My Oracle Support Banner

"ORA-28353: failed to open wallet" After Database Cloud Service Restart (Doc ID 2445472.1)

Last updated on NOVEMBER 08, 2019

Applies to:

Oracle Database Cloud Service - Version N/A to N/A [Release 1.0]
Linux x86-64

Symptoms

After VM restart open database failed with "ORA-28365: wallet is not open" error.

From Alert.log:

2018-08-22T02:50:33.358267+00:00
Starting ORACLE instance (normal) (OS id: 16207)
2018-08-22T02:50:33.361242+00:00
...........
2018-08-22T02:50:41.235889+00:00
Database mounted in Exclusive Mode
Lost write protection disabled
Using STANDBY_ARCHIVE_DEST parameter default value as USE_DB_RECOVERY_FILE_DEST
Completed: ALTER DATABASE MOUNT
2018-08-22T02:50:41.698532+00:00
ALTER DATABASE OPEN
2018-08-22T02:50:41.743918+00:00
Block change tracking file is current.
.....
2018-08-22T02:50:42.007517+00:00
Recovery of Online Redo Log: Thread 1 Group 2 Seq 818 Reading mem 0
Mem# 0: /u04/app/oracle/redo/redo02.log
2018-08-22T02:50:42.062028+00:00
Slave encountered ORA-28365 exception during crash recovery
Slave exiting with ORA-28365 exception
2018-08-22T02:50:42.062343+00:00
......
ORA-28365: wallet is not open
2018-08-22T02:50:42.093615+00:00

From trace file:

.............

*** 2018-08-22T02:50:41.944246+00:00 (CDB$ROOT(1))
*** SESSION ID:(245.24116) 2018-08-22T02:50:41.944286+00:00
*** CLIENT ID:() 2018-08-22T02:50:41.944296+00:00
*** SERVICE NAME:() 2018-08-22T02:50:41.944318+00:00
*** MODULE NAME:(sqlplus@DB01 (TNS V1-V3)) 2018-08-22T02:50:41.944326+00:00
*** ACTION NAME:() 2018-08-22T02:50:41.944337+00:00
*** CLIENT DRIVER:() 2018-08-22T02:50:41.944345+00:00
*** CONTAINER ID:(1) 2018-08-22T02:50:41.944355+00:00
........
kcbtse_get_tbskey: decrypting encrypted key for pdb 3 tablespace 0 without opening the wallet
kcbtse_get_tbskey: wallet is not opened (ts 3/0)
kcbtse_encdec_tbsblk: DIAG DUMP tsn 3/2 rdba 37799351, afn 11, mode 4
kcbz_encdec_tbsblk<-kcbtse_encdec_tbsblk_pdb1<-kclcaio<-kclrechk<-kcbtema<-kcrpap<-kcrpdv<-kxfprdp_int<-ksbdispatch<-opirip<-opidrv<-sou2o<-opimai_real<-ssthrdmain<-main<-__libc_start_main.
buffer tsn: 2 rdba: 0x0240c5b7 (9/50615)
scn: 0x1be9d30 seq: 0x15 flg: 0x14 tail: 0x9d300215
frmt: 0x02 chkval: 0xe562 type: 0x02=KTU UNDO BLOCK
.........

Wallet status:

SQL> select * from v$encryption_wallet;

WRL_TYPE
--------------------
WRL_PARAMETER
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
STATUS WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
------------------------------ -------------------- --------- --------- ----------
FILE
/u01/app/oracle/admin/<env>/tde_wallet/
CLOSED UNKNOWN SINGLE UNDEFINED 1

Then, we have tried to open the keystore, but again failed with ORA-28353

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE open identified by "pwd" ;
ADMINISTER KEY MANAGEMENT SET KEYSTORE open identified by "pwd"
*
ERROR at line 1:
ORA-28353: failed to open wallet

From SQLNET.ORA

ENCRYPTION_WALLET_LOCATION = (SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/u01/app/oracle/admin/<env>/tde_wallet)))
WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /u01/app/oracle/admin/cprops/cprops_wallet)))

Instance and PDB status:

SQL> select status from v$instance;

STATUS
------------
MOUNTED

SQL> select name, open_mode from v$pdbs;

NAME
--------------------------------------------------------------------------------
OPEN_MODE
----------
PDB$SEED
MOUNTED

DB01
MOUNTED

Changes

Here before this service restart, customer added a certificate - azure.cer - to the TDE wallet.

[oracle@DB01 tde_wallet]$ orapki wallet add -wallet . -trusted_cert -cert azure.cer
Oracle PKI Tool : Version 12.2.0.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Cannot modify auto-login (sso) wallet
Enter wallet password:
Operation is successfully completed.

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


In this Document
Symptoms
Changes
Cause
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.