My Oracle Support Banner

Migration of File based TDE to OKV for Gen 2 ExaDB-C@C Using REST (Doc ID 2828575.1)

Last updated on JANUARY 13, 2022

Applies to:

Oracle Key Vault - Version and later
Oracle Database - Enterprise Edition - Version and later
Gen 2 Exadata Cloud at Customer - Version All Versions and later
Linux x86-64


The purpose of this doc is to provide step-by-step instructions on how to migrate Gen 2 Exadata Database Service on Cloud at Customer (ExaDB-C@C) File based TDE to Oracle Key Vault (OKV) using REST for RDBMS versions 12.1 and 19c Gen 2 ExaDB-C@C databases. REST for OKV management provides the capability to script wallet and endpoint deployments and also implement OKV endpoint software installs.


To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document
 Step 1) Setup OKV_HOME (WALLET_ROOT) directories for each endpoint (All Nodes):
 Step 2) Download RESTFul Service Utility (All Nodes):
 Step 3) Update okv wrapper script (All Nodes):
 Step 4) Update okvrestcli.ini (All Nodes):
 Step 5) Create Wallet, Endpoints and Install Endpoint Client Software:
 Step 6) Copy Current TDE Wallets to OKV_HOME/tde:
 Step 7) Upload Wallet (One Node Only):
 Step 8) Add Secrets:
 Step 9) Database Initialization Parameters (18c and up):
 Step 10) For 12.1 Databases, update sqlnet.ora (All Nodes) and RAC Environment variables:
 Step 11) Migrate Keys (One node):
 Step 12) Verify Wallet Status:
 Step 13) Update CREG (All nodes):
 Known Issues/Troubleshooting:
 TDE and OKV Endpoint Client Passwords Are Different:

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.