TDE keys must be available to both the source and target databases. In Oracle Key Vault, this is done by assigning (sharing) the keys of the source PDB to the target endpoint wallet.

1. Log in to the Oracle Key Vault management console as an SSH admin user.
2. In the Keys and Wallets tab, select All Items.
3. To verify if the source PDB keys are added to the target endpoint wallet, in the Keys & Secrets page, confirm that the source PDB keys are assigned to the target endpoint’s wallet.
4. If a key is not assigned to any wallet, click the pencil icon for the key.
5. On the edit page, click Add Wallet Membership, and then select the wallet assigned to the target endpoint.
6. Click Save.
7. View the Keys & Secrets page again to verify that the key displays the correct wallet membership.

In this scenario, between the source and target databases, Oracle Key Vault is configured only on the source database.

1. Create a temporary database and configure it with Oracle Key Vault that matches the configuration of the source database.
2. Clone the PDB from the source database into the temporary database.
3. Reverse-migrate the temporary database from Oracle Key Vault to a non-Oracle Key Vault keystore.
4. Clone the PDB from the temporary database into the target (non-Oracle Key Vault) database.
5. After cloning the PDB, delete the temporary database.

In this scenario, between the source and target databases, Oracle Key Vault is configured only on the target database.

1. Create a temporary database that matches the configuration of the source database.
2. Clone the PDB from the source database into the temporary database.
3. Configure Oracle Key Vault for the temporary database.
4. Migrate all required TDE keys from the temporary database to Oracle Key Vault.
5. Clone the PDB from the temporary database to the target database. For more information, see Cloning a PDB Where the Source and Target Databases Both use Oracle Key Vault.
6. After cloning the PDB, delete the temporary database.