Database With Encrypted Tablespaces Cannot Be Opened If The TDE Wallet Is Not Accessible (Doc ID 1073237.1)

Last updated on SEPTEMBER 29, 2015

Applies to:

Advanced Networking Option - Version 11.1.0.6 and later
Information in this document applies to any platform.
Checked for relevance on 07-Jun-2013


Symptoms

If the TDE wallet cannot be opened (the file is lost or the wallet password is forgotten) and if there is a need to perform a crash recovery for an encrypted tablespace then it is impossible to open the database even after the datafiles of the encrypted tablespace are put offline.


To reproduce this open two sessions to the same database and execute the following:

In session #1:

conn / as sysdba
create tablespace testtde encryption using '3DES168' default storage(ENCRYPT)
datafile '/oracle/oradata/dv11107/testtde.dbf' size 10M;

create user scott identified by tiger;
grant connect to scott;
grant resource to scott;

create table scott.testtde(col1 varchar2(100)) tablespace testtde;


conn scott/tiger

begin
for rec in 1..1000000 loop
insert into scott.testtde values('XYZ'||rec);
end loop;
end;
/


In session # 2 ( while the last command executed in session # 1 is still running) :


conn / as sysdba
shutdown abort




Rename the wallet file (mv ewallet.p12 old_ewallet.p12)

The database cannot be opened anymore:

SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-28365: wallet is not open
ORA-28365: wallet is not open


SQL> alter database datafile 5 offline drop;
Database altered.

SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-600: internal error code, arguments: [kcrp_init_1], [], [], [], [], [],[], [], [], [], [], []








On Oracle 11.2.0.3 the same ORA-28365 is seen rather than an ORA-600 but the database still cannot be opened :


SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-28365: wallet is not open




These are the messages from the alert.log of a 11gR1 database :

Beginning crash recovery of 1 threads
Started redo scan
Completed redo scan
127081 redo blocks read, 1954 data blocks need recovery
kcbztek_get_tbskey: decrypting encrypted key for tablespace 0 without opening
the wallet
kcbztek_get_tbskey: decrypting encrypted key for tablespace 0 without opening
the wallet
Aborting crash recovery due to error 28365
Errors in file /oracle/diag/rdbms/dv11107/dv11107/trace/dv11107_ora_5942.trc:
ORA-28365: wallet is not open
ORA-28365: wallet is not open
ORA-28365 signalled during: alter database open...
Tue Mar 31 12:48:56 2009
alter database datafile 5 offline drop
Completed: alter database datafile 5 offline drop
Tue Mar 31 12:49:07 2009
alter database open
Beginning crash recovery of 1 threads
parallel recovery started with 2 processes
Errors in file /oracle/diag/rdbms/dv11107/dv11107/trace/dv11107_ora_5942.trc
(incident=33805):
ORA-600: internal error code, arguments: [kcrp_init_1], [], [], [], [], [],
[], [], [], [], [], []
Incident details in:
/oracle/diag/rdbms/dv11107/dv11107/incident/incdir_33805/dv11107_ora_5942_i338
05.trc
Aborting crash recovery due to error 600
Errors in file /oracle/diag/rdbms/dv11107/dv11107/trace/dv11107_ora_5942.trc:
ORA-600: internal error code, arguments: [kcrp_init_1], [], [], [], [], [],
[], [], [], [], [], []
ORA-600 signalled during: alter database open...
Tue Mar 31 12:49:09 2009
Trace dumping is performing id=[cdmp_20090331124909]
Tue Mar 31 12:49:11 2009
Sweep Incident[34869]: completed
Sweep Incident[34861]: completed
Sweep Incident[33805]: completed




These are the messages from the alert.log of a 11.2.0.3 database:


Beginning crash recovery of 1 threads
parallel recovery started with 2 processes
Started redo scan
Completed redo scan
read 112592 KB redo, 3861 data blocks need recovery
Sat Jan 07 18:38:35 2012
kcbztek_get_tbskey: decrypting encrypted key for tablespace 0 without opening the wallet
Slave exiting with ORA-28365 exception
Errors in file /u01/app/oracle/diag/rdbms/av103/av103/trace/av103_p000_4175.trc:
ORA-28365: wallet is not open
Aborting crash recovery due to slave death, attempting serial crash recovery
Beginning crash recovery of 1 threads
Started redo scan
Completed redo scan
read 112592 KB redo, 3861 data blocks need recovery
kcbztek_get_tbskey: decrypting encrypted key for tablespace 0 without opening the wallet
Aborting crash recovery due to error 28365
Errors in file /u01/app/oracle/diag/rdbms/av103/av103/trace/av103_ora_4192.trc:
ORA-28365: wallet is not open
Errors in file /u01/app/oracle/diag/rdbms/av103/av103/trace/av103_ora_4192.trc:
ORA-28365: wallet is not open
ORA-28365 signalled during: alter database open...





Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms