Table of Contents Table of Contents Title and Copyright Information Preface Audience Documentation Accessibility Related Documents Conventions 1 Getting Started with HSM 1.1 Why HSM? 1.2 Install HSM Client Software on Oracle Key Vault Server 1.3 Enroll Oracle Key Vault as a Client of HSM 2 Configuring HSM 2.1 Protect the Oracle Key Vault TDE Master Key with the HSM 2.2 Enable HSM in a Primary-Standby Oracle Key Vault Installation 2.3 HSM in a Multi-Master Cluster 2.3.1 Set up HSM for a Multi-Master Cluster with a Single Node 2.3.2 Set up HSM for a Multi-Master Cluster with Multiple Nodes 2.4 Backup and Restore in HSM Mode 2.4.1 Backup in HSM Mode 2.4.2 Restore in HSM Mode 2.5 Reverse Migrating to Local Wallet 2.5.1 Reverse Migrating a Standalone Deployment 2.5.2 Reverse Migrating a Primary-Standby Deployment 2.5.3 Reverse Migrating a Multi-Master Cluster 3 Reference 3.1 Commands used in Oracle Key Vault 12.2.0.5.0 and earlier 3.1.1 HSM in a Primary-Standby Oracle Key Vault Installation 3.1.2 Enable the HSM_ENABLED Parameter in the okv_security.conf File 4 Support Guidance 4.1 General Troubleshooting 4.1.1 hsm_initialize: Could Not Get Slot for HSM 4.1.2 hsm_initialize: Could Not Load PKCS#11 Library 4.1.3 Oracle Key Vault Management Console Does Not Start After Restarting HSM-Enabled Oracle Key Vault Server 4.1.4 Primary-Standby Errors 4.1.5 Backup 4.1.6 Restoring an HSM-Enabled Backup 4.2 Vendor Specific Notes - SafeNet 4.2.1 Install the HSM Client Software on the Oracle Key Vault Server 4.2.2 HSM Credential 4.2.3 Enroll Oracle Key Vault as a Client of HSM 4.2.4 HSM Provider Value 4.2.5 HSM Vendor Specific Checks 4.2.6 Verify Connection between Oracle Key Vault and SafeNet 4.3 Vendor Specific Notes - nCipher 4.3.1 Install the HSM Client Software on the Oracle Key Vault Server 4.3.2 HSM Credential 4.3.3 Enroll Oracle Key Vault as a Client of HSM 4.3.4 HSM Provider Value 4.3.5 Enable HSM Mode 4.3.6 Backup 4.3.7 Restore 4.3.8 HSM in a Primary-Standby Oracle Key Vault Installation 4.4 CNSA Suite Support 4.4.1 Running the CNSA Scripts 4.4.2 Backup 4.4.3 Upgrade