for a15\ncol wallet_type for a20\ncol con_id      for 999\n\n-- Check current wallet status\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;<\/code><\/pre>\n\n\n\n
    Wallet status meanings:<\/strong><\/p>\n\n\n\n
    Status<\/th>Meaning<\/th><\/tr><\/thead>
    NOT_AVAILABLE<\/td>TDE not configured \u2014 no wallet exists<\/td><\/tr>
    CLOSED<\/td>Wallet exists but is not open<\/td><\/tr>
    OPEN<\/td>Wallet is open and database can access encryption keys<\/td><\/tr>
    OPEN_NO_MASTER_KEY<\/td>Wallet is open but no master key has been created yet<\/td><\/tr>
    OPEN_UNKNOWN_MASTER_KEY<\/td>Wallet is open but master key is from a different version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    -- Check if any tablespaces are already encrypted\nset linesize 200\nset pagesize 100\ncol tablespace_name     for a25\ncol encrypted           for a10\ncol encryption_alg      for a20\n\nSELECT tablespace_name, encrypted\nFROM   dba_tablespaces\nORDER BY tablespace_name;\n\n-- Check if any columns are encrypted\nset linesize 200\nset pagesize 100\ncol owner       for a20\ncol table_name  for a25\ncol column_name for a25\ncol encryption_alg for a20\n\nSELECT owner, table_name, column_name, encryption_alg\nFROM   dba_encrypted_columns\nORDER BY owner, table_name;<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    4.3 \u2014 Check Database is in ARCHIVELOG Mode<\/h4>\n\n\n\n
    \n
    \ud83d\udcdd Why?<\/strong> Enabling TDE modifies datafile headers and redo logs. If the database is not in ARCHIVELOG mode and something goes wrong during TDE enablement, you may not be able to recover the database. Always ensure ARCHIVELOG is enabled before configuring TDE.<\/p>\n<\/blockquote>\n\n\n\n
    SELECT name, log_mode FROM v$database;\n-- Must show: ARCHIVELOG<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    4.4 \u2014 Take Full RMAN Backup Before Enabling TDE<\/h4>\n\n\n\n
    \n
    \u26a0\ufe0f IMPORTANT:<\/strong> Take a full backup BEFORE enabling TDE. Once TDE is enabled and data is encrypted, your pre-TDE backup becomes the last backup that can be restored without the TDE wallet. Keep the pre-TDE backup safely for a long time.<\/p>\n<\/blockquote>\n\n\n\n
    su - oracle\nrman target \/\n\nRMAN> BACKUP DATABASE PLUS ARCHIVELOG;\nRMAN> LIST BACKUP SUMMARY;\nRMAN> EXIT;<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    4.5 \u2014 Check Disk Space for Wallet and Encrypted Datafiles<\/h4>\n\n\n\n
    \n
    \ud83d\udcdd Why?<\/strong> When you encrypt an existing tablespace online, Oracle rewrites every datafile block. The encrypted tablespace may be slightly larger than the unencrypted one. Ensure sufficient disk space before encrypting large tablespaces.<\/p>\n<\/blockquote>\n\n\n\n
    # Check filesystem space\ndf -hP \/u01\/app\/oracle\/admin\ndf -hP \/u01\/app\/oracle\/oradata\n\n# Check size of tablespaces you plan to encrypt<\/code><\/pre>\n\n\n\n
    set linesize 200\nset pagesize 100\ncol tablespace_name for a25\ncol total_gb        for 9999.99\n\nSELECT df.tablespace_name,\n       ROUND(SUM(df.bytes)\/1024\/1024\/1024,2) total_gb\nFROM   dba_data_files df\nGROUP BY df.tablespace_name\nORDER BY total_gb DESC;<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    4.6 \u2014 Document Current Tablespace and Datafile Layout<\/h4>\n\n\n\n
    \n
    \ud83d\udcdd Why?<\/strong> Document everything BEFORE making changes. This is your reference in case you need to roll back or troubleshoot.<\/p>\n<\/blockquote>\n\n\n\n
    set linesize 200\nset pagesize 100\ncol file#           for 999\ncol tablespace_name for a25\ncol bytes_gb        for 9999.99\ncol name            for a70\n\nSELECT f.file#,\n       f.name,\n       t.name tablespace_name,\n       f.bytes\/1024\/1024\/1024 bytes_gb\nFROM   v$datafile f,\n       v$tablespace t\nWHERE  f.ts# = t.ts#\nORDER BY t.name, f.file#;<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    5. Configure Wallet Location in sqlnet.ora<\/h3>\n\n\n\n
    \n
    \ud83d\udcdd Why sqlnet.ora?<\/strong> The sqlnet.ora<\/code> file tells Oracle where to find the TDE wallet. This must be configured BEFORE creating the wallet. If sqlnet.ora<\/code> does not have the ENCRYPTION_WALLET_LOCATION<\/code> parameter, Oracle does not know where to look for the wallet and TDE commands will fail.<\/p>\n<\/blockquote>\n\n\n\n
    \n
    \u26a0\ufe0f IMPORTANT:<\/strong> Every server that runs Oracle Database and uses TDE must have this parameter correctly configured in its sqlnet.ora<\/code>. This includes all RAC nodes and the standby server in a Data Guard configuration.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    5.1 \u2014 Create Wallet Directory<\/h4>\n\n\n\n
    # On DATABASE SERVER as oracle user\nsu - oracle\n\n# Create wallet directory\n# Convention A\nmkdir -p \/u01\/app\/oracle\/admin\/ORCL\/wallet\n\n# Convention B\nmkdir -p \/oracle\/admin\/ORCL\/wallet\n\n# Set permissions \u2014 only oracle user should access this directory\nchmod 700 \/u01\/app\/oracle\/admin\/ORCL\/wallet\n\n# Verify\nls -ld \/u01\/app\/oracle\/admin\/ORCL\/wallet\n# Expected: drwx------. 2 oracle oinstall 4096 Jan 15 10:00 \/u01\/app\/oracle\/admin\/ORCL\/wallet<\/code><\/pre>\n\n\n\n
    \n
    \u26a0\ufe0f IMPORTANT:<\/strong> Wallet directory permissions must be 700 (oracle only). If the directory is readable by other OS users, anyone with OS access can copy the wallet file \u2014 significantly reducing security.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    5.2 \u2014 Configure ENCRYPTION_WALLET_LOCATION in sqlnet.ora<\/h4>\n\n\n\n
    \n
    \ud83d\udcdd Why this specific parameter?<\/strong> ENCRYPTION_WALLET_LOCATION<\/code> tells Oracle where the TDE wallet files (ewallet.p12<\/code> and cwallet.sso<\/code>) are stored. Without this, Oracle uses a default location which can vary and cause confusion.<\/p>\n<\/blockquote>\n\n\n\n
    # Edit sqlnet.ora\nsu - oracle\nvi $ORACLE_HOME\/network\/admin\/sqlnet.ora<\/code><\/pre>\n\n\n\n
    Add the following block \u2014 DO NOT remove existing content, just add below it:<\/strong><\/p>\n\n\n\n
    # -------------------------------------------------------\n# TDE Wallet Configuration\n# Added by DBA on <date>\n# This tells Oracle where to find the TDE encryption wallet\n# -------------------------------------------------------\n\n# SQLNET.ENCRYPTION_SERVER and CLIENT are for network encryption\n# (different from TDE \u2014 TDE is for data at rest)\n# Do not confuse these with TDE settings below\n\n# TDE Wallet location \u2014 path to directory containing ewallet.p12\n# Must be a local filesystem path (not NFS, not ASM)\n# Must be same path on all nodes (RAC) and standby server (Data Guard)\nENCRYPTION_WALLET_LOCATION =\n  (SOURCE =\n    (METHOD = FILE)\n    (METHOD_DATA =\n      (DIRECTORY = \/u01\/app\/oracle\/admin\/ORCL\/wallet)\n    )\n  )<\/code><\/pre>\n\n\n\n
    \n
    \ud83d\udcdd Convention B \u2014 change the directory path:<\/strong><\/p>\n<\/blockquote>\n\n\n\n
          (DIRECTORY = \/oracle\/admin\/ORCL\/wallet)<\/code><\/pre>\n\n\n\n
    \n
    \ud83d\udcdd For CDB (Container Database) environments in 19c<\/strong>, use the unified keystore location parameter instead:<\/p>\n<\/blockquote>\n\n\n\n
    WALLET_LOCATION =\n  (SOURCE =\n    (METHOD = FILE)\n    (METHOD_DATA =\n      (DIRECTORY = \/u01\/app\/oracle\/admin\/ORCL\/wallet)\n    )\n  )<\/code><\/pre>\n\n\n\n
    # Verify sqlnet.ora has correct content\ncat $ORACLE_HOME\/network\/admin\/sqlnet.ora | grep -A8 \"ENCRYPTION_WALLET\"<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    6. Create the TDE Software Keystore (Wallet)<\/h3>\n\n\n\n
    \n
    \ud83d\udcdd What happens when you create a keystore?<\/strong> Oracle creates two files in the wallet directory:<\/p>\n\n\n\n
      \n
    • ewallet.p12<\/code> \u2014 the password-protected wallet file (PKCS#12 format)<\/li>\n\n\n\n
    • Later when you configure auto-open, Oracle creates cwallet.sso<\/code> \u2014 the auto-open wallet<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n
      \n
      \u26a0\ufe0f IMPORTANT:<\/strong> The wallet password you set here is CRITICAL. Write it down and store it securely in a password vault. If you lose this password AND lose the cwallet.sso file, your encrypted data is permanently inaccessible. There is no Oracle Support procedure to recover a lost wallet password.<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      6.1 \u2014 Create the Software Keystore<\/h4>\n\n\n\n
      -- Connect to database as SYSDBA\nsqlplus \/ as sysdba\n\n-- Create the software keystore\n-- Replace 'MyWallet_Password_123' with a strong password\n-- Store this password in your organization's password vault IMMEDIATELY\nADMINISTER KEY MANAGEMENT\n    CREATE KEYSTORE '\/u01\/app\/oracle\/admin\/ORCL\/wallet'\n    IDENTIFIED BY MyWallet_Password_123;\n\n-- Convention B:\n-- ADMINISTER KEY MANAGEMENT\n--     CREATE KEYSTORE '\/oracle\/admin\/ORCL\/wallet'\n--     IDENTIFIED BY MyWallet_Password_123;<\/code><\/pre>\n\n\n\n
      # Verify ewallet.p12 was created\nls -lh \/u01\/app\/oracle\/admin\/ORCL\/wallet\/<\/code><\/pre>\n\n\n\n
      Expected output:<\/strong><\/p>\n\n\n\n
      -rw-------. 1 oracle oinstall 2555 Jan 15 10:05 ewallet.p12<\/code><\/pre>\n\n\n\n
      \n
      \u26a0\ufe0f IMPORTANT:<\/strong> If you see ewallet.p12<\/code> with only oracle<\/code> having read permissions (600) \u2014 that is correct and expected. Do not change these permissions.<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      6.2 \u2014 Open the Keystore<\/h4>\n\n\n\n
      \n
      \ud83d\udcdd Why open it?<\/strong> Creating the keystore does not automatically open it. You must open it before you can create master encryption keys or encrypt any data. Think of it as creating a safe (CREATE KEYSTORE) vs unlocking it (OPEN KEYSTORE).<\/p>\n<\/blockquote>\n\n\n\n
      -- Open the keystore\nADMINISTER KEY MANAGEMENT\n    SET KEYSTORE OPEN\n    IDENTIFIED BY MyWallet_Password_123;\n\n-- Verify keystore is now open\nset linesize 200\nset pagesize 50\ncol wrl_type      for a15\ncol wrl_parameter for a60\ncol status        for a20\ncol wallet_type   for a20\n\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;<\/code><\/pre>\n\n\n\n
      Expected output:<\/strong><\/p>\n\n\n\n
      WRL_TYPE  WRL_PARAMETER                              STATUS              WALLET_TYPE\n--------- ------------------------------------------ ------------------- --------------------\nFILE      \/u01\/app\/oracle\/admin\/ORCL\/wallet\/         OPEN_NO_MASTER_KEY  PASSWORD<\/code><\/pre>\n\n\n\n
      \n
      \ud83d\udcdd OPEN_NO_MASTER_KEY<\/code> is correct at this stage \u2014 we have not yet created the Master Encryption Key. We do that next.<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      6.3 \u2014 Create and Activate Master Encryption Key<\/h4>\n\n\n\n
      \n
      \ud83d\udcdd What is the Master Encryption Key (MEK)?<\/strong> The MEK is the root key of the TDE encryption hierarchy. All tablespace and column encryption keys are encrypted by the MEK and stored in the database. The MEK itself is stored in the keystore. When the keystore is open, Oracle can decrypt the TEKs and CEKs using the MEK \u2014 allowing access to encrypted data.<\/p>\n<\/blockquote>\n\n\n\n
      \n
      \ud83d\udcdd Why WITH BACKUP<\/code>?<\/strong> Creating a new MEK automatically backs up the old one (if any) inside the keystore. The WITH BACKUP<\/code> clause creates an additional backup of the keystore in the wallet directory before generating the new key. Always use this.<\/p>\n<\/blockquote>\n\n\n\n
      -- Create Master Encryption Key\n-- This is the most critical TDE step\n-- WITH BACKUP creates a backup before generating new key\nADMINISTER KEY MANAGEMENT\n    SET KEY\n    IDENTIFIED BY MyWallet_Password_123\n    WITH BACKUP USING 'initial_mek_backup';<\/code><\/pre>\n\n\n\n
      Expected output:<\/strong><\/p>\n\n\n\n
      keystore altered.<\/code><\/pre>\n\n\n\n
      -- Verify Master Encryption Key is created and keystore is fully open\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;<\/code><\/pre>\n\n\n\n
      Expected output:<\/strong><\/p>\n\n\n\n
      WRL_TYPE  WRL_PARAMETER                              STATUS   WALLET_TYPE\n--------- ------------------------------------------ -------- --------------------\nFILE      \/u01\/app\/oracle\/admin\/ORCL\/wallet\/         OPEN     PASSWORD<\/code><\/pre>\n\n\n\n
      \n
      \ud83d\udcdd Status changed from OPEN_NO_MASTER_KEY<\/code> to OPEN<\/code> \u2014 the keystore is now fully configured with a Master Encryption Key.<\/p>\n<\/blockquote>\n\n\n\n
      # Check wallet directory \u2014 backup file should now exist\nls -lh \/u01\/app\/oracle\/admin\/ORCL\/wallet\/<\/code><\/pre>\n\n\n\n
      Expected files:<\/strong><\/p>\n\n\n\n
      -rw-------. 1 oracle oinstall  2555 Jan 15 10:05 ewallet.p12\n-rw-------. 1 oracle oinstall  5120 Jan 15 10:10 ewallet_2024011510100000.p12<\/code><\/pre>\n\n\n\n
      \n
      \ud83d\udcdd The timestamped file (ewallet_<timestamp>.p12<\/code>) is the backup created by WITH BACKUP<\/code>. Keep it \u2014 it contains the MEK and can restore access to encrypted data.<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      7. Configure Auto-Open Keystore<\/h3>\n\n\n\n
      \n
      \ud83d\udcdd Why auto-open?<\/strong> With a password-protected keystore, every time the database restarts (patching, OS reboot, crash recovery), you must manually open the keystore before encrypted tablespaces are accessible. In production environments databases restart unattended (via systemd, after power outage etc.) \u2014 if the keystore is not open, the database starts but encrypted tablespaces are inaccessible and applications fail.<\/p>\n<\/blockquote>\n\n\n\n
      \n
      \ud83d\udcdd How auto-open works?<\/strong> Oracle creates a special wallet file cwallet.sso<\/code> (SSO = Single Sign-On). This file contains the wallet password encrypted in a way that Oracle can read automatically at startup without human intervention. It is derived from the password-protected wallet.<\/p>\n<\/blockquote>\n\n\n\n
      \n
      \u26a0\ufe0f IMPORTANT:<\/strong> cwallet.sso<\/code> provides convenience but reduces security slightly \u2014 anyone who can copy this file can open the wallet on another system. Protect the wallet directory with strict OS permissions (700) and consider encrypting the filesystem.<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      7.1 \u2014 Create Auto-Open Keystore<\/h4>\n\n\n\n
      -- Connect to database as SYSDBA\nsqlplus \/ as sysdba\n\n-- Create auto-open (SSO) keystore from the existing password keystore\n-- This creates cwallet.sso in the wallet directory\nADMINISTER KEY MANAGEMENT\n    CREATE AUTO_LOGIN KEYSTORE\n    FROM KEYSTORE '\/u01\/app\/oracle\/admin\/ORCL\/wallet'\n    IDENTIFIED BY MyWallet_Password_123;<\/code><\/pre>\n\n\n\n
      # Verify cwallet.sso was created\nls -lh \/u01\/app\/oracle\/admin\/ORCL\/wallet\/<\/code><\/pre>\n\n\n\n
      Expected files after auto-open configuration:<\/strong><\/p>\n\n\n\n
      -rw-------. 1 oracle oinstall  2555 Jan 15 10:05 ewallet.p12\n-rw-------. 1 oracle oinstall  5120 Jan 15 10:10 ewallet_2024011510100000.p12\n-rw-------. 1 oracle oinstall  3072 Jan 15 10:15 cwallet.sso<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      7.2 \u2014 Test Auto-Open by Bouncing the Database<\/h4>\n\n\n\n
      \n
      \ud83d\udcdd Why test?<\/strong> Auto-open must be tested BEFORE you encrypt any data. If auto-open is not working and you encrypt a tablespace, the database will start after a reboot but encrypted tablespaces will be inaccessible until someone manually opens the keystore.<\/p>\n<\/blockquote>\n\n\n\n
      -- Close and reopen database to test auto-open\nsqlplus \/ as sysdba\n\nSHUTDOWN IMMEDIATE;\nSTARTUP;\n\n-- Check wallet status IMMEDIATELY after startup\n-- WITHOUT manually opening the wallet\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;<\/code><\/pre>\n\n\n\n
      Expected output after startup (auto-open working):<\/strong><\/p>\n\n\n\n
      WRL_TYPE  WRL_PARAMETER                              STATUS   WALLET_TYPE\n--------- ------------------------------------------ -------- --------------------\nFILE      \/u01\/app\/oracle\/admin\/ORCL\/wallet\/         OPEN     AUTOLOGIN<\/code><\/pre>\n\n\n\n
      \n
      \ud83d\udcdd WALLET_TYPE = AUTOLOGIN<\/code> confirms auto-open is working. The wallet opened automatically without any manual intervention.<\/p>\n<\/blockquote>\n\n\n\n
      \n
      \u26a0\ufe0f IMPORTANT:<\/strong> If status shows CLOSED<\/code> after startup, auto-open is NOT working. Do NOT encrypt anything. Investigate why cwallet.sso is not being picked up (check sqlnet.ora path, file permissions, file existence).<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      8. Tablespace Encryption<\/h3>\n\n\n\n
      \n
      \ud83d\udcdd Two approaches to tablespace encryption:<\/strong><\/p>\n\n\n\n
        \n
      1. New tablespace<\/strong> \u2014 Create a new tablespace with encryption enabled from the start. Simple and clean.<\/li>\n\n\n\n
      2. Existing tablespace<\/strong> \u2014 Encrypt an existing tablespace that already has data. Requires online encryption (12.2+) or offline encryption with downtime.<\/li>\n<\/ol>\n<\/blockquote>\n\n\n\n
        \n\n\n\n
        8.1 \u2014 Create a New Encrypted Tablespace<\/h4>\n\n\n\n
        \n
        \ud83d\udcdd Why create new encrypted tablespaces?<\/strong> For new applications or new data, always create tablespaces with encryption enabled. This is simpler than encrypting existing tablespaces.<\/p>\n<\/blockquote>\n\n\n\n
        -- Connect to database as SYSDBA\nsqlplus \/ as sysdba\n\n-- Verify keystore is open before creating encrypted tablespace\nSELECT status, wallet_type FROM v$encryption_wallet;\n-- Must show: OPEN\n\n-- Create new encrypted tablespace\n-- ENCRYPTION AES256 = use AES 256-bit encryption (recommended)\n-- DEFAULT STORAGE (ENCRYPT) = all objects created in this tablespace are encrypted\n-- Convention A (filesystem)\nCREATE TABLESPACE encrypted_data\n    DATAFILE '\/u01\/app\/oracle\/oradata\/ORCL\/encrypted_data01.dbf'\n    SIZE 5G\n    AUTOEXTEND ON NEXT 1G MAXSIZE UNLIMITED\n    EXTENT MANAGEMENT LOCAL\n    SEGMENT SPACE MANAGEMENT AUTO\n    ENCRYPTION USING 'AES256'\n    DEFAULT STORAGE (ENCRYPT);\n\n-- Convention B (ASM)\nCREATE TABLESPACE encrypted_data\n    DATAFILE '+DATA'\n    SIZE 5G\n    AUTOEXTEND ON NEXT 1G MAXSIZE UNLIMITED\n    ENCRYPTION USING 'AES256'\n    DEFAULT STORAGE (ENCRYPT);\n\n-- Verify tablespace was created with encryption\nset linesize 200\nset pagesize 50\ncol tablespace_name for a25\ncol encrypted       for a10\ncol def_tab_compression for a20\n\nSELECT tablespace_name, encrypted, block_size\nFROM   dba_tablespaces\nWHERE  tablespace_name = 'ENCRYPTED_DATA';<\/code><\/pre>\n\n\n\n
        Expected output:<\/strong><\/p>\n\n\n\n
        TABLESPACE_NAME           ENCRYPTED  BLOCK_SIZE\n------------------------- ---------- ----------\nENCRYPTED_DATA            YES              8192<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        8.2 \u2014 Encrypt an Existing Tablespace (Online \u2014 No Downtime)<\/h4>\n\n\n\n
        \n
        \ud83d\udcdd What is online encryption?<\/strong> In Oracle 12.2 and 19c, you can encrypt an existing tablespace while it is online and the database is serving users. Oracle rewrites each datafile block-by-block in the background. This is the preferred method for production systems.<\/p>\n<\/blockquote>\n\n\n\n
        \n
        \ud83d\udcdd How long does it take?<\/strong> Depends on tablespace size and system I\/O capacity. Typically 1-5 GB per minute on a healthy system. A 100 GB tablespace could take 20-100 minutes. Plan the timing accordingly \u2014 while users can still access the tablespace during encryption, there will be elevated I\/O.<\/p>\n<\/blockquote>\n\n\n\n
        \n
        \u26a0\ufe0f IMPORTANT:<\/strong> Monitor v$rman_status<\/code> and v$session_longops<\/code> during online encryption to track progress and estimated completion time.<\/p>\n<\/blockquote>\n\n\n\n
        -- Verify keystore is open\nSELECT status FROM v$encryption_wallet;\n\n-- Check tablespace current state before encryption\nSELECT tablespace_name, encrypted\nFROM   dba_tablespaces\nWHERE  tablespace_name = 'USERS';\n\n-- Encrypt existing USERS tablespace online\n-- ENCRYPT = encrypt all existing blocks\n-- AES256 = encryption algorithm\n-- ONLINE = do not require tablespace to be offline\nALTER TABLESPACE users\n    ENCRYPTION ONLINE\n    USING 'AES256'\n    ENCRYPT;\n\n-- This command returns immediately but encryption runs in background\n-- Monitor progress:<\/code><\/pre>\n\n\n\n
        -- Monitor online encryption progress\n-- Run this repeatedly until no rows returned (encryption complete)\nset linesize 200\nset pagesize 100\ncol sid         for 999\ncol serial#     for 99999\ncol opname      for a40\ncol target      for a30\ncol sofar       for 9999999\ncol totalwork   for 9999999\ncol pct_done    for 999.99\ncol elapsed_sec for 99999\n\nSELECT sid, serial#, opname, target,\n       sofar, totalwork,\n       ROUND(sofar\/DECODE(totalwork,0,1,totalwork)*100,2) pct_done,\n       elapsed_seconds elapsed_sec\nFROM   v$session_longops\nWHERE  opname LIKE '%Encrypt%'\nAND    sofar < totalwork\nORDER BY start_time;<\/code><\/pre>\n\n\n\n
        -- After encryption completes -- verify tablespace is now encrypted\nSELECT tablespace_name, encrypted\nFROM   dba_tablespaces\nWHERE  tablespace_name = 'USERS';\n-- Must show: ENCRYPTED = YES<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        8.3 \u2014 Encrypt Multiple Tablespaces<\/h4>\n\n\n\n
        \n
        \ud83d\udcdd Best practice:<\/strong> Encrypt tablespaces one at a time in production to avoid overloading the I\/O subsystem with multiple concurrent encryption operations.<\/p>\n<\/blockquote>\n\n\n\n
        -- Encrypt USERS tablespace first -- wait for completion\nALTER TABLESPACE users  ENCRYPTION ONLINE USING 'AES256' ENCRYPT;\n\n-- After USERS is done, encrypt EXAMPLE\nALTER TABLESPACE example ENCRYPTION ONLINE USING 'AES256' ENCRYPT;\n\n-- Never encrypt SYSTEM or UNDO tablespaces with TDE\n-- These must remain unencrypted for Oracle internal operations\n-- You CAN encrypt TEMP tablespace if needed for compliance\n\n-- Encrypt TEMP tablespace (if required by compliance)\nALTER TABLESPACE temp ENCRYPTION ONLINE USING 'AES256' ENCRYPT;\n\n-- Verify all tablespaces encryption status\nset linesize 200\nset pagesize 100\ncol tablespace_name for a30\ncol encrypted       for a10\ncol status          for a12\n\nSELECT tablespace_name, status, encrypted\nFROM   dba_tablespaces\nORDER BY tablespace_name;<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        8.4 \u2014 Encrypt Existing Tablespace Offline (Older Method \u2014 Requires Downtime)<\/h4>\n\n\n\n
        \n
        \ud83d\udcdd When to use?<\/strong> If Oracle version is below 12.2 or if online encryption is not available. This method requires the tablespace to be taken offline during encryption.<\/p>\n<\/blockquote>\n\n\n\n
        -- Take tablespace offline\nALTER TABLESPACE users OFFLINE NORMAL;\n\n-- Encrypt the tablespace\nALTER TABLESPACE users\n    ENCRYPTION OFFLINE\n    USING 'AES256'\n    ENCRYPT;\n\n-- Bring tablespace back online\nALTER TABLESPACE users ONLINE;\n\n-- Verify\nSELECT tablespace_name, encrypted\nFROM   dba_tablespaces\nWHERE  tablespace_name = 'USERS';<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        9. Column-Level Encryption<\/h3>\n\n\n\n
        \n
        \ud83d\udcdd When to use column encryption instead of tablespace encryption?<\/strong><\/p>\n\n\n\n
          \n
        • When you only need to encrypt specific sensitive columns (SSN, credit card numbers, passwords) and not entire tablespaces<\/li>\n\n\n\n
        • When most of the table data is not sensitive but a few columns are<\/li>\n\n\n\n
        • Column encryption is more granular but has higher CPU overhead per row compared to tablespace encryption<\/li>\n\n\n\n
        • For new columns \u2014 encrypt at CREATE TABLE time<\/li>\n\n\n\n
        • For existing columns \u2014 use ALTER TABLE to add encryption<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n
          \n
          \u26a0\ufe0f IMPORTANT:<\/strong> Column encryption and tablespace encryption can be used together. A column in an encrypted tablespace gets double encryption \u2014 first by the column encryption key, then by the tablespace encryption key. This is usually unnecessary overhead \u2014 use one or the other.<\/p>\n<\/blockquote>\n\n\n\n
          \n\n\n\n
          9.1 \u2014 Create New Table with Encrypted Columns<\/h4>\n\n\n\n
          -- Create a table with specific columns encrypted\n-- Sensitive columns: credit_card_number, ssn, salary\nCREATE TABLE hr.sensitive_data (\n    employee_id     NUMBER(6)     NOT NULL,\n    first_name      VARCHAR2(20),\n    last_name       VARCHAR2(25)  NOT NULL,\n\n    -- Encrypt SSN with AES192 - no salt (faster lookups, allows index)\n    ssn             VARCHAR2(11)\n                    ENCRYPT USING 'AES192' NO SALT,\n\n    -- Encrypt credit card with AES256 - with salt (default, more secure)\n    credit_card_num VARCHAR2(20)\n                    ENCRYPT USING 'AES256',\n\n    -- Encrypt salary with 3DES168\n    salary          NUMBER(10,2)\n                    ENCRYPT USING '3DES168',\n\n    CONSTRAINT sensitive_emp_pk PRIMARY KEY (employee_id)\n);\n\n-- Verify column encryption\nset linesize 200\nset pagesize 100\ncol owner          for a15\ncol table_name     for a25\ncol column_name    for a25\ncol encryption_alg for a20\ncol salt           for a5\n\nSELECT owner, table_name, column_name,\n       encryption_alg, salt\nFROM   dba_encrypted_columns\nWHERE  owner = 'HR'\nORDER BY table_name, column_name;<\/code><\/pre>\n\n\n\n
          \n
          \ud83d\udcdd SALT vs NO SALT:<\/strong><\/p>\n\n\n\n
            \n
          • SALT<\/code> (default) \u2014 adds random data to each encrypted value. Two identical plaintext values produce different ciphertext. More secure. BUT you cannot create B-tree indexes on SALTed columns.<\/li>\n\n\n\n
          • NO SALT<\/code> \u2014 identical plaintext values produce identical ciphertext. Allows B-tree indexes for equality searches. Less secure but needed for searchable encrypted columns.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n
            \n\n\n\n
            9.2 \u2014 Add Encryption to Existing Column<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd Why encrypt existing columns?<\/strong> If you have a production table with sensitive data in unencrypted columns and need to add encryption without recreating the table.<\/p>\n<\/blockquote>\n\n\n\n
            \n
            \u26a0\ufe0f IMPORTANT:<\/strong> Adding encryption to an existing column rewrites every row in the table. This takes time proportional to table size and generates significant undo\/redo. Do this during a maintenance window for large tables.<\/p>\n<\/blockquote>\n\n\n\n
            -- Add encryption to existing column\n-- Table: hr.employees, Column: salary (already exists with data)\nALTER TABLE hr.employees\n    MODIFY (salary ENCRYPT USING 'AES256' NO SALT);\n\n-- Verify\nSELECT owner, table_name, column_name, encryption_alg\nFROM   dba_encrypted_columns\nWHERE  owner      = 'HR'\nAND    table_name = 'EMPLOYEES';<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            9.3 \u2014 Remove Column Encryption<\/h4>\n\n\n\n
            -- Remove encryption from a column (decrypts all existing data)\n-- Generates significant undo\/redo -- do during maintenance window\nALTER TABLE hr.employees MODIFY (salary DECRYPT);\n\n-- Verify encryption removed\nSELECT owner, table_name, column_name\nFROM   dba_encrypted_columns\nWHERE  owner      = 'HR'\nAND    table_name = 'EMPLOYEES';\n-- Should return no rows for SALARY column<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            10. Wallet Operations \u2014 Day-to-Day Management<\/h3>\n\n\n\n
            \n\n\n\n
            10.1 \u2014 Open Wallet Manually (Password-Protected)<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd When needed?<\/strong> After closing the auto-open wallet manually, or in environments where only password-protected wallet is used (no auto-open).<\/p>\n<\/blockquote>\n\n\n\n
            sqlplus \/ as sysdba\n\n-- Open the wallet with password\nADMINISTER KEY MANAGEMENT\n    SET KEYSTORE OPEN\n    IDENTIFIED BY MyWallet_Password_123;\n\n-- Verify\nSELECT status, wallet_type FROM v$encryption_wallet;<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            10.2 \u2014 Close Wallet<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd When to close?<\/strong> Rarely needed in production. Closing the wallet makes encrypted tablespaces inaccessible. Only close if explicitly required by security policy or during wallet maintenance.<\/p>\n<\/blockquote>\n\n\n\n
            -- Close the wallet\n-- This makes ALL encrypted tablespaces inaccessible\n-- Applications will get ORA-28365 until wallet is reopened\nADMINISTER KEY MANAGEMENT\n    SET KEYSTORE CLOSE\n    IDENTIFIED BY MyWallet_Password_123;\n\n-- Verify\nSELECT status FROM v$encryption_wallet;\n-- Shows: CLOSED<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            10.3 \u2014 Change Wallet Password<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd Why change the password?<\/strong> Regular password rotation is a security best practice. Also change immediately if the wallet password is suspected to be compromised.<\/p>\n<\/blockquote>\n\n\n\n
            \n
            \u26a0\ufe0f IMPORTANT:<\/strong> After changing the wallet password, you MUST recreate the auto-open wallet from the new password-protected wallet. The old cwallet.sso<\/code> will no longer work.<\/p>\n<\/blockquote>\n\n\n\n
            -- Change wallet password\n-- Wallet must be OPEN before changing password\nADMINISTER KEY MANAGEMENT\n    ALTER KEYSTORE PASSWORD\n    IDENTIFIED BY MyWallet_Password_123\n    SET NewWallet_Password_456\n    WITH BACKUP USING 'before_pwd_change';\n\n-- After password change -- recreate auto-open wallet\nADMINISTER KEY MANAGEMENT\n    CREATE AUTO_LOGIN KEYSTORE\n    FROM KEYSTORE '\/u01\/app\/oracle\/admin\/ORCL\/wallet'\n    IDENTIFIED BY NewWallet_Password_456;\n\n-- Verify auto-open still works by checking wallet status\nSELECT status, wallet_type FROM v$encryption_wallet;<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            10.4 \u2014 Rotate Master Encryption Key<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd Why rotate the MEK?<\/strong> Security best practice recommends rotating encryption keys periodically. Also rotate if there is any suspicion that the key has been compromised. Rotating the MEK re-encrypts all Tablespace Encryption Keys with the new MEK \u2014 the actual data in datafiles is NOT re-encrypted (only the key hierarchy changes).<\/p>\n<\/blockquote>\n\n\n\n
            -- Rotate Master Encryption Key\n-- WITH BACKUP backs up existing wallet before creating new key\nADMINISTER KEY MANAGEMENT\n    SET KEY\n    IDENTIFIED BY MyWallet_Password_123\n    WITH BACKUP USING 'before_key_rotation';\n\n-- After rotation -- verify new key is active\nSELECT status, wallet_type FROM v$encryption_wallet;\n\n-- Check key history\nset linesize 200\nset pagesize 100\ncol key_id         for a70\ncol creation_time  for a25\ncol activation_time for a25\ncol tag            for a30\n\nSELECT key_id, creation_time, activation_time, tag\nFROM   v$encryption_keys\nORDER BY creation_time;<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            10.5 \u2014 Backup the Wallet<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd Why backup the wallet separately?<\/strong> The wallet is NOT backed up by RMAN. RMAN backs up datafiles, archivelogs, and control files \u2014 not the wallet directory. You must backup the wallet separately. If you lose the wallet and have no backup, ALL encrypted data is permanently inaccessible.<\/p>\n<\/blockquote>\n\n\n\n
            # On DATABASE SERVER as oracle user\nsu - oracle\n\n# Create a timestamped backup of the wallet directory\nWALLET_DIR=\/u01\/app\/oracle\/admin\/ORCL\/wallet\nBACKUP_DIR=\/u01\/app\/oracle\/admin\/ORCL\/wallet_backup\nBACKUP_DATE=$(date +%Y%m%d_%H%M%S)\n\n# Create backup directory\nmkdir -p $BACKUP_DIR\n\n# Copy wallet files with timestamp\ncp -p $WALLET_DIR\/ewallet.p12  \\\n      $BACKUP_DIR\/ewallet_${BACKUP_DATE}.p12\n\ncp -p $WALLET_DIR\/cwallet.sso  \\\n      $BACKUP_DIR\/cwallet_${BACKUP_DATE}.sso\n\n# Verify backup\nls -lh $BACKUP_DIR\/\n\n# Optionally -- encrypt the backup of the wallet before copying off-server\n# (encrypt a backup of the encryption key -- ironic but important)\nopenssl enc -aes-256-cbc -in $BACKUP_DIR\/ewallet_${BACKUP_DATE}.p12 \\\n    -out $BACKUP_DIR\/ewallet_${BACKUP_DATE}.p12.enc \\\n    -k BackupEncryptionPassword_789\n\n# Copy encrypted backup to a remote\/offsite location\nscp $BACKUP_DIR\/ewallet_${BACKUP_DATE}.p12.enc \\\n    oracle@backupserver:\/secure\/wallet_backups\/<\/code><\/pre>\n\n\n\n
            \n
            \u26a0\ufe0f IMPORTANT:<\/strong> Store the wallet backup in a location completely separate from the database server. If the database server fails completely, you need the wallet backup to restore and decrypt the database on new hardware. A wallet backup on the same server as the database defeats the purpose.<\/p>\n<\/blockquote>\n\n\n\n
            \n\n\n\n
            10.6 \u2014 Export Wallet (Merge Wallets \/ Migration)<\/h4>\n\n\n\n
            \n
            \ud83d\udcdd Why export?<\/strong> When migrating to a new server, you need to export the wallet from the old server and import it on the new server so the new database instance can open the same encrypted tablespaces.<\/p>\n<\/blockquote>\n\n\n\n
            -- Export the wallet to a file\n-- Creates a self-contained export file\nADMINISTER KEY MANAGEMENT\n    EXPORT KEYS\n    WITH SECRET 'ExportSecret_123'\n    TO '\/u01\/app\/oracle\/admin\/ORCL\/wallet\/wallet_export.exp'\n    IDENTIFIED BY MyWallet_Password_123;<\/code><\/pre>\n\n\n\n
            # Copy the export file to new server\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/wallet_export.exp \\\n    oracle@newserver:\/u01\/app\/oracle\/admin\/ORCL\/wallet\/<\/code><\/pre>\n\n\n\n
            -- On NEW SERVER -- import the wallet\nADMINISTER KEY MANAGEMENT\n    IMPORT KEYS\n    WITH SECRET 'ExportSecret_123'\n    FROM '\/u01\/app\/oracle\/admin\/ORCL\/wallet\/wallet_export.exp'\n    IDENTIFIED BY MyWallet_Password_123\n    WITH BACKUP;<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            11. TDE in RAC Environment<\/h3>\n\n\n\n
            \n
            \ud83d\udcdd What is different about TDE in RAC?<\/strong> In a RAC environment, all nodes must be able to open the same wallet. Since each node runs an independent Oracle instance, each node needs access to the wallet. There are two approaches:<\/p>\n\n\n\n
              \n
            1. Shared wallet on shared filesystem<\/strong> \u2014 wallet stored on ACFS (ASM Cluster File System) or NFS, accessible from all nodes<\/li>\n\n\n\n
            2. Copied wallet on each node<\/strong> \u2014 same wallet files copied to the same local path on each node<\/li>\n<\/ol>\n<\/blockquote>\n\n\n\n
              \n
              \ud83d\udcdd Shared wallet is preferred<\/strong> because when you rotate the MEK or change the password, the change is immediately reflected on all nodes. With copied wallets, you must manually copy the updated wallet to all nodes after every change.<\/p>\n<\/blockquote>\n\n\n\n
              \n\n\n\n
              11.1 \u2014 Configure sqlnet.ora on All RAC Nodes<\/h4>\n\n\n\n
              # Configure sqlnet.ora on ALL RAC nodes (node1 and node2)\n# Must use the SAME wallet path on all nodes\n\n# On NODE 1\nsu - oracle\nvi $ORACLE_HOME\/network\/admin\/sqlnet.ora<\/code><\/pre>\n\n\n\n
              # Add on ALL nodes -- same path\nENCRYPTION_WALLET_LOCATION =\n  (SOURCE =\n    (METHOD = FILE)\n    (METHOD_DATA =\n      (DIRECTORY = \/u01\/app\/oracle\/admin\/ORCL\/wallet)\n    )\n  )<\/code><\/pre>\n\n\n\n
              # Copy sqlnet.ora to node2 (same content -- same path)\nscp $ORACLE_HOME\/network\/admin\/sqlnet.ora \\\n    oracle@racnode2:$ORACLE_HOME\/network\/admin\/sqlnet.ora<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              11.2 \u2014 Option A: Shared Wallet on ACFS<\/h4>\n\n\n\n
              # Create wallet on ACFS (shared storage accessible to all nodes)\n# ACFS mount point visible on all nodes -- example: \/u01\/acfsmounts\/ggwallet\nsu - oracle\n\nmkdir -p \/u01\/acfsmounts\/ggwallet\/ORCL\nchmod 700 \/u01\/acfsmounts\/ggwallet\/ORCL\n\n# Update sqlnet.ora on ALL nodes to point to shared location\nENCRYPTION_WALLET_LOCATION =\n  (SOURCE =\n    (METHOD = FILE)\n    (METHOD_DATA =\n      (DIRECTORY = \/u01\/acfsmounts\/ggwallet\/ORCL)\n    )\n  )<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              11.3 \u2014 Option B: Copy Wallet to Each Node<\/h4>\n\n\n\n
              # After creating wallet on node1 -- copy to node2\n# Must be copied to SAME path as on node1\n\n# On NODE 1 -- copy wallet files to node2\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12 \\\n    oracle@racnode2:\/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12\n\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/cwallet.sso \\\n    oracle@racnode2:\/u01\/app\/oracle\/admin\/ORCL\/wallet\/cwallet.sso\n\n# Set permissions on node2\nssh oracle@racnode2 \\\n    \"chmod 600 \/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12; \\\n     chmod 600 \/u01\/app\/oracle\/admin\/ORCL\/wallet\/cwallet.sso\"<\/code><\/pre>\n\n\n\n
              \n
              \u26a0\ufe0f IMPORTANT:<\/strong> In Option B, every time you change the wallet password or rotate the MEK, you MUST copy the updated wallet to ALL nodes. Forgetting to copy means some nodes have an outdated wallet \u2014 they can still read currently cached data in memory but after an instance restart on that node, the wallet will fail to open.<\/p>\n<\/blockquote>\n\n\n\n
              \n\n\n\n
              11.4 \u2014 Verify TDE on All RAC Nodes<\/h4>\n\n\n\n
              -- Connect to each instance and verify wallet status\n-- On NODE 1\nsqlplus \/ as sysdba\n\nSELECT inst_id, wrl_type, wrl_parameter, status, wallet_type\nFROM   gv$encryption_wallet\nORDER BY inst_id;<\/code><\/pre>\n\n\n\n
              Expected output:<\/strong><\/p>\n\n\n\n
              INST_ID  WRL_TYPE  WRL_PARAMETER                        STATUS   WALLET_TYPE\n-------- --------- ------------------------------------ -------- -----------\n       1 FILE      \/u01\/app\/oracle\/admin\/ORCL\/wallet\/   OPEN     AUTOLOGIN\n       2 FILE      \/u01\/app\/oracle\/admin\/ORCL\/wallet\/   OPEN     AUTOLOGIN<\/code><\/pre>\n\n\n\n
              \n
              \u26a0\ufe0f IMPORTANT:<\/strong> Both instances (all nodes) must show OPEN<\/code> status. If any instance shows CLOSED<\/code>, encrypted tablespaces are inaccessible from that node.<\/p>\n<\/blockquote>\n\n\n\n
              \n\n\n\n
              12. TDE with Data Guard<\/h3>\n\n\n\n
              \n
              \ud83d\udcdd How does TDE work with Data Guard?<\/strong> In a Data Guard configuration, the standby database applies redo from the primary. The redo logs contain encrypted data. The standby needs the same wallet as the primary to decrypt the data it receives via redo and to keep standby tablespaces encrypted. Both primary and standby must have the same wallet with the same Master Encryption Key.<\/p>\n<\/blockquote>\n\n\n\n
              \n\n\n\n
              12.1 \u2014 Configure sqlnet.ora on Standby Server<\/h4>\n\n\n\n
              # On STANDBY server\nsu - oracle\n\nvi $ORACLE_HOME\/network\/admin\/sqlnet.ora<\/code><\/pre>\n\n\n\n
              # Add on STANDBY server -- same wallet path structure\n# (path may differ if using Convention B)\nENCRYPTION_WALLET_LOCATION =\n  (SOURCE =\n    (METHOD = FILE)\n    (METHOD_DATA =\n      (DIRECTORY = \/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet)\n    )\n  )<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              12.2 \u2014 Copy Wallet from Primary to Standby<\/h4>\n\n\n\n
              \n
              \ud83d\udcdd Why copy the wallet?<\/strong> The standby must have the SAME wallet as the primary \u2014 specifically the same Master Encryption Key. Without this, the standby cannot decrypt the redo it receives from the primary.<\/p>\n<\/blockquote>\n\n\n\n
              \n
              \u26a0\ufe0f IMPORTANT:<\/strong> Copy the wallet BEFORE configuring MRP on the standby. If MRP tries to apply encrypted redo without a valid open wallet, it will error and stop.<\/p>\n<\/blockquote>\n\n\n\n
              # On PRIMARY server -- create standby wallet directory\n# and copy wallet to standby\nsu - oracle\n\n# Create wallet directory on standby first\nssh oracle@dbserver02 \\\n    \"mkdir -p \/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet && \\\n     chmod 700 \/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\"\n\n# Copy both wallet files from primary to standby\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12 \\\n    oracle@dbserver02:\/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/ewallet.p12\n\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/cwallet.sso \\\n    oracle@dbserver02:\/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/cwallet.sso\n\n# Set permissions on standby\nssh oracle@dbserver02 \\\n    \"chmod 600 \/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/ewallet.p12; \\\n     chmod 600 \/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/cwallet.sso\"\n\n# Verify files on standby\nssh oracle@dbserver02 \\\n    \"ls -lh \/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/\"<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              12.3 \u2014 Open Wallet on Standby and Verify<\/h4>\n\n\n\n
              -- Connect to STANDBY database\nsqlplus \/ as sysdba\n\n-- Check wallet status (auto-open should work if cwallet.sso copied correctly)\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;\n-- Expected: STATUS=OPEN, WALLET_TYPE=AUTOLOGIN\n\n-- If not auto-open -- open manually\nADMINISTER KEY MANAGEMENT\n    SET KEYSTORE OPEN\n    IDENTIFIED BY MyWallet_Password_123;<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              12.4 \u2014 Wallet Sync Procedure After MEK Rotation in DG<\/h4>\n\n\n\n
              \n
              \ud83d\udcdd Why?<\/strong> After rotating the Master Encryption Key on the primary, the standby wallet does not automatically get the new key. You must copy the updated wallet to the standby.<\/p>\n<\/blockquote>\n\n\n\n
              \n
              \u26a0\ufe0f IMPORTANT:<\/strong> This must be done PROMPTLY after MEK rotation. If the standby wallet does not have the new MEK, MRP will stop when it tries to apply redo that was encrypted with the new key.<\/p>\n<\/blockquote>\n\n\n\n
              # STEP 1 -- On PRIMARY: rotate MEK (already covered in Section 10.4)\n# After rotation -- copy new wallet to standby\n\n# STEP 2 -- Stop MRP on standby before copying wallet\n# (on standby)\nsqlplus \/ as sysdba\nALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;\n\n# STEP 3 -- Copy updated wallet from primary to standby\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12 \\\n    oracle@dbserver02:\/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/ewallet.p12\n\nscp \/u01\/app\/oracle\/admin\/ORCL\/wallet\/cwallet.sso \\\n    oracle@dbserver02:\/u01\/app\/oracle\/admin\/ORCL_STBY\/wallet\/cwallet.sso\n\n# STEP 4 -- On standby: close and reopen wallet to pick up new key\n# (on standby)\nsqlplus \/ as sysdba\n\nADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE;\n-- Wallet auto-opens with new key from cwallet.sso\nSELECT status, wallet_type FROM v$encryption_wallet;\n\n# STEP 5 -- Restart MRP\nALTER DATABASE RECOVER MANAGED STANDBY DATABASE\n    USING CURRENT LOGFILE DISCONNECT FROM SESSION;\n\n# STEP 6 -- Verify MRP is applying redo\nSELECT process, status, sequence# FROM v$managed_standby WHERE process='MRP0';<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              13. TDE Patching Considerations<\/h3>\n\n\n\n
              \n
              \ud83d\udcdd What to know about TDE during patching?<\/strong> Patching the Oracle Home does not affect the wallet or encrypted data. The wallet stays where it is and the encryption keys remain valid across patches. However there are a few things to be aware of.<\/p>\n<\/blockquote>\n\n\n\n
              \n\n\n\n
              13.1 \u2014 Verify Wallet Opens After Patching<\/h4>\n\n\n\n
              -- After applying any Oracle patch and restarting the database\n-- Verify wallet auto-opened correctly\nsqlplus \/ as sysdba\n\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;\n-- Must show: STATUS=OPEN, WALLET_TYPE=AUTOLOGIN\n\n-- Verify encrypted tablespaces are accessible\nSELECT tablespace_name, encrypted\nFROM   dba_tablespaces\nWHERE  encrypted = 'YES';\n\n-- Run a query against an encrypted tablespace to confirm access\nSELECT COUNT(*) FROM hr.employees;\n-- If wallet is not open this will error with ORA-28365<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              13.2 \u2014 TDE and datapatch<\/h4>\n\n\n\n
              \n
              \ud83d\udcdd Why mention datapatch?<\/strong> datapatch applies SQL changes to the data dictionary. If the SYSTEM tablespace or any tablespace containing SYSMAN objects is encrypted, datapatch must be able to open the wallet to access those objects. With auto-open wallet this is transparent. With password-protected wallet only, you must open the wallet before running datapatch.<\/p>\n<\/blockquote>\n\n\n\n
              # Ensure wallet is open before running datapatch\nsqlplus \/ as sysdba<\/code><\/pre>\n\n\n\n
              -- Confirm wallet is open\nSELECT status FROM v$encryption_wallet;\n-- Must show: OPEN\n\nEXIT;<\/code><\/pre>\n\n\n\n
              # Then run datapatch\n$ORACLE_HOME\/OPatch\/datapatch -verbose<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14. Post-Configuration Checks<\/h3>\n\n\n\n
              \n
              \u26a0\ufe0f IMPORTANT:<\/strong> Run all post-configuration checks after TDE is enabled and after any wallet operation. These checks confirm TDE is working correctly and encrypted data is accessible.<\/p>\n<\/blockquote>\n\n\n\n
              \n\n\n\n
              14.1 \u2014 Verify Keystore Status<\/h4>\n\n\n\n
              sqlplus \/ as sysdba\n\nset linesize 200\nset pagesize 50\ncol wrl_type      for a15\ncol wrl_parameter for a60\ncol status        for a20\ncol wallet_type   for a20\n\nSELECT wrl_type, wrl_parameter, status, wallet_type\nFROM   v$encryption_wallet;<\/code><\/pre>\n\n\n\n
              Must show:<\/strong> STATUS = OPEN<\/code> and WALLET_TYPE = AUTOLOGIN<\/code><\/p>\n\n\n\n
              \n\n\n\n
              14.2 \u2014 Verify All Encrypted Tablespaces Are Accessible<\/h4>\n\n\n\n
              set linesize 200\nset pagesize 100\ncol tablespace_name     for a25\ncol status              for a12\ncol encrypted           for a10\ncol encryption_alg      for a20\n\nSELECT t.tablespace_name,\n       t.status,\n       t.encrypted\nFROM   dba_tablespaces t\nWHERE  t.encrypted = 'YES'\nORDER BY t.tablespace_name;\n\n-- Test access to each encrypted tablespace\n-- Substitute your actual encrypted tablespace and table names\nSELECT COUNT(*) FROM hr.employees;\nSELECT COUNT(*) FROM hr.departments;\n-- These queries must succeed without ORA-28365 errors<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14.3 \u2014 Verify Master Encryption Key Information<\/h4>\n\n\n\n
              set linesize 200\nset pagesize 100\ncol key_id          for a70\ncol tag             for a30\ncol creation_time   for a25\ncol activation_time for a25\ncol key_use         for a15\n\nSELECT key_id,\n       tag,\n       creation_time,\n       activation_time,\n       key_use\nFROM   v$encryption_keys\nORDER BY creation_time DESC;<\/code><\/pre>\n\n\n\n
              What to look for:<\/strong> Most recent key must show ACTIVE<\/code> in KEY_USE<\/code>.<\/p>\n\n\n\n
              \n\n\n\n
              14.4 \u2014 Verify Wallet Files Exist and Have Correct Permissions<\/h4>\n\n\n\n
              # On DATABASE SERVER\nsu - oracle\n\n# List wallet files\nls -lh \/u01\/app\/oracle\/admin\/ORCL\/wallet\/\n\n# Convention B\nls -lh \/oracle\/admin\/ORCL\/wallet\/<\/code><\/pre>\n\n\n\n
              Expected files and permissions:<\/strong><\/p>\n\n\n\n
              -rw-------. 1 oracle oinstall  2555 ewallet.p12\n-rw-------. 1 oracle oinstall  3072 cwallet.sso\n-rw-------. 1 oracle oinstall  5120 ewallet_<timestamp>.p12  (backup files)<\/code><\/pre>\n\n\n\n
              \n
              \u26a0\ufe0f IMPORTANT:<\/strong> All wallet files must be owned by oracle<\/code> with permissions 600<\/code> (rw——-). If permissions are wider, fix them immediately:<\/p>\n<\/blockquote>\n\n\n\n
              chmod 600 \/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12\nchmod 600 \/u01\/app\/oracle\/admin\/ORCL\/wallet\/cwallet.sso<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14.5 \u2014 Verify sqlnet.ora Configuration<\/h4>\n\n\n\n
              # Confirm wallet path in sqlnet.ora matches actual wallet location\ngrep -A6 \"ENCRYPTION_WALLET\" $ORACLE_HOME\/network\/admin\/sqlnet.ora\n\n# Path in sqlnet.ora must match actual wallet directory\nls \/u01\/app\/oracle\/admin\/ORCL\/wallet\/ewallet.p12<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14.6 \u2014 Verify No Encrypted Tablespaces Are in OFFLINE Status<\/h4>\n\n\n\n
              set linesize 200\nset pagesize 100\ncol tablespace_name for a25\ncol status          for a12\ncol encrypted       for a10\n\n-- All encrypted tablespaces must be ONLINE\nSELECT tablespace_name, status, encrypted\nFROM   dba_tablespaces\nWHERE  encrypted = 'YES'\nAND    status   != 'ONLINE';\n-- Should return no rows<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14.7 \u2014 Verify Encrypted Columns<\/h4>\n\n\n\n
              set linesize 200\nset pagesize 100\ncol owner          for a20\ncol table_name     for a25\ncol column_name    for a25\ncol encryption_alg for a20\ncol salt           for a5\n\nSELECT owner, table_name, column_name,\n       encryption_alg, salt\nFROM   dba_encrypted_columns\nORDER BY owner, table_name, column_name;<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14.8 \u2014 Test Wallet Auto-Open After Database Restart<\/h4>\n\n\n\n
              \n
              \ud83d\udcdd This is the most important post-configuration check.<\/strong> Restart the database and verify the wallet auto-opens without any manual intervention.<\/p>\n<\/blockquote>\n\n\n\n
              sqlplus \/ as sysdba\n\n-- Bounce the database\nSHUTDOWN IMMEDIATE;\nSTARTUP;\n\n-- Immediately check wallet -- should be auto-open\nSELECT status, wallet_type FROM v$encryption_wallet;\n-- Must show: STATUS=OPEN, WALLET_TYPE=AUTOLOGIN\n\n-- Confirm encrypted data is accessible\nSELECT COUNT(*) FROM hr.employees;\n-- Must succeed without any ORA-28365 error<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              14.9 \u2014 Check Alert Log for TDE Errors<\/h4>\n\n\n\n
              # Scan alert log for TDE-related messages after enabling TDE\ntail -300 \/u01\/app\/oracle\/diag\/rdbms\/orcl\/ORCL\/trace\/alert_ORCL.log \\\n     | grep -E \"ORA-|TDE|wallet|keystore|encrypt|ADMINISTER\"\n\n# Convention B\ntail -300 \/oracle\/diag\/rdbms\/orcl\/ORCL\/trace\/alert_ORCL.log \\\n     | grep -E \"ORA-|TDE|wallet|keystore|encrypt|ADMINISTER\"<\/code><\/pre>\n\n\n\n
              Common TDE-related errors to watch for:<\/strong><\/p>\n\n\n\n
              Error<\/th>Meaning<\/th>Action<\/th><\/tr><\/thead>
              ORA-28365<\/td>Wallet not open<\/td>Open wallet manually or fix auto-open<\/td><\/tr>
              ORA-28417<\/td>Password-based keystore is not open<\/td>Open keystore with password<\/td><\/tr>
              ORA-46655<\/td>Master key not found in wallet<\/td>Wallet is missing or wrong wallet<\/td><\/tr>
              ORA-28374<\/td>Typed master key not found in wallet<\/td>Wrong wallet version or corrupted<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              \n\n\n\n
              14.10 \u2014 Verify Wallet Backup Exists and Is Current<\/h4>\n\n\n\n
              # Confirm wallet backup exists and is recent\nls -lh \/u01\/app\/oracle\/admin\/ORCL\/wallet_backup\/\n\n# Check remote backup location\nssh oracle@backupserver \"ls -lh \/secure\/wallet_backups\/ | tail -5\"<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              15. Quick Reference Card<\/h3>\n\n\n\n
              Task<\/th>Command<\/th><\/tr><\/thead>
              Check wallet status<\/td>SELECT wrl_type,status,wallet_type FROM v$encryption_wallet;<\/code><\/td><\/tr>
              Check wallet status (RAC)<\/td>SELECT inst_id,status,wallet_type FROM gv$encryption_wallet;<\/code><\/td><\/tr>
              Create wallet directory<\/td>mkdir -p \/u01\/app\/oracle\/admin\/ORCL\/wallet && chmod 700 ...<\/code><\/td><\/tr>
              Configure sqlnet.ora<\/td>Add ENCRYPTION_WALLET_LOCATION<\/code> block<\/td><\/tr>
              Create keystore<\/td>ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '<path>' IDENTIFIED BY <pwd>;<\/code><\/td><\/tr>
              Open keystore<\/td>ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY <pwd>;<\/code><\/td><\/tr>
              Close keystore<\/td>ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY <pwd>;<\/code><\/td><\/tr>
              Create MEK<\/td>ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY <pwd> WITH BACKUP;<\/code><\/td><\/tr>
              Create auto-open<\/td>ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE '<path>' IDENTIFIED BY <pwd>;<\/code><\/td><\/tr>
              Change wallet password<\/td>ADMINISTER KEY MANAGEMENT ALTER KEYSTORE PASSWORD IDENTIFIED BY <old> SET <new> WITH BACKUP;<\/code><\/td><\/tr>
              Rotate MEK<\/td>ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY <pwd> WITH BACKUP USING '<tag>';<\/code><\/td><\/tr>
              Check MEK history<\/td>SELECT key_id,creation_time,activation_time FROM v$encryption_keys;<\/code><\/td><\/tr>
              Create encrypted TS<\/td>CREATE TABLESPACE ... ENCRYPTION USING 'AES256' DEFAULT STORAGE (ENCRYPT);<\/code><\/td><\/tr>
              Encrypt existing TS (online)<\/td>ALTER TABLESPACE <ts> ENCRYPTION ONLINE USING 'AES256' ENCRYPT;<\/code><\/td><\/tr>
              Check encryption progress<\/td>SELECT sid,opname,sofar,totalwork,pct_done FROM v$session_longops WHERE opname LIKE '%Encrypt%';<\/code><\/td><\/tr>
              Check encrypted TSs<\/td>SELECT tablespace_name,encrypted FROM dba_tablespaces WHERE encrypted='YES';<\/code><\/td><\/tr>
              Encrypt column<\/td>ALTER TABLE t MODIFY (col ENCRYPT USING 'AES256' NO SALT);<\/code><\/td><\/tr>
              Decrypt column<\/td>ALTER TABLE t MODIFY (col DECRYPT);<\/code><\/td><\/tr>
              Check encrypted columns<\/td>SELECT owner,table_name,column_name,encryption_alg FROM dba_encrypted_columns;<\/code><\/td><\/tr>
              Backup wallet<\/td>cp ewallet.p12 ewallet_$(date +%Y%m%d).p12<\/code><\/td><\/tr>
              Export wallet<\/td>ADMINISTER KEY MANAGEMENT EXPORT KEYS WITH SECRET '<secret>' TO '<file>' IDENTIFIED BY <pwd>;<\/code><\/td><\/tr>
              Import wallet<\/td>ADMINISTER KEY MANAGEMENT IMPORT KEYS WITH SECRET '<secret>' FROM '<file>' IDENTIFIED BY <pwd> WITH BACKUP;<\/code><\/td><\/tr>
              Copy wallet to standby<\/td>scp ewallet.p12 cwallet.sso oracle@standby:<wallet_dir>\/<\/code><\/td><\/tr>
              Verify wallet files<\/td>ls -lh \/u01\/app\/oracle\/admin\/ORCL\/wallet\/<\/code><\/td><\/tr>
              Check alert log TDE<\/td>grep -E \"ORA-28|wallet|keystore\" alert_ORCL.log<\/code><\/td><\/tr>
              MOS TDE Best Practices<\/td>Doc ID 1285580.1<\/td><\/tr>
              MOS TDE in 19c<\/td>Doc ID 2264784.1<\/td><\/tr>
              MOS TDE with Data Guard<\/td>Doc ID 1944507.1<\/td><\/tr>
              MOS TDE in RAC<\/td>Doc ID 1526557.1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              \n\n\n\n
              This SOP covers everything you need to configure Oracle TDE on Linux without referring to any other source. Always backup the wallet separately from the database, always test auto-open after configuration by bouncing the database, always copy the wallet to standby before starting MRP in a Data Guard environment, and always keep the wallet password stored securely in your organization’s password vault \u2014 losing the wallet password with no backup means permanent and unrecoverable data loss.<\/p>\n","protected":false},"excerpt":{"rendered":"
              A complete production-ready SOP for configuring Oracle Transparent Data Encryption (TDE) on Linux from scratch. Covers wallet creation, master encryption key generation, tablespace and column encryption, auto-open wallet configuration, wallet backup and recovery, TDE in RAC environments, TDE with Data Guard, and full post-configuration validation \u2014 with real commands, expected outputs, and consultant-level notes for […]<\/p>\n","protected":false},"author":1,"featured_media":5791,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowu461DA:productID":"","footnotes":""},"categories":[1534],"tags":[],"class_list":["post-5790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oracle-sop"],"_links":{"self":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/5790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/comments?post=5790"}],"version-history":[{"count":2,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/5790\/revisions"}],"predecessor-version":[{"id":5811,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/5790\/revisions\/5811"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/media\/5791"}],"wp:attachment":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/media?parent=5790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/categories?post=5790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/tags?post=5790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}