In united mode, the keystore that you create in the CDB root will be accessible by the united mode PDBs.

In general, to configure a united mode software keystore after you have enabled united mode, you create and open the keystore in the CDB root, and then create a master encryption key for this keystore. Afterward, you can begin to encrypt data for tables and tablespaces that will be accessible throughout the CDB environment.

The V$ENCRYPTION_WALLET dynamic view describes the status and location of the keystore. For example, the following query shows the open-closed status and the keystore location of the CDB root keystore (CON_ID 1) and its associated united mode PDBs. The WRL_PARAMETER column shows the CDB root keystore location being in the $ORACLE_BASE/wallet/tde directory.

SELECT CON_ID, STATUS, WRL_PARAMETER FROM V$ENCRYPTION_WALLET;

CON_ID STATUS WRL_PARAMETER
------ ------ -----------------------------
     1 OPEN   /app/oracle/wallet/tde/
     2 CLOSED 
     3 OPEN 
     4 OPEN
     5 OPEN  

In this output, there is no keystore path listed for the other PDBs in this CDB because these PDBs use the keystore in the CDB root. If any of these PDBs are isolated and you create a keystore in the isolated mode PDB, then when you perform this query, the WRL_PARAMETER column will show the keystore path for the isolated mode PDB.

You can create a secure external store for the software keystore. This feature enables you to hide the password from the operating system: it removes the need for storing clear-text keystore passwords in scripts or other tools that can access the database without user intervention, such as overnight batch scripts. The location for this keystore is set by the EXTERNAL_KEYSTORE_CREDENTIAL_LOCATION initialization parameter. In a multitenant environment, different PDBs can access this external store location when you run the ADMINISTER KEY MANAGEMENT statement using the IDENTIFIED BY EXTERNAL STORE clause. This way, you can centrally locate the password and then update it only once in the external store.

In united mode, you must create the keystore in the CDB root.

1. Connect to the CDB root as a common user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
   For example:

   CONNECT c##sec_admin AS SYSKM
   Enter password: password

2. Use the SHOW PARAMETER command to confirm that WALLET_ROOT is set, and TDE_CONFIGURATION is set to KEYSTORE_CONFIGURATION=FILE.
3. Run the ADMINISTER KEY MANAGEMENT SQL statement to create the keystore using the following syntax:

   ADMINISTER KEY MANAGEMENT CREATE KEYSTORE 
   IDENTIFIED BY TDE_wallet_password;
   

   The /tde directory is automatically created under WALLET_ROOT, if it does not already exist. In Oracle Automatic Storage Management (Oracle ASM), for the /tde directory to be automatically created if it does not already exist, WALLET_ROOT must point to +DATA/ORACLE_UNQNAME.

   In this specification, TDE_wallet_password is the password of the TDe wallet that you, the security administrator, creates.

   For example, to create the TDE wallet in the WALLET_ROOT/tde directory:

   ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY TDE_wallet_password;
   
   keystore altered.
   

   After you run this statement, the ewallet.p12 file, which is the TDE wallet, appears in the wallet location.

To open a TDE wallet in united mode, you must use the ADMINISTER KEY MANAGEMENT statement with the SET KEYSTORE OPEN clause.

1. Connect to the CDB root as a common user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
2. Open the TDE wallet in the CDB root.
   For example:

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   IDENTIFIED BY password;
   
   keystore altered.

   If the CDB is configured with the TDE wallet password stored in WALLET_ROOT/tde_seps and has a (local) auto-login TDE wallet in WALLET_ROOT/tde, you must include the FORCE KEYSTORE clause and the IDENTIFIED BY EXTERNAL STORE clause in the ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN statement, as follows:

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   FORCE KEYSTORE 
   IDENTIFIED BY EXTERNAL STORE;
   
   keystore altered.

   If the WALLET_ROOT parameter has been set, then Oracle Database finds the external store in the WALLET_ROOT/tde_seps directory.

3. Ensure that the PDB in which you want to open the TDE wallet is in READ WRITE mode.
   For example:

   SHOW PDBS
   
   CON_ID CON_NAME   OPEN MODE    RESTRICTED
   ------ ---------- ------------ -----------
   2      PDB$SEED   READ ONLY    NO
   3      CDB1_PDB1  READ WRITE   NO

   If any PDB has an OPEN MODE value that is different from READ WRITE, then run the following statement to open the PDB, which will set it to READ WRITE mode:

   ALTER PLUGGABLE DATABASE CDB1_PDB1 OPEN;

   Now the TDE wallet can be opened in both the CDB root and the PDB.

4. Connect to the PDB.
5. Run the ADMINISTER KEY MANAGEMENT statement to open the TDE wallet.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   IDENTIFIED BY password | EXTERNAL STORE;
   keystore altered.

   To open a password-protected TDE wallet when a (local) auto-login TDE wallet is open, specify the FORCE KEYSTORE clause as follows.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN 
   FORCE KEYSTORE 
   IDENTIFIED BY TDE_wallet_password | EXTERNAL STORE;
   keystore altered.

   FORCE KEYSTORE is also useful for databases that are heavily loaded. The IDENTIFIED BY EXTERNAL STORE clause is included in the statement because the TDE wallet credentials exist in an external store. This enables the password-protected TDE wallet to be opened without specifying the TDE wallet password within the statement itself.

   If the WALLET_ROOT parameter has been set in the CDB, then united PDBs find the external store in the WALLET_ROOT/tde_seps directory.

6. Confirm that the TDE wallet is open.

   SELECT STATUS FROM V$ENCRYPTION_WALLET;

To set the TDE master encryption key in the TDE wallet when the PDB is configured in united mode, use the ADMINISTER KEY MANAGEMENT statement with the SET KEY clause.

1. Log in to the CDB root or to the PDB that is configured for united mode as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
2. Ensure that the database is open in READ WRITE mode.
   To find the status, run the show pdbs command.
3. Run the ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY statement to create or rekey the TDE master encryption key in the TDE wallet.
   For example, if the TDE wallet is password-protected and open, and you want to create or rekey the TDE master encryption key in the current container:

   ADMINISTER KEY MANAGEMENT SET KEY 
   IDENTIFIED BY keystore_password 
   WITH BACKUP USING 'emp_key_backup';
   
   keystore altered.

   If the keystore is closed:

   ADMINISTER KEY MANAGEMENT SET KEY 
   FORCE KEYSTORE
   IDENTIFIED BY keystore_password 
   WITH BACKUP USING 'emp_key_backup';
   
   keystore altered.

   In this specification:

   • FORCE KEYSTORE should be included if the TDE wallet is closed. This automatically opens the keystore before setting the TDE master encryption key. The FORCE KEYSTORE clause also switches over to opening the password-protected TDE wallet when an auto-login keystore is configured and is currently open.

   • IDENTIFIED BY specifies the TDE wallet password. Alternatively, if the TDE wallet password is in an external store, you can use the IDENTIFIED BY EXTERNAL STORE clause.

4. Confirm that the TDE master encryption key is set.

   SELECT MASTERKEY_ACTIVATED FROM V$DATABASE_KEY_INFO;

   The output should be YES.

In united mode, you can configure Oracle Key Vault by setting the WALLET_ROOT and TDE_CONFIGURATION parameters in the container database (CDB).

Oracle recommends that you set the parameters WALLET_ROOT and TDE_CONFIGURATION for new deployments. Alternatively, you can migrate from the old configuration in the sqlnet.ora file to the new configuration with WALLET_ROOT and TDE_CONFIGURATION at your earliest convenience (for example, the next time you apply a quarterly bundle patch).

United Mode is the default TDE setup that is used in Oracle Database release 12.1.0.2 and later with the TDE configuration in sqlnet.ora. In Oracle Database release 18c and later, TDE configuration in sqlnet.ora is deprecated. You must first set the static initialization parameter WALLET_ROOT to an existing directory; for this change to be picked up, a database restart is necessary. After the restart, set the KEYSTORE_CONFIGURATION attribute of the dynamic TDE_CONFIGURATION parameter to OKV (for a password-protected connection into Oracle Key Vault), or OKV|FILE for an auto-open connection into Oracle Key Vault, and then open the configured external keystore, and then set the TDE master encryption keys. After you complete these tasks, you can begin to encrypt data in your database.

Now that you have completed the configuration for an external keystore or for an Oracle Key Vault keystore, you can begin to encrypt data.

You can change the password of either a TDE wallet or an external keystore only in the CDB root.

You can close both TDE wallet and external keystores in united mode, unless the system tablespace is encrypted.

To create a user-defined TDE master encryption key, use the ADMINISTER KEY MANAGEMENT statement with the SET | CREATE [ENCRYPTION] KEY clause.

1. Connect to the CDB root as a common user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
2. Create the user-defined TDE master encryption key by using the following syntax:

   ADMINISTER KEY MANAGEMENT SET | CREATE [ENCRYPTION] KEY
   '[mkid:mk | mk]' 
   [USING ALGORITHM 'algorithm'] 
   [FORCE KEYSTORE]
   IDENTIFIED BY [EXTERNAL STORE | keystore_password] 
   [WITH BACKUP [USING 'backup_identifier']];

   In this specification:

   • SET | CREATE : Enter SET if you want to create the master and activate the TDE master encryption key now, or select CREATE if you want to create the key for later use, without activating it yet. For SET KEY and USE KEY, you must be connected to the database that is supposed to use that key (CDB root container, united or isolated PDB). For CREATE KEY, you can be connected any united PDB, or the CDB root container, or the specific isolated PDB that is supposed to use that key later.

   • mkid and mk:

     • mkid, the TDE master encryption key ID, is a 16–byte hex-encoded value that you can specify or have Oracle Database generate.

     • mk, the TDE master encryption key, is a hex-encoded value that you can specify or have Oracle Database generate, either 32 bytes (for the for AES256, ARIA256, and GOST256 algorithms) or 16 bytes (for the SEED128 algorithm).

     If you omit the mkid:mk|mkid clause but include the mk value, then Oracle Database generates the mkid for the mk.

     If you omit the entire mkid:mk|mkid clause, then Oracle Database generates these values for you.

   • USING ALGORITHM: Specify one of the following supported algorithms:

     • AES256

     • ARIA256

     • SEED128

     • GOST256

     If you omit the algorithm, then the default, AES256, is used.

   • FORCE KEYSTORE temporarily opens the password-protected TDE wallet for this operation. You must open the TDE wallet for this operation.

   The following example creates a TDE master encryption key without the key-ID is when a database administrator performs that operation:

   First, generate the TDE master encryption key. For example, using OpenSSL:

   $ openssl rand -hex 32
   f24ce8cdae39742b5da7293da206fbd05a28b1e44c4781f801768cfdc3dbb6e2

   Set (create and activate) this ARIA master key with the following ADMINISTER KEY MANAGEMENT statement:

   ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY 
   'f24ce8cdae39742b5da7293da206fbd05a28b1e44c4781f801768cfdc3dbb6e2' 
   USING ALGORITHM 'ARIA256'
   FORCE KEYSTORE
   IDENTIFIED BY EXTERNAL STORE
   WITH BACKUP USING 'backup_identifier';

   The next example, where TDE master encryption key and key-ID are generated outside of the database, shows how to support separation of duties. A key administrator inserts the key with a key_ID into the wallet by using the ADMINISTER KEY MANAGEMENT CREATE [ENCRYPTION] KEY statement. Then, the key administrator sends the key_ID to the database administrator, who then activates the key by using the ADMINISTER KEY MANAGEMENT USE KEY clause.

   1. Create the key-ID, converting characters to upper case. For example, using OpenSSL:

      $ openssl rand 16 | xxd -u -p
      D20765EB721AF44D054B30FE87F8E49A

   2. Create the TDE master encryption key. For example, using OpenSSL:

      $ openssl rand -hex 32
      5a089c8ea6ee21cba774f61e58d102665df4a979a34757836b3d066a3eb3db11

   3. Create (but do not activate) a default AES256 master encryption key by inserting both the random key-ID and the key itself, separated by a :, into the wallet.

      ADMINISTER KEY MANAGEMENT CREATE ENCRYPTION KEY
      'D20765EB721AF44D054B30FE87F8E49A:5a089c8ea6ee21cba774f61e58d102665df4a979a34757836b3d066a3eb3db11'
      IDENTIFIED BY [EXTERNAL STORE | keystore_password]
      WITH BACKUP USING 'backup_identifier' WITH BACKUP;

   4. The database administrator can retrieve the BASE64 key-ID from the database with the following SELECT statement:

      SELECT ' ADMINISTER KEY MANAGEMENT USE KEY '''||KEY_ID||''' 
      USING TAG '''||SYS_CONTEXT('USERENV', 'CON_NAME')||' '||TO_CHAR (SYS_EXTRACT_UTC (SYSTIMESTAMP), 
      'YYYY-MM-DD HH24:MI:SS"Z"')||''' 
      FORCE KEYSTORE 
      IDENTIFIED BY EXTERNAL STORE WITH BACKUP;
      ' AS "USE KEY COMMAND" FROM DUAL, V$ENCRYPTION_KEYS WHERE TAG IS NULL;

A keystore must be opened before you can create a TDE master encryption key for use later on in united mode.

1. Log in to the CDB root or the united mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
2. Create the TDE master encryption key by using the following syntax:

   ADMINISTER KEY MANAGEMENT CREATE [ENCRYPTION] KEY 
   [FORCE KEYSTORE]
   [USING TAG 'tag_name']
   IDENTIFIED BY [EXTERNAL STORE | keystore_password] 
   [WITH BACKUP [USING 'backup_identifier']]
   [CONTAINER = ALL | CURRENT];
   

   In this specification:

   • FORCE KEYSTORE temporarily opens the password-protected TDE wallet for this operation. You must open the TDE wallet for this operation.

   • CONTAINER: In the CDB root, set CONTAINER to either ALL or CURRENT. In a PDB, set it to CURRENT. In both cases, omitting CONTAINER defaults to CURRENT.

   For example:

   ADMINISTER KEY MANAGEMENT CREATE KEY 
   FORCE KEYSTORE 
   IDENTIFIED BY keystore_password
   WITH BACKUP
   CONTAINER = CURRENT;

3. If necessary, activate the TDE master encryption key.
   1. Find the key ID.

      SELECT KEY_ID FROM V$ENCRYPTION_KEYS; 
      
      KEY_ID
      ----------------------------------------------------
      AWsHwVYC2U+Nv3RVphn/yAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

   2. Use this key ID to activate the key.

      ADMINISTER KEY MANAGEMENT USE KEY 
      'AWsHwVYC2U+Nv3RVphn/yAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' 
      USING TAG 'quarter:second;description:Activate Key on standby' 
      IDENTIFIED BY password 
      WITH BACKUP;

In united mode, you can move an existing TDE master encryption key into a new keystore from an existing software password keystore.

1. Log in to the CDB root or the united mode PDB as a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
2. Query the KEY_ID column of the V$ENCRYPTION_KEYS view to find the key identifier of the keystore to which you want to move the keys.
   For example:

   SELECT CREATION_TIME, KEY_ID FROM V$ENCRYPTION_KEYS; 
   
   CREATION TIME
   ----------------------------------------------------
   22-SEP-17 08.55.12.956170 PM +00:00
   
   KEY_ID
   ----------------------------------------------------
   ARaHD762tUkkvyLgPzAi6hMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

3. Move the key into a new keystore by using the following syntax:

   ADMINISTER KEY MANAGEMENT 
   MOVE [ENCRYPTION] KEYS
   TO NEW KEYSTORE 'keystore_location1'
   IDENTIFIED BY keystore1_password
   FROM [FORCE] KEYSTORE
   IDENTIFIED BY keystore_password
   [WITH IDENTIFIER IN
   { 'key_identififier' [, 'key_identifier' ]... | ( subquery ) } ]
   [WITH BACKUP [USING 'backup_identifier']];

   In this specification:

   • keystore_location1 is the path to the wallet directory that will store the new keystore .p12 file. By default, this directory is in $ORACLE_BASE/admin/db_unique_name/wallet.

   • FORCE temporarily opens the keystore for this operation.

   • keystore_password is the password for the keystore from which the key is moving.

   For example:

   ADMINISTER KEY MANAGEMENT MOVE KEYS 
   TO NEW KEYSTORE '$ORACLE_BASE/admin/orcl/wallet' 
   IDENTIFIED BY keystore_password 
   FROM FORCE KEYSTORE 
   IDENTIFIED BY keystore_password 
   WITH IDENTIFIER IN 
   (SELECT KEY_ID FROM V$ENCRYPTION_KEYS WHERE ROWNUM < 2)
   WITH BACKUP;

4. To delete the old keystore, go to the wallet directory and then manually delete the .p12 file containing the keystore.
   To find the location of the keystore, open the keystores, and then query the WRL_PARAMETER column of the V$ENCRYPTION_WALLET view.

In united mode, the REMOVE_INACTIVE_STANDBY_TDE_MASTER_KEY initialization parameter can configure the automatic removal of inactive TDE master encryption keys.

1. Log in to the server where the CDB root or the united mode PDB of the Oracle standby database resides.
2. Locate the initialization parameter file for the database.
   By default, the initialization parameter fileis located in the $ORACLE_HOME/dbs directory.
3. Edit the initialization parameter file to include the REMOVE_INACTIVE_STANDBY_TDE_MASTER_KEY initialization parameter.
   For example:

   remove_inactive_standby_tde_master_key = true

   Setting this parameter to TRUE enables the automatic removal of inactive TDE master encryption keys; setting it to FALSE disables the automatic removal.

Isolating a PDB keystore moves the master encryption key from the CDB root keystore into an isolated mode keystore in the a PDB.

1. Connect to the CDB root as a common user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege.
2. Move the keys from the keystore of the CDB root into the isolated mode keystore of the PDB by using the following syntax:

   ADMINISTER KEY MANAGEMENT [FORCE] ISOLATE KEYSTORE
   IDENTIFIED BY isolated_keystore_password
   FROM ROOT KEYSTORE
   [FORCE KEYSTORE]
   IDENTIFIED BY
   [EXTERNAL STORE | united_keystore_password]
   [WITH BACKUP [USING backup_id]];

   In this specification:

   • FORCE is used when a clone of the PDB is using the master encryption key that is being isolated. The ADMINISTER KEY MANAGEMENT statement then copies (rather than moves) the keys from the wallet of the CDB root into the isolated mode PDB.

   • FORCE KEYSTORE temporarily opens the password-protected TDE wallet for this operation if an auto-login TDE wallet is open (and in use) or if the TDE wallet is closed.

   • united_keystore_password: Knowledge of this password does not enable the user who performs the ISOLATE KEYSTORE operation privileges to perform ADMINISTER KEY MANAGEMENT UNITE KEYSTORE operations on the CDB root. This password is the same as the keystore password in the CDB root.

   After the keystore of a CDB root has been united with that of a PDB, all of the previously active (historical) master encryption keys that were associated with the CDB are moved to the keystore of the PDB.
3. Confirm that the united mode PDB is now an isolated mode PDB.

   SELECT KEYSTORE_MODE FROM V$ENCRYPTION_WALLET;

   The output should be ISOLATED.

You can clone or relocate encrypted PDBs within the same container database, or across container databases.

• Clone or relocate the non-CDB or PDB using the following syntax:

  CREATE|RELOCATE PLUGGABLE DATABASE database_name KEYSTORE 
  IDENTIFIED BY EXTERNAL STORE|target_keystore_password [NO REKEY];

In united mode, you can clone a PDB that has encrypted data in a CDB.