Table of Contents
- Title and Copyright Information
- Preface
-
Changes in This Release for Oracle Key Vault
- Changes for Oracle Key Vault Release 21.9
- Changes for Oracle Key Vault Release 21.8
-
Changes for Oracle Key Vault
Release 21.7
- Controlling Access to SSH Servers Centrally with Oracle Key Vault
- Improved SSH User Keys Management
- RESTful Services Utility Changes to Support SSH Keys Management
- Support Key Creation from Oracle Key Vault Management Console
- Support for Node or Cluster Scope for Alerts in Multi-Master Cluster
- Setting the Initial Password for the support and root User
-
Changes for Oracle Key Vault
Release 21.6
- Ability to Restrict the Extraction of Private Encryption Keys from Oracle Key Vault
- Ability to Create Asymmetric Key Pairs in Oracle Key Vault
- Ability to Clone an Oracle Key Vault VM
- Support the Ability to Provide an Alternate Host Name or an IP Address
- Support SAMLv2 Based Single Sign-On (SSO) Authentication for Oracle Key Vault
- Support for Unified Application-Level Tracing and Simplified Diagnostics Collection
- Aborting Oracle Audit Vault Integration with Oracle Key Vault
- Event ID Support in Auditing Records
- Support for Disk and Network I/O and Application Metrics in Oracle Key Vault Metrics Framework
- Support for Sign and Signature Verify Operations
- Oracle Key Vault Deployments in Microsoft Azure and Amazon AWS
- Endpoint IP Address Attribute Added to endpoint get RESTful Command
- Improved Audit Record Messages
- Support Endpoint Communication With Oracle Key Vault Using a Secondary IP address or Fully-Qualified Domain Name
-
Changes for Oracle Key Vault
Release 21.5
- Support for SSH Public Key Authentication using SSH User Keys from Oracle Key Vault
- Automatic Purging of Audit Records Based on a Retention Policy
- Ability to Rotate Endpoint Certificates
- Endpoint and Endpoint Group Privileges Support for LDAP Users
- User Account Management
- Severity based Alert Categorization
- Displaying Endpoint Group Membership Column in Endpoint Metadata Report
- Ability to Determine Time of Last Endpoint Activity

- UEFI Support for OCI marketplace Image
- Separate Alerts for CA Certificate Expiration and Server/Node Certificate Expiration
-
Changes for Oracle Key Vault Release 21.4
- Ability to Control the Extraction of Symmetric Encryption Keys from Oracle Key Vault
- Enhancements to Certificate Management
- Support for Policy Based Automatic Purging of Old Oracle Key Vault Backups
- Ability to Restrict Oracle Key Vault Administrative Role Grants
- Client IP Address in the Oracle Key Vault Audit Trail
- Support for Additional Monitoring Information Through SNMP
- Changes for Oracle Key Vault Release 21.3
- Deprecated Features of Oracle Key Vault
-
1
Introduction to Oracle Key Vault
- 1.1 About Key and Secrets Management in Oracle Key Vault
- 1.2 Benefits of Using Oracle Key Vault
- 1.3 Oracle Key Vault Use Cases
- 1.4 Who Should Use Oracle Key Vault
-
1.5
Major Features of Oracle Key Vault
- 1.5.1 Centralized Storage and Management of Security Objects
- 1.5.2 Centrally Managed Remote Server Access Controls and Improved Private Key Governance for SSH Public Key Authentication
- 1.5.3 Management of the Key Lifecycle
- 1.5.4 Reporting and Alerts
- 1.5.5 Separation of Duties for Oracle Key Vault Users
- 1.5.6 Persistent Master Encryption Key Cache
- 1.5.7 Backup and Restore Functionality for Security Objects
- 1.5.8 Management of Oracle Key Vault Using RESTful Services Utility
- 1.5.9 Support for OASIS Key Management Interoperability Protocol (KMIP)
- 1.5.10 Database Release and Platform Support
- 1.5.11 Integration with External Audit and Monitoring Services
- 1.5.12 Integration of MySQL with Oracle Key Vault
- 1.5.13 Oracle Advanced Cluster File System Encryption
- 1.5.14 Support for Cloud-Based Oracle Database Deployments
- 1.5.15 Oracle Key Vault Hardware Security Module Integration
- 1.5.16 Continuous Availability, Fault-tolerance, and High Availability through Oracle Key Vault Clustering
- 1.6 Oracle Key Vault Interfaces
- 1.7 Overview of an Oracle Key Vault Deployment
-
2
Oracle Key Vault Concepts
- 2.1 Overview of Oracle Key Vault Concepts
- 2.2 Oracle Key Vault Deployment Architecture
- 2.3 Access Control Configuration
- 2.4 Administrative Roles and Endpoint Privileges within Oracle Key Vault
- 2.5 Naming Guidelines for Objects
- 2.6 Emergency System Recovery Process
- 2.7 Root and Support User Accounts
- 2.8 Endpoint Managers
- 2.9 Endpoint Administrators
- 2.10 FIPS Mode
-
3
Oracle Key Vault Multi-Master Cluster Concepts
- 3.1 Oracle Key Vault Multi-Master Cluster Overview
- 3.2 Benefits of Oracle Key Vault Multi-Master Clustering
-
3.3
Multi-Master Cluster Architecture
- 3.3.1 Oracle Key Vault Cluster Nodes
- 3.3.2 Cluster Node Limitations
- 3.3.3 Cluster Subgroups
- 3.3.4 Critical Data in Oracle Key Vault
- 3.3.5 Oracle Key Vault Read/Write Nodes
- 3.3.6 Oracle Key Vault Read-Only Nodes
- 3.3.7 Cluster Node Mode Types
- 3.3.8 Operations Permitted on Cluster Nodes in Different Modes
- 3.4 Building and Managing a Multi-Master Cluster
- 3.5 Oracle Key Vault Multi-Master Cluster Deployment Scenarios
- 3.6 Multi-Master Cluster Features
- 3.7 Cluster Management Information
-
4
Managing Oracle Key Vault Multi-Master Clusters
- 4.1 About Managing Oracle Key Vault Multi-Master Clusters
- 4.2 Setting Up a Cluster
- 4.3 Terminating the Pairing of a Node
- 4.4 Disabling a Cluster Node
- 4.5 Enabling a Disabled Cluster Node
- 4.6 Deleting a Cluster Node
- 4.7 Force Deleting a Cluster Node
- 4.8 Managing Replication Between Nodes
- 4.9 Cluster Management Information
- 4.10 Cluster Monitoring Information
- 4.11 Naming Conflicts and Resolution
- 4.12 Multi-Master Cluster Deployment Recommendations
- 4.13 Adding an Alternate Name or IP Address
-
5
Deploying Oracle Key Vault on an Oracle Cloud Infrastructure VM Compute Instance
- 5.1 About Deploying Oracle Key Vault on an Oracle Cloud Infrastructure Compute Instance
- 5.2 Benefits of Using Oracle Key Vault in Oracle Cloud Infrastructure
- 5.3 Provisioning an Oracle Key Vault Compute Instance
- 5.4 General Management of an Oracle Key Vault Compute Instance
- 5.5 Migrating Oracle Key Vault Deployments Between On-Premises and OCI
- 5.6 Creating Oracle Key Vault Image in Microsoft Azure
- 5.7 Creating Oracle Key Vault Image in Amazon AWS
- 5.8 Creating Oracle Key Vault Image in Google Cloud
-
6
Oracle Database Instances in Oracle Cloud Infrastructure
- 6.1 About Managing Oracle Cloud Infrastructure Database Instance Endpoints
- 6.2 Preparing a Database Instance on OCI to be an Oracle Key Vault Endpoint
-
6.3
Using an SSH Tunnel Between Oracle Key Vault and Database as a Service
- 6.3.1 Creating an SSH Tunnel Between Oracle Key Vault and a DBaaS Instance
- 6.3.2 Managing a Reverse SSH Tunnel in a Multi-Master Cluster
- 6.3.3 Managing a Reverse SSH Tunnel in a Primary-Standby Configuration
- 6.3.4 Viewing SSH Tunnel Configuration Details
- 6.3.5 Disabling an SSH Tunnel Connection
- 6.3.6 How the Connection Works if the SSH Tunnel Is Not Active
- 6.3.7 Deleting an SSH Tunnel Configuration
-
6.4
Registering and Enrolling a Database as a Service Instance as an Oracle Key Vault Endpoint
- 6.4.1 About Registering and Enrolling a Database as a Service Instance as an Oracle Key Vault Endpoint
- 6.4.2 Step 1: Register the Endpoint in the Oracle Key Vault Management Console
- 6.4.3 Step 2: Prepare the Endpoint Environment
- 6.4.4 Step 3: Install the Oracle Key Vault Software onto the Endpoint for Registration and Enrollment
- 6.4.5 Step 4: Perform Post-Installation Tasks
- 6.5 Suspending Database Cloud Service Access to Oracle Key Vault
- 6.6 Resuming Database Cloud Service Access to Oracle Key Vault
- 6.7 Resuming a Database Endpoint Configured with a Password-Based Keystore
-
7
Configuring Single Sign-On in
Oracle Key Vault
- 7.1 About Single Sign-On Authentication in Oracle Key Vault
- 7.2 Configuring SAML Single Sign-On (SSO) Authentication
- 7.3 Managing Single Sign-On in Oracle Key Vault
- 7.4 Configuring Single Sign-On for Oracle Key Vault and Azure Active Directory
- 7.5 Configuring Single Sign-On for Oracle Key Vault and ADFS
- 7.6 Guidelines for Managing Single Sign-On Configuration
-
8
Managing LDAP User Authentication and Authorization in Oracle Key Vault
- 8.1 About Managing LDAP User Authentication and Authorization in Oracle Key Vault
- 8.2 Considerations for Granting Privileges to LDAP Users
- 8.3 Configuring the LDAP Directory Server Connection to Oracle Key Vault
- 8.4 Logins to Oracle Key Vault as an LDAP User
- 8.5 Managing the LDAP Configuration
- 8.6 Managing LDAP Groups
- 8.7 Managing Oracle Key Vault-Generated LDAP Users
-
9
Managing Oracle Key Vault Users
-
9.1
Managing User Accounts
- 9.1.1 About Oracle Key Vault User Accounts
- 9.1.2 User Account Profile Parameters
-
9.1.3
How a Multi-Master Cluster Affects User Accounts
- 9.1.3.1 Multi-Master Cluster Effect on User Account Profile Parameters
- 9.1.3.2 Multi-Master Cluster Effect on System Administrator Users
- 9.1.3.3 Multi-Master Cluster Effect on Key Administrator Users
- 9.1.3.4 Multi-Master Cluster Effect on Audit Manager Users
- 9.1.3.5 Multi-Master Cluster Effect on Administration Users
- 9.1.3.6 Multi-Master Cluster Effect on System Users
- 9.1.4 Creating an Oracle Key Vault User Account
- 9.1.5 Viewing User Account Details
- 9.1.6 Deleting an Oracle Key Vault User Account
-
9.2
Managing Administrative Roles and User Privileges
- 9.2.1 About Managing Administrative Roles and User Privileges
- 9.2.2 Granting or Changing an Administrative Role of a User
- 9.2.3 Granting the Create Endpoint Privilege
- 9.2.4 Granting the Manage Endpoint Privilege
- 9.2.5 Granting the Create Endpoint Group Privilege
- 9.2.6 Granting the Manage Endpoint Group Privilege
- 9.2.7 Revoking an Administrative Role or Endpoint Privilege from a User
- 9.2.8 Granting a User Access to a Virtual Wallet
- 9.2.9 Enforce Separation of Administrator Roles
- 9.3 Managing User Passwords
- 9.4 Managing User Email
-
9.5
Managing User Groups
- 9.5.1 About Managing User Groups
- 9.5.2 How a Multi-Master Cluster Affects User Groups
- 9.5.3 Creating a User Group
- 9.5.4 Adding a User to a User Group
- 9.5.5 Granting a User Group Access to a Virtual Wallet
- 9.5.6 Renaming a User Group
- 9.5.7 Changing a User Group Description
- 9.5.8 Removing a User from a User Group
- 9.5.9 Deleting a User Group
- 9.6 Managing support and root Password
-
9.1
Managing User Accounts
-
10
Managing Oracle Key Vault Virtual Wallets and Security Objects
- 10.1 Managing Virtual Wallets
- 10.2 Managing Access to Virtual Wallets from Keys & Wallets Tab
- 10.3 Managing Access to Virtual Wallets from User’s Menu
- 10.4 Managing Security Objects
-
10.5
Managing the State of a Key or a Security Object
- 10.5.1 About Managing the State of a Key or a Security Object
- 10.5.2 How a Multi-Master Cluster Affects Keys and Security Objects
- 10.5.3 Activating a Key or Security Object
- 10.5.4 Deactivating a Key or Security Object
- 10.5.5 Revoking a Key or Security Object
- 10.5.6 Destroying a Key or Security Object
- 10.6 Managing the Extraction of Symmetric or Private Keys from Oracle Key Vault
- 10.7 Managing Details of Security Objects
-
11
Managing Oracle Key Vault Master Encryption Keys
-
11.1
Using the Persistent Master Encryption Key Cache
- 11.1.1 About the Persistent Master Encryption Key Cache
- 11.1.2 About Oracle Key Vault Persistent Master Encryption Key Cache Architecture
- 11.1.3 Caching Master Encryption Keys in the In-Memory and Persistent Master Encryption Key Cache
- 11.1.4 Storage Location of Persistent Master Encryption Key Cache
- 11.1.5 Persistent Master Encryption Key Cache Modes of Operation
- 11.1.6 Persistent Master Encryption Key Cache Refresh Window
-
11.1.7
Persistent Master Encryption Key Cache Parameters
- 11.1.7.1 PKCS11_CACHE_TIMEOUT Parameter
- 11.1.7.2 PKCS11_PERSISTENT_CACHE_TIMEOUT Parameter
- 11.1.7.3 PKCS11_PERSISTENT_CACHE_FIRST Parameter
- 11.1.7.4 PKCS11_CONFIG_PARAM_REFRESH_INTERVAL Parameter
- 11.1.7.5 PKCS11_PERSISTENT_CACHE_REFRESH_WINDOW Parameter
- 11.1.7.6 EXPIRE PKCS11 PERSISTENT CACHE ON DATABASE SHUTDOWN Parameter
- 11.1.8 Listing the Contents of the Persistent Master Key Cache
- 11.1.9 Oracle Database Deployments and Persistent Master Encryption Key Cache
- 11.2 Configuring an Oracle Key Vault to a New TDE-Enabled Database Connection
- 11.3 Migrating Existing TDE Wallets to Oracle Key Vault
- 11.4 Uploading and Downloading Oracle Wallets
- 11.5 Uploading and Downloading JKS and JCEKS Keystores
- 11.6 Using a User-Defined Key as the TDE Master Encryption Key
-
11.1
Using the Persistent Master Encryption Key Cache
-
12
Managing Oracle Key Vault Endpoints
- 12.1 Overview of Managing Endpoints
- 12.2 Managing Endpoints
- 12.3 Managing Endpoint Details
- 12.4 Managing Global and Per-Endpoint Configuration Parameters and Settings
- 12.5 Default Wallets and Endpoints
- 12.6 Managing Endpoint Access to a Virtual Wallet
-
12.7
Managing Endpoint Groups
- 12.7.1 How a Multi-Master Cluster Affects Endpoint Groups
- 12.7.2 Creating an Endpoint Group
- 12.7.3 Modifying Endpoint Group Details
- 12.7.4 Granting an Endpoint Group Access to a Virtual Wallet
- 12.7.5 Adding an Endpoint to an Endpoint Group
- 12.7.6 Removing an Endpoint from an Endpoint Group
- 12.7.7 Deleting Endpoint Groups
-
13
Enrolling and Upgrading Endpoints for Oracle Key Vault
- 13.1 About Endpoint Enrollment and Provisioning
- 13.2 Finalizing Enrollment and Provisioning
- 13.3 Environment Variables and Endpoint Provisioning Guidance
- 13.4 Endpoints That Do Not Use the Oracle Key Vault Client Software
- 13.5 Transparent Data Encryption Endpoint Management
- 13.6 Endpoint okvclient.ora Configuration File
- 13.7 okvclient.ora Parameters That Must Not Be Modified
- 13.8 Upgrading Endpoint Software
-
14
Managing Keys for Oracle Products
- 14.1 Using a TDE-Configured Oracle Database in an Oracle RAC Environment
- 14.2 Using a TDE-Configured Oracle Database in an Oracle GoldenGate Environment
-
14.3
Using a TDE-Configured Oracle Database in an Oracle Data Guard Environment
- 14.3.1 About Uploading Oracle Wallets in an Oracle Data Guard Environment
- 14.3.2 Uploading Oracle Wallets in an Oracle Data Guard Environment
- 14.3.3 Performing an Online Master Encryption Key Connection in an Oracle Data Guard Environment
- 14.3.4 Migrating Oracle Wallets in an Oracle Data Guard Environment
- 14.3.5 Reverse Migrating Oracle Wallets in an Oracle Data Guard Environment
- 14.3.6 Migrating an Oracle TDE Wallet to Oracle Key Vault for a Logical Standby Database
- 14.3.7 Checking the Oracle TDE Wallet Migration for a Logical Standby Database
- 14.4 Uploading Keystores from Automatic Storage Management to Oracle Key Vault
- 14.5 MySQL Integration with Oracle Key Vault
- 14.6 Other Oracle Database Features That Oracle Key Vault Supports
-
15
SSH Keys Management
Concepts
- 15.1 SSH Protocol
- 15.2 SSH Public Key Authentication
- 15.3 OpenSSH Implementation of the SSH Protocol
- 15.4 Challenges with SSH Public Key Authentication
- 15.5 Controlling Access to SSH Server Centrally with Oracle Key Vault
- 15.6 Managing SSH User Keys with Oracle Key Vault
- 15.7 Oracle Key Vault and SSH Integration
- 15.8 Supported Platforms for SSH Server and Client Endpoints
-
16
Management of SSH Keys - Setup and
Configuration
- 16.1 Setup SSH Admin
- 16.2 Controlling Access to SSH Server Centrally with Oracle Key Vault
- 16.3 Managing SSH User Keys with Oracle Key Vault
- 16.4 Oracle Key Vault and SSH Integration
- 16.5 Migrating Existing SSH Deployments to Oracle Key Vault
- 16.6 Guidelines for OpenSSH SSHD Configuration
- 16.7 Reports
-
17
Managing Online and Offline Secrets
- 17.1 Uploading and Downloading Credential Files
- 17.2 Managing Secrets and Credentials for SQL*Plus
- 17.3 Managing Secrets and Credentials for SSH
- 17.4 Integrating Oracle Key Vault with SSH Public Key Authentication
-
17.5
Centrally Managing Passwords in Oracle Key Vault
- 17.5.1 About Centrally Managing Passwords in Oracle Key Vault
- 17.5.2 Creating and Sharing Centrally Managed Passwords
- 17.5.3 Example: Script for Using External Keystore Passwords in SQL*Plus Operations
- 17.5.4 Sharing Secrets with Other Databases
- 17.5.5 Changing Passwords for a Large Database Deployment
-
18
Oracle Key Vault General System Administration
- 18.1 Overview of Oracle Key Vault General System Administration
-
18.2
Configuring Oracle Key Vault in a Non-Multi-Master Cluster Environment
- 18.2.1 Configuring the Network Details
- 18.2.2 Configuring Network Access
- 18.2.3 Configuring DNS
- 18.2.4 Configuring the System Time
- 18.2.5 Configuring FIPS Mode
- 18.2.6 Configuring Syslog
- 18.2.7 Changing the Network Interface Mode
- 18.2.8 Configuring RESTful Services Utility
- 18.2.9 Checking the Oracle Audit Vault Integration Status
- 18.2.10 Configuring the Oracle Key Vault Management Console Web Session Timeout
- 18.2.11 Restarting or Powering Off Oracle Key Vault
-
18.3
Configuring Oracle Key Vault in a Multi-Master Cluster Environment
- 18.3.1 About Configuring Oracle Key Vault in a Multi-Master Cluster Environment
-
18.3.2
Configuring System Settings for Individual Multi-Master Cluster Nodes
- 18.3.2.1 Configuring the Network Details for the Node
- 18.3.2.2 Configuring Network Access for the Node
- 18.3.2.3 Configuring DNS for the Node
- 18.3.2.4 Configuring the System Time for the Node
- 18.3.2.5 Configuring the FIPS Mode for the Node
- 18.3.2.6 Configuring Syslog for the Node
- 18.3.2.7 Changing the Network Interface Mode for the Node
- 18.3.2.8 Configuring Auditing for the Node
- 18.3.2.9 Configuring SNMP Settings for the Node
- 18.3.2.10 Checking the Oracle Audit Vault Integration for the Node
- 18.3.2.11 Restarting or Powering Off Oracle Key Vault from a Node
-
18.3.3
Managing Oracle Key Vault Multi-Master Clusters
- 18.3.3.1 Configuring the System Time for the Cluster
- 18.3.3.2 Configuring DNS for the Cluster
- 18.3.3.3 Configuring the Maximum Disable Node Duration for the Cluster
- 18.3.3.4 Configuring Syslog for the Cluster
- 18.3.3.5 Configuring RESTful Services for the Cluster
- 18.3.3.6 Configuring Auditing for the Cluster
- 18.3.3.7 Configuring SNMP Settings for the Cluster
- 18.3.3.8 Configuring the Oracle Key Vault Management Console Web Session Timeout for the Cluster
- 18.4 Managing System Recovery
- 18.5 Support for a Primary-Standby Environment
-
18.6
Commercial National Security Algorithm Suite Support
- 18.6.1 About Commercial National Security Algorithm Suite Support
- 18.6.2 Running the Commercial National Security Algorithm Scripts
- 18.6.3 Performing Backup Restore Operations with CNSA
- 18.6.4 Upgrading a Standalone Oracle Key Vault Server with CNSA
- 18.6.5 Upgrading Primary-Standby Oracle Key Vault Servers to Use CNSA
- 18.7 Minimizing Downtime
-
19
Managing Service
Certificates
- 19.1 Overview of Oracle Key Vault Certificates
- 19.2 Certificates Validity Period
-
19.3
Monitoring Certificates
Expiry
- 19.3.1 Monitoring Certificates Expiry Using Certificate Expiration Alerts
- 19.3.2 Finding the Expiration Date of Endpoint Certificates
- 19.3.3 CA Certificate Expiration Date on Status Page
- 19.3.4 Server and Node Certificate Expiration on Status Page
- 19.3.5 Finding the Expiration Date of the CA Certificate
- 19.3.6 Finding the Expiration Date of Server Certificates and Node Certificates
-
19.4
Managing CA Certificate
Rotation
- 19.4.1 Steps for Managing CA Certificate Rotation
- 19.4.2 Checking for Self-Signed Root CA or Intermediate CA Certificate
- 19.4.3 Setting the Key Length of the CA Certificate
- 19.4.4 Setting the Validity of Self-Signed Root CA Certificate
- 19.4.5 Setting Up the Intermediate CA Certificate
- 19.4.6 Rotating CA Certificate
- 19.4.7 Setting the Endpoint Certificate Rotation Batch Size
- 19.4.8 Setting the Endpoint Certificate Rotation Sequence
- 19.4.9 Checking Overall Certificate Rotation Status
- 19.4.10 Checking Certificate Rotation Status for Endpoints
- 19.4.11 Post-CA Certificate Rotation Tasks
- 19.4.12 Factors Affecting CA Certificate Rotation Process
- 19.4.13 Guidelines for Managing CA Certificate Rotations
- 19.5 Managing Server Certificates and Node Certificates Rotation
- 19.6 Managing the Oracle Key Vault CA Certificate After Expiry
- 19.7 Configuring Oracle Key Vault with an Alternate Hostname
- 20 Managing Console Certificates
-
21
Backup and Restore Operations
- 21.1 About Backing Up and Restoring Data in Oracle Key Vault
- 21.2 Oracle Key Vault Backup Destinations
- 21.3 Scheduled Backups and States
-
21.4
Scheduling and Managing Oracle Key Vault Backups
- 21.4.1 Scheduling a Backup for Oracle Key Vault
- 21.4.2 Changing a Backup Schedule for Oracle Key Vault
- 21.4.3 Deleting a Backup Schedule from Oracle Key Vault
- 21.4.4 How Primary-Standby Affects Oracle Key Vault Backups
- 21.4.5 How Using a Cluster Affects Oracle Key Vault Backups
- 21.4.6 Protecting the Backup Using the Recovery Passphrase
-
21.5
Restoring Oracle Key Vault Data
- 21.5.1 About the Oracle Key Vault Restore Process
- 21.5.2 Procedure for Restoring Oracle Key Vault Data
- 21.5.3 Multi-Master Cluster and the Restore Operation
- 21.5.4 Primary-Standby and the Restore Operation
- 21.5.5 Certificates and the Restore Operation
- 21.5.6 Changes Resulting from a System State Restore
-
21.6
Scheduling the Purging of Old Oracle Key Vault Backups
- 21.6.1 About Scheduling the Purging of Old Oracle Key Vault Backups
- 21.6.2 Creating a Backup Destination Policy
- 21.6.3 Adding a Backup Destination Policy to a Remote Backup Destination
- 21.6.4 Changing a Backup Destination Policy
- 21.6.5 Suspending a Backup Destination Policy
- 21.6.6 Resuming a Suspended Backup Destination Policy
- 21.6.7 Deleting a Backup Destination Policy
- 21.6.8 Finding Information about Backup Destination Policies
- 21.7 Manually Deleting a Local Oracle Key Vault Backup
-
21.8
Configuring Oracle ZFS Storage Appliance to Store Oracle Key Vault Backups
- 21.8.1 Step 1: Create a Storage Project in Oracle ZFS Storage Appliance
- 21.8.2 Step 2: Copy the Oracle Key Vault Public Key to the Oracle ZFS Storage Appliance
- 21.8.3 Step 3: Complete Creating the Oracle ZFS Storage Appliance Project
- 21.8.4 Step 4: Configure Oracle Key Vault to Connect to the Oracle ZFS Storage Appliance Project
- 21.9 Backup and Restore Best Practices
-
22
Monitoring and Auditing Oracle Key Vault
-
22.1
Managing System Monitoring
-
22.1.1
Configuring Remote Monitoring to Use SNMP
- 22.1.1.1 About Using SNMP for Oracle Key Vault
- 22.1.1.2 Granting SNMP Access to Users
- 22.1.1.3 Changing the SNMP User Name and Password
- 22.1.1.4 Changing SNMP Settings on the Standby Server
- 22.1.1.5 Remotely Monitoring Oracle Key Vault Using SNMP
- 22.1.1.6 SNMP Management Information Base Variables for Oracle Key Vault
- 22.1.1.7 Example: Simplified Remote Monitoring of Oracle Key Vault Using SNMP
- 22.1.1.8 Configuring SNMP to Work with Old SNMP Clients
- 22.1.2 Configuring Email Notification
- 22.1.3 Configuring the Syslog Destination for Individual Multi-Master Cluster Nodes
- 22.1.4 Capturing System Diagnostics
- 22.1.5 Monitoring System Metrics
-
22.1.1
Configuring Remote Monitoring to Use SNMP
- 22.2 Configuring Oracle Key Vault Alerts
-
22.3
Managing System Auditing
- 22.3.1 About Auditing in Oracle Key Vault
- 22.3.2 Oracle Key Vault Audit Trail
-
22.3.3
Oracle Key Vault Audit
Configuration
- 22.3.3.1 About Oracle Key Vault Audit Configuration
- 22.3.3.2 Configuring All Events Auditing
- 22.3.3.3 Configuring Custom Events Auditing
- 22.3.3.4 Configuring Auditing on Event Categories
- 22.3.3.5 Including Specific Audit Event IDs for Auditing
- 22.3.3.6 Excluding Specific Audit Event IDs from Auditing
- 22.3.4 Viewing Audit Records
- 22.3.5 Exporting and Deleting Audit Records Manually
- 22.3.6 Deleting Audit Records Automatically
- 22.3.7 Oracle Key Vault Audit Event IDs
-
22.3.8
Configuring Oracle Key Vault with Oracle Audit Vault
- 22.3.8.1 Integrating Oracle Audit Vault with Oracle Key Vault
- 22.3.8.2 Viewing Oracle Key Vault Audit Data Collected by Oracle Audit Vault
- 22.3.8.3 Suspending an Oracle Audit Vault Monitoring Operation
- 22.3.8.4 Resuming an Oracle Audit Vault Monitoring Operation
- 22.3.8.5 Deleting an Oracle Audit Vault Integration
- 22.3.8.6 Guidance for Integrating Oracle Audit Vault in a Multi-Master Cluster or Primary-Standby Environment
- 22.4 Using Oracle Key Vault Reports
-
22.1
Managing System Monitoring
-
23
Managing an Oracle Key Vault Primary-Standby Configuration
-
23.1
Overview of the Oracle Key Vault Primary-Standby Configuration
- 23.1.1 About the Oracle Key Vault Primary-Standby Configuration
- 23.1.2 Benefits of an Oracle Key Vault Primary-Standby Configuration
- 23.1.3 Difference Between Primary-Standby Configuration and Multi-Master Cluster
- 23.1.4 Primary Server Role in a Primary-Standby Configuration
- 23.1.5 Standby Server Role in a Primary-Standby Configuration
- 23.2 Configuring the Primary-Standby Environment
- 23.3 Switching the Primary and Standby Servers
- 23.4 Restoring Primary-Standby After a Failover
- 23.5 Disabling (Unpairing) the Primary-Standby Configuration
-
23.6
Read-Only Restricted Mode in a Primary-Standby Configuration
- 23.6.1 About Read-Only Restricted Mode in a Primary-Standby Configuration
- 23.6.2 Primary-Standby with Read-Only Restricted Mode
- 23.6.3 Primary-Standby without Read-Only Restricted Mode
- 23.6.4 States of Read-Only Restricted Mode
- 23.6.5 Enabling Read-Only Restricted Mode
- 23.6.6 Disabling Read-Only Restricted Mode
- 23.6.7 Recovering from Read-Only Restricted Mode
- 23.6.8 Read-Only Restricted Mode Notifications
- 23.7 Best Practices for Using Oracle Key Vault in a Primary-Standby Configuration
-
23.1
Overview of the Oracle Key Vault Primary-Standby Configuration
- A Oracle Key Vault Multi-Master Cluster Operations
-
B
Oracle Key Vault okvutil Endpoint Utility Reference
- B.1 About the okvutil Utility
- B.2 okvutil Command Syntax
- B.3 okvutil changepwd Command
- B.4 okvutil diagnostics Command
- B.5 okvutil download Command
- B.6 okvutil list Command
- B.7 okvutil upload Command
- B.8 okvutil sign Command
- B.9 okvutil sign-verify Command
- B.10 okvutil show Command
- B.11 okvutil Common Errors
-
C
Troubleshooting Oracle Key Vault
- C.1 Before You Start Troubleshooting
- C.2 Common Oracle Key Vault Tasks
-
C.3
okvutil and Endpoint
Issues
- C.3.1 Database Wallet Status Not Open or Not Found, TDE HEARTBEAT Check Failed
- C.3.2 Oracle Key Vault Server Communication or Connection Failed Error
- C.3.3 Could Not Store Private Key Errors on Wallet Upload
- C.3.4 RESTful Services Endpoint Provisioning Command Failure
- C.3.5 Uploading Certificate File Failure
- C.3.6 Error in Uploading the Java Keystore
- C.3.7 SSL layer Error while migrating MYSQL Database Keys to Oracle Key Vault
- C.3.8 Rotation or Set Key Failure in Windows Environment
- C.3.9 Rotation or Set Key Fails with ORA-03113
- C.4 Multi-Master Cluster Issues
- C.5 Backup and Restore Issues
- C.6 Certificate Related Issues
-
C.7
Installation and Upgrade
Issues
- C.7.1 Oracle Key Vault Installation Failure
- C.7.2 Oracle Key Vault Upgrade Failure
- C.7.3 Oracle Key Vault Management Console is Not Accessible After Installation
- C.7.4 Oracle Key Vault Upgrade Failure
- C.7.5 Unable to boot after installation of Oracle Key Vault on VMWare VM
- C.7.6 Operation Failed on Network Information Screen After Upgrade from 21.x to 21.5 and Later.
- C.8 Primary-Standby Configuration Issues
- C.9 DBCS Endpoint Configuration Issues
- C.10 Server and Node Issues
- D Security Technical Implementation Guides Compliance Standards
-
E
Managing Oracle Key Vault Platform
Certificates
- E.1 Overview of Oracle Key Vault Platform Certificates
- E.2 Monitoring Oracle Key Vault Platform Certificate Expiration
-
E.3
Rotating Platform
Certificates
- E.3.1 Rotating Platform Certificates on a Standalone Oracle Key Vault Server
-
E.3.2
Rotating Platform Certificates in
a Multi-Master Cluster Environment
- E.3.2.1 Rotate Platform CA Certificate on Read/Write Multi-Master Cluster Nodes
- E.3.2.2 Rotate Platform CA Certificate on Read-Only Multi-Master Cluster Nodes
- E.3.2.3 Rotate Platform Certificate Used For Redo Shipping On Any One Multi-Master Cluster Node
- E.3.2.4 Transfer the Rotated Redo Shipping Platform Certificate to Other Multi-Master Cluster Nodes
- Glossary
- Index