TDE enable in RAC

-

 


1:- Create a backup of spfile/initfile (it is always a good practice to create a backup before any change on the DB):


 create pfile='/tmp/initorcl1.ora' from spfile;

 

 2:- Create WALLET directory in both nodes:

 

 /u01/app/oracle/product/19.3.0/dbhome_1

 

 mkdir /u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET  created on Ndoe01

 mkdir /u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET  created on Ndoe02

 

 3:- Update sqlnet.ora with wallet location (in all nodes):

 

 

 ENCRYPTION_WALLET_LOCATION=

 (SOURCE=

  (METHOD=FILE)

   (METHOD_DATA=

    (DIRECTORY=/u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET)))


 [oracle@ggrac01 admin]$ scp sqlnet.ora ggrac02:/u01/app/oracle/product/19.3.0/dbhome_1/network/admin

sqlnet.ora                                                                                  100%  145   172.3KB/s   00:00


4:- Set WALLET_ROOT:


SQL> show parameter wallet_root


NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

wallet_root                          string



SQL> alter system set wallet_root='/u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET' scope=spfile sid='*';


System altered.


Restart DB (if not, KEYSTORE_CONFIGURATION change will fail):


[oracle@ggrac01 admin]$ srvctl status database -d orcl

Instance orcl1 is running on node ggrac01

Instance orcl2 is running on node ggrac02

[oracle@ggrac01 admin]$ srvctl stop database -d orcl

srvctl start  database -d orcl


SQL> show parameter wallet_root


SQL> show parameter wallet_root


NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

wallet_root                          string      /u01/app/oracle/product/19c/db

                                                 home_1/admin/orcl/WALLET

 

Both the sides we have validated  

 

SQL> show parameter wallet_root


NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

wallet_root                          string      /u01/app/oracle/product/19c/db

                                                 home_1/admin/orcl/WALLET

 

5:- Set TDE_CONFIGURATION:


SQL> alter system set tde_configuration="KEYSTORE_CONFIGURATION=FILE" scope=both sid='*';

System altered.


6:- Create AUTO-LOGIN Keystore:


SQL>  administer key management create keystore identified by Oracle_4U;

keystore altered.


SQL>  administer key management create auto_login keystore from keystore identified by Oracle_4U;

keystore altered.

SQL> 


/u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET/tde

ls -ltr

[oracle@ggrac01 tde]$ ll

total 8

-rw------- 1 oracle asmadmin 2600 Jun 21 23:40 cwallet.sso

-rw------- 1 oracle asmadmin 2555 Jun 21 23:39 ewallet.p12



7:- Set Master key:


SQL> administer key management set keystore open force keystore identified by Oracle_4U container=all;

keystore altered.

SQL> administer key management set key force keystore identified by Oracle_4U with backup container=all;

keystore altered.


[oracle@ggrac01 tde]$ pwd

/u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET/tde

[oracle@ggrac01 tde]$ ls -ltr

total 12

-rw------- 1 oracle asmadmin 2555 Jun 21 23:44 ewallet_2025062118141629.p12

-rw------- 1 oracle asmadmin 3995 Jun 21 23:44 ewallet.p12

-rw------- 1 oracle asmadmin 4040 Jun 21 23:44 cwallet.sso

[oracle@ggrac01 tde]$



administer key management set keystore close identified by Oracle_4U container=all;



8:- Copy WALLET to other all nodes: 


[oracle@ggrac01 tde]$ scp *.* ggrac02:/u01/app/oracle/product/19.3.0/dbhome_1/admin/orcl/WALLET/tde

cwallet.sso                                                                                 100% 4040     4.0MB/s   00:00

ewallet_2025062118141629.p12                                                                100% 2555     2.1MB/s   00:00

ewallet.p12                                                                                 100% 3995     4.3MB/s   00:00

[oracle@ggrac01 tde]$




/u01/app/oracle/product/19c/dbhome_1/admin/orcl/WALLET/tde


9: – Restart DB and check open status:


SQL> alter pluggable database all save state;

SQL> alter pluggable database pdb open;


SQL> show pdbs


    CON_ID CON_NAME                       OPEN MODE  RESTRICTED

---------- ------------------------------ ---------- ----------

         2 PDB$SEED                       READ ONLY  NO

         3 PDB                            READ WRITE NO


SQL> alter pluggable database all save state;


Pluggable database altered.


SQL> show pdbs


    CON_ID CON_NAME                       OPEN MODE  RESTRICTED

---------- ------------------------------ ---------- ----------

         2 PDB$SEED                       READ ONLY  NO

         3 PDB                            READ WRITE NO

 

 

 set linesize 300

 col WRL_PARAMETER for a60

 select * from v$encryption_wallet;



ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY Oracle_4U WITH BACKUP;



 set linesize 120

 column wrl_parameter format a40

 column wrl_type heading 'Type' format a10

 column status heading 'Status' format a20

 column fully_backed_up heading 'Backed Up' format a15

 column pdb_name heading 'PDB Name' format a15

 select b.name pdb_name,wrl_type,wrl_parameter,status,wallet_type,keystore_mode,fully_backed_up from v$encryption_wallet a,v$containers b where a.con_id = b.con_id(+);

 

 ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY Oracle_4U CONTAINER = CURRENT;

 

 

 SQL> CREATE TABLESPACE TDE_TBS DATAFILE '+DATA' SIZE 100M

        ENCRYPTION USING 'AES256'

DEFAULT STORAGE (ENCRYPT);   2    3


Tablespace created.



SQL>

SQL> select tablespace_name, encrypted from dba_tablespaces;


TABLESPACE_NAME                ENC

------------------------------ ---

SYSTEM                         NO

SYSAUX                         NO

UNDOTBS1                       NO

TEMP                           NO

USERS                          NO

UNDOTBS2                       NO

TDE_TBS                        YES


7 rows selected.


SQL>







 

 





 

Comments

Post a Comment

Popular posts from this blog

MY NOTEPAD

-
set lines 200 pages 200; col END_TIME for a20; col ELAPSED_TIME for a25; col START_TIME for a20 SELECT T.SESSION_KEY, T.INPUT_TYPE, T.STATUS, T.SUM_BACKUP_PIECES_IN_GB, T.START_TIME, T.END_TIME, T.SECONDS ELAPSED_TIME FROM ( SELECT SESSION_KEY, INPUT_TYPE, STATUS, OUTPUT_BYTES/1024/1024/1024 SUM_BACKUP_PIECES_IN_GB, TO_CHAR (START_TIME, 'dd/mm/yyyy hh24:mi') START_TIME, TO_CHAR (END_TIME, 'dd/mm/yyyy hh24:mi') END_TIME, TIME_TAKEN_DISPLAY SECONDS FROM V$RMAN_BACKUP_JOB_DETAILS WHERE INPUT_TYPE='ARCHIVELOG' ORDER BY SESSION_KEY DESC) T WHERE ROWNUM <= 1; ================ ASM disk group free space ============== set sqlblanklines on set lines 180 set pages 999le col "Group Name" form a25 col "Disk Name" form a30 col "State" form a15 ...
Read more

Oracle OEM Holistic Patch

-
  Oracle OEM Holistic Patch  The Concept Starting with Oracle Enterprise Manager (OEM) 13.5 RU24 (October 2024), Oracle introduced the Holistic Patch for OEM — a unified patching model that consolidates several separate updates into a single coordinated package. Previously, administrators had to patch: * The OMS and Agents with the quarterly Release Update (RU). * OEM Application via the System Patch Bundle (SPB). * WebLogic CPU and JDK manually. There was an element of complication because of the need to keep the solution homogeneous. With the Holistic Patch, the last two steps are merged into a single patch bundle. Now we have a new Holistic patch for OEM that is released with each new OMS Release Update. Prerequisites Apply RU 24 Patch  PATCH 36761595  /later on all OMSes before applying Oct Holistic Patch   PATCH 37305292             (OR) Apply RU 25 Patch  PATCH 37057635  /later on all OMSes before applying ...
Read more

Upgrade Oracle 19c DB to 21c using Auto Upgrade utility inprogress

-
Image
  Upgrade Oracle 11g to 21c using AutoUpgrade utility: How do I upgrade Oracle database to 21c?  install the 21c oracle binaries into the server . Oracle Virtual Bix  Oracle Linux 7 Oracle Database 19c currently running Upgrading 19c database to 21c directly Oracle Database 19c on premises is available – and one of the key features is the new Auto Upgrade utility. In the following days I will publish several blog posts explaining and showcasing the new Auto Upgrade. What is the Auto Upgrade? The Oracle Database Auto Upgrade utility is a new tiny little command line tool which allows you to upgrade your databases in an unattended way. I call it the Hands-Free Upgrade. The new Auto Upgrade utility in Oracle 19che idea of the tool is to run the prechecks against multiple databases, fix 99% of the potential issues, set a restore point in case something goes wrong – and then upgrade your databases. And of course, do the post upgrade, recompilation and time zone adjustment. The...
Read more