{"id":29079,"date":"2023-11-02T14:35:02","date_gmt":"2023-11-02T13:35:02","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=29079"},"modified":"2025-01-24T10:43:47","modified_gmt":"2025-01-24T09:43:47","slug":"add-tde-to-oracle-database-and-upload-keys-to-okv","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/","title":{"rendered":"Add TDE to Oracle Database and upload keys to OKV"},"content":{"rendered":"\n<p>by Alexandre Nestor<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-introduction\">Introduction <\/h2>\n\n\n\n<p>The TDE database encryption is one of the main Oracle database feature usage. Once the TDE configured, the wallet must be backed up. If the wallet is lost nobody can help to recover the database. Also for security reasons is not a good idea to store the wallet with the database RMAN backups. <\/p>\n\n\n\n<p>OKV was created to address these main points: store in a safe place the database encryption keys and avoid to keep the keys on the disk. <\/p>\n\n\n\n<p>In this post I will show how to configure, from scratch, the TDE on the database, how to upload the wallet keys in the OKV and how to configure the database to use these keys. <\/p>\n\n\n\n<p>I choose to make the full configuration using the OKV API, so it can be scripted and implemented on a new server. <\/p>\n\n\n\n<p>The passwords are not hidden in order to easy find which password is used in which case. <\/p>\n\n\n\n<p>So let&#8217;s start&#8230;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-steps\">The steps<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Configure the TDE at the datababse level.<\/li>\n\n\n\n<li>Configure the OKV RESTfull API.<\/li>\n\n\n\n<li>Add the endpoint server to the OKV.<\/li>\n\n\n\n<li>Upload database keys to OKV. <\/li>\n\n\n\n<li>Migrate from local keys usage to OKV.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-main-configuration\">Main configuration <\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Oracle Key Vault ip <\/td><td><code>172.168.0.41<\/code><\/td><\/tr><tr><td>Oracle Key Vault version<\/td><td><code>21.7<\/code><\/td><\/tr><tr><td>Database Server ip <\/td><td><code>172.168.1.128<\/code><\/td><\/tr><tr><td>Database name<\/td><td><code>CDB01<\/code><\/td><\/tr><tr><td>Database version <\/td><td><code>21c<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-configure-tde-at-database-level\">Configure TDE at database level<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-create-the-directories\">Create the directories<\/h3>\n\n\n\n<p>First let&#8217;s create some directories to keep the database wallet. <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli oracle]$ export WALLET_DIR=\/u01\/app\/oracle\/wallet\n\n&#x5B;oracle@okvcli oracle]$ mkdir -p ${WALLET_DIR}\/tde\n\n&#x5B;oracle@okvcli oracle]$ mkdir -p ${WALLET_DIR}\/tde_seps\n\n&#x5B;oracle@okvcli oracle]$ mkdir -vp ${WALLET_DIR}\/okv\n\n&#x5B;oracle@okvcli oracle]$ echo &quot;export WALLET_DIR=\/u01\/app\/oracle\/wallet&quot; &gt;&gt; $HOME\/.bashrc\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-set-the-tde-parameters\">Set the TDE parameters<\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli oracle]$ . oraenv\nORACLE_SID = &#x5B;CDB01] ?\n\n&#x5B;oracle@okvcli oracle]$ sqlplus \/ as sysdba\n\nSQL&gt; alter system set wallet_root = &#039;\/u01\/app\/oracle\/wallet&#039; scope=spfile;\n\nSQL&gt; alter system set tablespace_encryption_default_algorithm = &#039;AES256&#039;;\n\nSQL&gt; alter system set encrypt_new_tablespaces=&#039;ALWAYS&#039;;\n\nSQL&gt; shutdown immediate; \n\nSQL&gt; startup; \n\nSQL&gt; alter system set tde_configuration = &quot;KEYSTORE_CONFIGURATION=FILE&quot;\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-wallet-creation\">Wallet creation <\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; select a.con_id, b.name, a.wrl_type, \n        a.wrl_parameter, a.status, \n        a.wallet_type \nfrom v$encryption_wallet a, \n         v$containers b \nwhere a.con_id=b.con_id \norder by a.con_id;\n\n    CON_ID NAME       WRL_TYPE     WRL_PARAMETER                        STATUS                   WALLET_TYPE\n---------- ---------- ------------ ------------------------------------ ------------------------------ ------------\n     1     CDB$ROOT   FILE          \/u01\/app\/oracle\/wallet\/tde\/          NOT_AVAILABLE               UNKNOWN\n     2     PDB$SEED   FILE                                               NOT_AVAILABLE               UNKNOWN\n     3     PDB1       FILE                                               NOT_AVAILABLE               UNKNOWN\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-create-the-keystore-at-cdb-level\">Create the keystore at CDB level <\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; administer key management create keystore identified by &quot;Hello123&quot;; \n\nkeystore altered.\n\nSQL&gt; administer key management add secret &#039;Hello123&#039; for client &#039;TDE_WALLET&#039; to local auto_login keystore &#039;\/u01\/app\/oracle\/wallet\/tde_seps&#039;;\n\nkeystore altered.\n\nSQL&gt; administer key management set keystore open identified by external store container=all;\n\nkeystore altered.\n\nselect a.con_id, b.name, a.wrl_type, \n       a.wrl_parameter, a.status, \n       a.wallet_type \nfrom v$encryption_wallet a, \n    v$containers b \nwhere a.con_id=b.con_id \norder by a.con_id;\n\n    CON_ID NAME       WRL_TYPE     WRL_PARAMETER                        STATUS                WALLET_TYPE\n---------- ---------- ------------ ------------------------------------ --------------------- ------------\n     1     CDB$ROOT   FILE          \/u01\/app\/oracle\/wallet\/tde\/          OPEN_NO_MASTER_KEY    PASSWORD\n     2     PDB$SEED   FILE                                               OPEN_NO_MASTER_KEY    PASSWORD\n     3     PDB1       FILE                                               OPEN_NO_MASTER_KEY    PASSWORD\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-create-the-master-key-password-mek-at-cdb-and-pdb-level\">Create the master key password MEK at CDB and PDB level <\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; administer key management set key using tag &#039;CDB1: Initial MEK&#039; identified by external store with backup container=current;\n\nKeystore altered.\n\nSQL&gt; select a.con_id, \n   b.name, a.wrl_type, a.wrl_parameter, a.status \nfrom v$encryption_wallet a, \n   v$containers b \nwhere a.con_id=b.con_id order by a.con_id;\n\nCON_ID  NAME       WRL_TYPE      WRL_PARAMETER                    STATUS\n---------- ---------- ------------ ------------------------------ ------------------------------\n     1     CDB$ROOT   FILE          \/u01\/app\/oracle\/wallet\/tde\/   OPEN\n     2     PDB$SEED   FILE                                        OPEN\n     3     PDB1       FILE                                        OPEN_NO_MASTER_KEY\n\nSQL&gt; alter session set container=pdb1;\n\nSession altered\n\nSQL&gt; administer key management set key using tag &#039;PDB1: Initial MEK&#039; identified by external store with backup container=current;\n\nKeystore altered.\n\nSQL&gt; alter session set container=CDB$ROOT;\n\nSession altered.\n\nSQL&gt; select a.con_id, \n   b.name, a.wrl_type, a.wrl_parameter, a.status \nfrom v$encryption_wallet a, \n   v$containers b \nwhere a.con_id=b.con_id order by a.con_id;\n\nCON_ID  NAME       WRL_TYPE      WRL_PARAMETER                    STATUS\n---------- ---------- ------------ ------------------------------ ------------------------------\n     1     CDB$ROOT   FILE          \/u01\/app\/oracle\/wallet\/tde\/   OPEN\n     2     PDB$SEED   FILE                                        OPEN\n     3     PDB1       FILE                                        OPEN\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-create-autologin-wallet\">Create autologin wallet <\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; show con_name\n\nCON_NAME\n------------------------------\nCDB$ROOT\n\nSQL&gt; administer key management create local auto_login keystore from keystore &#039;\/u01\/app\/oracle\/wallet\/tde&#039; identified by &quot;Hello123&quot;;\n\nkeystore altered.\n<\/pre><\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-configure-okv-restfull-service-on-oracle-database-server\">Configure OKV RESTfull service on oracle database server<\/h2>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli bin]$ export JAVA_HOME=\/u01\/app\/oracle\/product\/21.0.0\/dbhome_1\/jdk\n\n&#x5B;oracle@okvcli bin]$ echo &quot;export JAVA_HOME=\/u01\/app\/oracle\/product\/21.0.0\/dbhome_1\/jdk&quot; &amp;gt;&amp;gt; $HOME\/.bashrc\n\n&#x5B;oracle@okvcli oracle]$ mkdir \/u01\/app\/oracle\/okvapi\n\n&#x5B;oracle@okvcli oracle]$ cd okvapi\/\n\n&#x5B;oracle@okvcli okvapi]$ curl -O -k https:\/\/172.168.0.41:5695\/okvrestclipackage.zip\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100 3865k  100 3865k    0     0   107M      0 --:--:-- --:--:-- --:--:--  107M\n\n&#x5B;oracle@okvcli okvapi]$ unzip okvrestclipackage.zip\nArchive:  okvrestclipackage.zip\n   creating: lib\/\n   creating: bin\/\n  inflating: bin\/okv\n  inflating: bin\/okv.bat\n   creating: conf\/\n  inflating: conf\/okvrestcli.ini\n  inflating: conf\/okvrestcli_logging.properties\n  inflating: lib\/okvrestcli.jar\n\n&#x5B;oracle@okvcli okvapi]$ rm okvrestclipackage.zip\n\noracle@okvcli ~]$ export OKV_HOME=\/u01\/app\/oracle\/okvapi\n\n&#x5B;oracle@okvcli ~]$ echo &quot;export OKV_HOME=\/u01\/app\/oracle\/okvapi&quot; &amp;gt;&amp;gt; $HOME\/.bashrc\n\n&#x5B;oracle@okvcli ~]$ cat $OKV_HOME\/conf\/okvrestcli.ini\n&#x5B;Default]\nlog_property=$OKV_HOME\/conf\/okvrestcli_logging.properties\nserver=172.168.0.41\nokv_client_config=$WALLET_DIR\/okv\/conf\/okvclient.ora\nuser=admin\nclient_wallet=$OKV_HOME\/wallet\n<\/pre><\/div>\n\n\n<p>Edit the <code>$OKV_HOME\/bin\/okv<\/code> file and uncomment the line <code>export OKV_RESTCLI_CONFIG=$OKV_RESTCLI_DIR\/conf\/okvrestcli.ini<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-create-the-wallet-for-okv-restfull-api\">Create the wallet for OKV RESTfull API <\/h3>\n\n\n\n<p>As for the <code>okvrestcli.ini<\/code> file I used the admin user (see <code>user=admin<\/code> from <code>okvrestcli.ini<\/code>) to configure the wallet. The password is the one defined in OKV for the <code>admin<\/code> user. <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli okvapi]$ mkdir $OKV_HOME\/wallet\n\n&#x5B;oracle@okvcli okvapi]$ $OKV_HOME\/bin\/okv admin client-wallet add --client-wallet $OKV_HOME\/wallet --wallet-user admin\nPassword: ****** \n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-test-the-correct-installation-of-okv-restfull-api\">Test the correct installation of OKV RESTfull API <\/h3>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli conf]$ $OKV_HOME\/bin\/okv\n{\n  &quot;restCLIVersion&quot; : &quot;21.7.0.0.0&quot;\n}\n\n&#x5B;oracle@okvcli okvapi]$  $OKV_HOME\/bin\/okv server info get\n{\n  &quot;result&quot; : &quot;Success&quot;,\n  &quot;value&quot; : {\n    &quot;caCertificateExpirationDate&quot; : &quot;2026-10-19 09:52:32&quot;,\n    &quot;cpuCores&quot; : &quot;4&quot;,\n    &quot;deploymentType&quot; : &quot;Standalone&quot;,\n    &quot;diskInGB&quot; : &quot;3652&quot;,\n    &quot;fraInGB&quot; : &quot;20&quot;,\n    &quot;memoryInKB&quot; : &quot;30504316&quot;,\n    &quot;serverCertificateExpirationDate&quot; : &quot;2024-10-19 09:57:11&quot;,\n    &quot;serverTime&quot; : &quot;2023-11-02 10:40:47&quot;,\n    &quot;version&quot; : &quot;21.7.0.0.0&quot;\n  }\n}\n<\/pre><\/div>\n\n\n<p>At this moment the OKV RESTfull API is communicate with the OKV server. So we can use the API to add the endpoint to OKV. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-add-the-endpoint-to-okv\">Add the endpoint to OKV.<\/h2>\n\n\n\n<p>First we can create a wallet in the OKV for the endpoint. This step is optional. The name of the wallet is DBCDB01_WLT<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli okvapi]$ $OKV_HOME\/bin\/okv manage-access wallet create --wallet DBCDB01_WLT\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>Now create the endpoint in the OKV <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli okvapi]$ $OKV_HOME\/bin\/okv admin endpoint create --endpoint okvcli_host --description &quot;$HOSTNAME, $(hostname -i)&quot; --type ORACLE_DB --platform LINUX64\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>In the OKV the added endpoint is REGISTERED as is not enrolled yet: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1024x544.png\" alt=\"\" class=\"wp-image-29100\" srcset=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1024x544.png 1024w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-300x159.png 300w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-768x408.png 768w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1536x815.png 1536w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2048x1087.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>As we create a wallet for this endpoint let&#8217;s define it as default wallet for it:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli okvapi]$ $OKV_HOME\/bin\/okv manage-access wallet set-default --wallet DBCDB01_WLT  --endpoint okvcli_host\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>Enroll the endpoint: <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli okvapi]$ echo $ORACLE_HOME\n\/u01\/app\/oracle\/product\/21.0.0\/dbhome_1\n\n&#x5B;oracle@okvcli okvapi]$ echo $ORACLE_BASE\n\/u01\/app\/oracle\n\n&#x5B;oracle@okvcli okvapi]$ $OKV_HOME\/bin\/okv admin endpoint provision --endpoint okvcli_host --location \/u01\/app\/oracle\/wallet\/okv --auto-login FALSE\nEnter Oracle Key Vault endpoint password: OKV_cli_123\n{\n  &quot;result&quot; : &quot;Success&quot;\n}\n<\/pre><\/div>\n\n\n<p>The <code>--location<\/code> parameter <strong>must<\/strong> be <code>wallet_root<\/code> parameter path from the database plus <code>okv<\/code>. In this path OKV will download the <code>okvutil<\/code> file needed by the database to communicate with OKV server: <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli okvapi]$ ls \/u01\/app\/oracle\/wallet\/okv\nbin  conf  csdk  jlib  lib  log  ssl\n<\/pre><\/div>\n\n\n<p>The<code> okvclient.ora<\/code> file from <code>\/u01\/app\/oracle\/wallet\/okv\/con<\/code>f path can be added in the <code>$OKV_HOME\/conf\/okvrestcli.ini<\/code> file: <code>okv_client_config=\/u01\/app\/oracle\/wallet\/okv\/conf\/okvclient.ora<\/code> to be able to use the RESTfull API for this database. <\/p>\n\n\n\n<p>Notice that I put the password in the command to identified it in the next steps. <\/p>\n\n\n\n<p>At the end execute the <code>root.sh<\/code> script, which creates the directory tree&nbsp;<code>\/opt\/oracle\/extapi\/64\/hsm\/oracle\/1.0.0<\/code>, changes ownership and permissions, then copies the PKCS#11 library into this directory.<\/p>\n\n\n\n<p>The library PKCS#11&nbsp;library <code>liborapkcs.so<\/code> is used by Oracle Database to communicate with OKV.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;opc@tstokvcli ~]$ sudo su -\n&#x5B;root@tstokvcli ~]# \/u01\/app\/oracle\/wallet\/okv\/bin\/root.sh\n<\/pre><\/div>\n\n\n<p>At OKV server level the endpoint is enrolled now.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1-1024x544.png\" alt=\"\" class=\"wp-image-29104\" srcset=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1-1024x544.png 1024w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1-300x159.png 300w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1-768x408.png 768w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1-1536x815.png 1536w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1-2048x1087.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Let&#8217;s test if the endpoint okvutil is working: <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\noracle@okvcli ~]$ cd \/u01\/app\/oracle\/wallet\/okv\/bin\n\n&#x5B;oracle@okvcli bin]$ .\/okvutil list\nEnter Oracle Key Vault endpoint password:  OKV_cli_123\nUnique ID                               Type            Identifier\n3E32A151-D656-4E43-ADE8-629B11B8B4C9\tTemplate\tDefault template for OKVCLI_HOST\n\n<\/pre><\/div>\n\n\n<p>At this moment we have the database encrypted with TDE, and the database server is able to communicate with the OKV server, and is enrolled in the OKV client. <\/p>\n\n\n\n<p>The next step is to upload the TDE keys in the OKV. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-upload-tde-key-to-okv\">Upload TDE key to OKV. <\/h2>\n\n\n\n<p>The first password id the wallet password (<code>Hello123<\/code>) the second password is the endpoint password (<code>OKV_cli_123<\/code>)<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli bin]$ .\/okvutil upload -t WALLET -l \/u01\/app\/oracle\/wallet\/tde  -g DBCDB01_WLT -v 4\nokvutil version 21.7.0.0.0\nEndpoint type: Oracle Database\nConfiguration file: \/u01\/app\/oracle\/wallet\/okv\/conf\/okvclient.ora\nServer: 172.168.0.41:5696\nStandby Servers:\nUploading from \/u01\/app\/oracle\/wallet\/tde\nEnter source wallet password:  Hello123\nNo auto-login wallet found, password needed\nEnter Oracle Key Vault endpoint password: OKV_cli_123\nORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY\nTrying to connect to 172.168.0.41:5696 ...\nConnected to 172.168.0.41:5696.\nORACLE.SECURITY.DB.ENCRYPTION.AZXyYcD7Y0+Rv5tK3Y2lrT8AAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nORACLE.SECURITY.KM.ENCRYPTION.AZXyYcD7Y0+Rv5tK3Y2lrT8AAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nORACLE.SECURITY.KT.ENCRYPTION.AZXyYcD7Y0+Rv5tK3Y2lrT8AAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nORACLE.SECURITY.KB.ENCRYPTION.\nORACLE.SECURITY.ID.ENCRYPTION.\nORACLE.SECURITY.KT.ENCRYPTION.AezKLH\/ZbU8ev0KGkyVh9XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nORACLE.SECURITY.KM.ENCRYPTION.AezKLH\/ZbU8ev0KGkyVh9XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nORACLE.SECURITY.DB.ENCRYPTION.AezKLH\/ZbU8ev0KGkyVh9XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY.0928CAFC93BBEE6CE0638001A8AC296F\n\nUploaded 2 TDE keys\nUploaded 0 SEPS entries\nUploaded 0 other secrets\nUploaded 4 opaque objects\n\nUploading private key\nUploading certificate request\nUploading trust points\n\nUploaded 1 private keys\nUploaded 1 certificate requests\nUploaded 0 user certificates\nUploaded 0 trust points\n\nUpload succeeded\n\n&#x5B;oracle@okvcli bin]$ .\/okvutil list\nEnter Oracle Key Vault endpoint password: OKV_cli_123\nUnique ID                               Type            Identifier\nF1C1537B-970E-4F09-BF41-6E5525D92E28\tOpaque Object\tTDE Wallet Metadata\nA2FE6566-A68E-5217-89B0-19370EF78066\tSymmetric Key\tTDE Master Encryption Key: TAG CDB1: Initial MEK\nF3C5C8F1-5DBA-4FF2-BF28-4EC3E8606772\tOpaque Object\tTDE Wallet Metadata\n3E77A59D-DB88-4F26-BF7C-5449137B46FE\tOpaque Object\tTDE Wallet Metadata\nC910D912-0031-5776-AE3F-43967710B8DB\tSymmetric Key\tTDE Master Encryption Key: TAG PDB1: Initial MEK\n0ABA58D9-7295-4F12-BFBF-F13382476355\tOpaque Object\tTDE Wallet Metadata\n492260F0-113C-4F07-BFCA-25360F0173BC\tPrivate Key\tPrivate Key\n4F1FC5D9-2C87-4F56-BF4B-6B3A5D730C6E\tOpaque Object\tCertificate Request\n3E32A151-D656-4E43-ADE8-629B11B8B4C9\tTemplate\tDefault template for OKVCLI_HOST\n<\/pre><\/div>\n\n\n<p>At database level we are still in the <code>FILE<\/code> keystore mode (local on the server).<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&amp;gt; select wrl_type, status, con_id from v$encryption_wallet;\n\nWRL_TYPE         STATUS CON_ID\n---------------- ------ ------\nFILE             OPEN       1\nFILE             OPEN       2\nFILE             OPEN       3\n<\/pre><\/div>\n\n\n<p>At OKV server level the wallet <code>DBCDB01_WLT<\/code> contains our keys and the <code>OKVCLI_HOST<\/code> endpoint has access to the wallet: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"657\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2-1024x657.png\" alt=\"\" class=\"wp-image-29113\" srcset=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2-1024x657.png 1024w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2-300x193.png 300w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2-768x493.png 768w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2-1536x986.png 1536w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-2-2048x1315.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-migrate-the-file-local-wallet-to-okv\">Migrate the FILE local wallet to OKV<\/h2>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; show con_id\n\nCON_ID\n------------------------------\n1\n\nSQL&gt; alter system set tde_configuration = &quot;KEYSTORE_CONFIGURATION=OKV|FILE&quot; ;\n\nSQL&gt; administer key management set encryption key identified BY &quot;OKV_cli_123&quot;  migrate using &quot;Hello123&quot;  WITH BACKUP;\n\nkeystore altered.\n<\/pre><\/div>\n\n\n<p>The parameter <code>\"KEYSTORE_CONFIGURATION=OKV|FILE\"<\/code> means that the database will get the encryption key from OKV and the auto_login file <code>cwallet.sso<\/code> from local disk (<code>\/u01\/app\/oracle\/wallet\/tde<\/code>)<\/p>\n\n\n\n<p>Remove the auto_login file from the <code>tde<\/code>, directory in order to create the new auto_login file: <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli tde]$ cd \/u01\/app\/oracle\/wallet\/tde\n\n&#x5B;oracle@okvcli tde]$ rm cwallet.sso\n<\/pre><\/div>\n\n\n<p>Create the auto_login file for OKV access: <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&amp;gt; administer key management add secret &#039;OKV_cli_123&#039; for client &#039;OKV_PASSWORD&#039; to local auto_login keystore &#039;\/u01\/app\/oracle\/wallet\/tde&#039;;\n\nkeystore altered.\n\nSQL&amp;gt; select wrl_type, status, con_id from v$encryption_wallet;\n\nWRL_TYPE    STATUS    CON_ID\n----------- -------- --------\nFILE        OPEN      1\nOKV         OPEN      1\nFILE        OPEN      2\nOKV         OPEN      2\nFILE        OPEN      3\nOKV         OPEN      3\n<\/pre><\/div>\n\n\n<p>At this step the database use OKV for the encryption key and local file for auto_login.  In the wallet directory  <code>\/u01\/app\/oracle\/wallet\/tde <\/code>only the <code>cwallet.sso <\/code>file should exist. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-final-test\">Final test<\/h2>\n\n\n\n<p>The final test consist in the creation of an encrypted tablespace with a table inside,  then clean local wallet (<code>ewallet.p12<\/code> file ) and finally restart the database. <\/p>\n\n\n\n<p>If everything is correctly configured then no password should be asked, the CDB and PDB(s) must be opened, the encrypted tablespace and the table must be accessible. <\/p>\n\n\n\n<p>Let&#8217;s clean the <code>\/u01\/app\/oracle\/wallet\/tde<\/code> directory (is a good practice to start by making  a backup in another directory, just in case):<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;oracle@okvcli tde]$ cd \/u01\/app\/oracle\/wallet\/tde\n\n&#x5B;oracle@okvcli tde]$ mkdir bck\n\n&#x5B;oracle@okvcli tde]$ mv ewallet_* bck\n\n&#x5B;oracle@okvcli tde]$ ls \ncwallet.sso\n\n<\/pre><\/div>\n\n\n<p>Create an encrypted (<code>ENCR_TBS<\/code>) tablespace and add a table (<code>ENCR_TABLE<\/code>):<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; alter session set container=pdb1;\n\nSession altered.\n\nSQL&gt; create tablespace encr_tbs;\n\nSQL&gt; select tablespace_name, encrypted from dba_tablespaces where tablespace_name=&#039;ENCR_TBS&#039;;\n\nTABLESPACE_NAME \t       ENC\n------------------------------ ---\nENCR_TBS\t\t       YES\n\nSQL&gt; create table encr_table(c number) tablespace encr_tbs;\n\nTable created.\n\nSQL&gt; insert into encr_table values(1);\n\n1 row created.\n\nSQL&gt; commit;\n\nCommit complete.\n\nSQL&gt; select * from encr_table;\n\n\t C\n----------\n\t 1\n\nSQL&gt; alter session set container=CDB$ROOT;\n\nSession altered \n<\/pre><\/div>\n\n\n<p>Finally restart the database and try to select the table: <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSQL&gt; shutdown immediate; \n\nSQL&gt; startup; \n\nSQL&gt; show pdbs;\n\n   CON_ID  CON_NAME    OPEN MODE   RESTRICTED\n---------- ----------- ----------- ---------- \n     2     PDB$SEED    READ ONLY    NO\n     3     PDB1        READ WRITE   NO\n\nSQL&gt; alter session set container=pdb1;\n\nSession altered.\n\nSQL&gt; select * from encr_table;\n\n\t C\n----------\n\t 1\n\n<\/pre><\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p>Using OKV to store TDE encryption keys is  the preferred solution. The RESTfull API proposed by OKV is complete and easy to configure. It is a good practice to script all commands in order to add the endpoints, and configure the database, as a post script of vm creation for instance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to configure, from scratch, the TDE on the database, how to upload the wallet keys in the OKV and how to configure the database to use these keys. <\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[59],"tags":[3153,2857,1930,3152],"type_dbi":[3156,3155],"class_list":["post-29079","post","type-post","status-publish","format-standard","hentry","category-oracle","tag-okv","tag-online-tablespace-encryption","tag-oracle-cloud-infrastructure","tag-oracle-key-vault","type-oci","type-okv"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Add TDE to Oracle Database and upload keys to OKV - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Add TDE to Oracle Database and upload keys to OKV\" \/>\n<meta property=\"og:description\" content=\"How to configure, from scratch, the TDE on the database, how to upload the wallet keys in the OKV and how to configure the database to use these keys.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-02T13:35:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-01-24T09:43:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2814\" \/>\n\t<meta property=\"og:image:height\" content=\"1494\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Oracle Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oracle Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\"},\"author\":{\"name\":\"Oracle Team\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"headline\":\"Add TDE to Oracle Database and upload keys to OKV\",\"datePublished\":\"2023-11-02T13:35:02+00:00\",\"dateModified\":\"2025-01-24T09:43:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\"},\"wordCount\":853,\"commentCount\":7,\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1024x544.png\",\"keywords\":[\"OKV\",\"online tablespace encryption\",\"oracle cloud infrastructure\",\"Oracle Key Vault\"],\"articleSection\":[\"Oracle\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\",\"name\":\"Add TDE to Oracle Database and upload keys to OKV - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1024x544.png\",\"datePublished\":\"2023-11-02T13:35:02+00:00\",\"dateModified\":\"2025-01-24T09:43:47+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image.png\",\"contentUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image.png\",\"width\":2814,\"height\":1494},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Add TDE to Oracle Database and upload keys to OKV\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\",\"name\":\"Oracle Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"caption\":\"Oracle Team\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Add TDE to Oracle Database and upload keys to OKV - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/","og_locale":"en_US","og_type":"article","og_title":"Add TDE to Oracle Database and upload keys to OKV","og_description":"How to configure, from scratch, the TDE on the database, how to upload the wallet keys in the OKV and how to configure the database to use these keys.","og_url":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/","og_site_name":"dbi Blog","article_published_time":"2023-11-02T13:35:02+00:00","article_modified_time":"2025-01-24T09:43:47+00:00","og_image":[{"width":2814,"height":1494,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image.png","type":"image\/png"}],"author":"Oracle Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oracle Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/"},"author":{"name":"Oracle Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"headline":"Add TDE to Oracle Database and upload keys to OKV","datePublished":"2023-11-02T13:35:02+00:00","dateModified":"2025-01-24T09:43:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/"},"wordCount":853,"commentCount":7,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1024x544.png","keywords":["OKV","online tablespace encryption","oracle cloud infrastructure","Oracle Key Vault"],"articleSection":["Oracle"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/","url":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/","name":"Add TDE to Oracle Database and upload keys to OKV - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image-1024x544.png","datePublished":"2023-11-02T13:35:02+00:00","dateModified":"2025-01-24T09:43:47+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/11\/image.png","width":2814,"height":1494},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/add-tde-to-oracle-database-and-upload-keys-to-okv\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Add TDE to Oracle Database and upload keys to OKV"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee","name":"Oracle Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","caption":"Oracle Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/29079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=29079"}],"version-history":[{"count":38,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/29079\/revisions"}],"predecessor-version":[{"id":36880,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/29079\/revisions\/36880"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=29079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=29079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=29079"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=29079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}