Backup Encryption test scenario
Configure the Software Keystore Location
Set the WALLET_ROOT and TDE_CONFIGURATION parameters.
SQL> ALTER SYSTEM SET WALLET_ROOT=’C:\app\orauser\admin\testdb\wallet’ SCOPE=SPFILE SID=’*’;
System altered.
Restart the database for effective the above parameter
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
Total System Global Area 1073738560 bytes
Fixed Size 9036608 bytes
Variable Size 276824064 bytes
Database Buffers 780140544 bytes
Redo Buffers 7737344 bytes
Database mounted.
Database opened.
SQL> show parameter wallet_root
NAME TYPE VALUE
———————————— ———– ——————————
wallet_root string C:\APP\ORAUSER\ADMIN\TESTDB\WA
LLET
SQL> ALTER SYSTEM SET TDE_CONFIGURATION=”KEYSTORE_CONFIGURATION=FILE” SCOPE=BOTH SID=’*’;
System altered.
Creating a Password-Protected Software Keystore:
SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY Oracle123Ace;
keystore altered.
SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY Oracle123Ace;
keystore altered.
SQL> SELECT STATUS FROM V$ENCRYPTION_WALLET;
STATUS
——————————
OPEN_NO_MASTER_KEY
Set the master encryption key by executing the following command:
SQL> set linesize 120
SQL> col wrl_parameter format a45
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS WALLET_TYPE
——————– ——————————————— —————————— ——————–
WALLET_OR KEYSTORE FULLY_BAC CON_ID
——— ——– ——— ———-
FILE C:\APP\ORAUSER\ADMIN\TESTDB\WALLET\tde OPEN PASSWORD
SINGLE NONE NO 0
Wallet files location :
Backup database :
RMAN> CONFIGURE ENCRYPTION FOR DATABASE on;
new RMAN configuration parameters:
CONFIGURE ENCRYPTION FOR DATABASE ON;
new RMAN configuration parameters are successfully stored
RMAN> backup database;
Starting backup at 15-MAR-22
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=40 device type=DISK
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00001 name=C:\APP\ORAUSER\ORADATA\TESTDB\SYSTEM01.DBF
input datafile file number=00003 name=C:\APP\ORAUSER\ORADATA\TESTDB\SYSAUX01.DBF
input datafile file number=00004 name=C:\APP\ORAUSER\ORADATA\TESTDB\UNDOTBS01.DBF
input datafile file number=00007 name=C:\APP\ORAUSER\ORADATA\TESTDB\USERS01.DBF
channel ORA_DISK_1: starting piece 1 at 15-MAR-22
channel ORA_DISK_1: finished piece 1 at 15-MAR-22
piece handle=C:\APP\ORAUSER\FAST_RECOVERY_AREA\TESTDB\BACKUPSET\2022_03_15\O1_MF_NNNDF_TAG20220315T180619_K31BVDZ6_.BKP tag=TAG20220315T180619 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:45
Finished backup at 15-MAR-22
Starting Control File and SPFILE Autobackup at 15-MAR-22
piece handle=C:\APP\ORAUSER\FAST_RECOVERY_AREA\TESTDB\AUTOBACKUP\2022_03_15\O1_MF_S_1099418825_K31BWTDZ_.BKP comment=NONE
Finished Control File and SPFILE Autobackup at 15-MAR-22
Restore database without open wallet :
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> exit
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.9.0.0.0
C:\Users\mazar>sqlplus / as sysdba
SQL*Plus: Release 19.0.0.0.0 – Production on Tue Mar 15 18:10:17 2022
Version 19.9.0.0.0
Copyright (c) 1982, 2020, Oracle. All rights reserved.
Connected to an idle instance.
SQL> startup mount
ORACLE instance started.
Total System Global Area 1073738560 bytes
Fixed Size 9036608 bytes
Variable Size 276824064 bytes
Database Buffers 780140544 bytes
Redo Buffers 7737344 bytes
Database mounted.
SQL> select * from v$encryption_wallet;
WRL_TYPE
——————–
WRL_PARAMETER
——————————————————————————–
STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC
—————————— ——————– ——— ——– ———
CON_ID
———-
FILE
C:\APP\ORAUSER\ADMIN\TESTDB\WALLET\TDE\tde\
CLOSED UNKNOWN SINGLE NONE UNDEFINED
0
SQL>
C:\Users\mazar>rman target /
Recovery Manager: Release 19.0.0.0.0 – Production on Tue Mar 15 18:13:28 2022
Version 19.9.0.0.0
Copyright (c) 1982, 2020, Oracle and/or its affiliates. All rights reserved.
connected to target database: TESTDB (DBID=2882744687, not open)
RMAN> restore database;
Starting restore at 15-MAR-22
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=258 device type=DISK
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00001 to C:\APP\ORAUSER\ORADATA\TESTDB\SYSTEM01.DBF
channel ORA_DISK_1: restoring datafile 00003 to C:\APP\ORAUSER\ORADATA\TESTDB\SYSAUX01.DBF
channel ORA_DISK_1: restoring datafile 00004 to C:\APP\ORAUSER\ORADATA\TESTDB\UNDOTBS01.DBF
channel ORA_DISK_1: restoring datafile 00007 to C:\APP\ORAUSER\ORADATA\TESTDB\USERS01.DBF
channel ORA_DISK_1: reading from backup piece C:\APP\ORAUSER\FAST_RECOVERY_AREA\TESTDB\BACKUPSET\2022_03_15\O1_MF_NNNDF_TAG20220315T180619_K31BVDZ6_.BKP
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of restore command at 03/15/2022 18:13:45
ORA-19870: error while restoring backup piece C:\APP\ORAUSER\FAST_RECOVERY_AREA\TESTDB\BACKUPSET\2022_03_15\O1_MF_NNNDF_TAG20220315T180619_K31BVDZ6_.BKP
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open
RMAN>
Restore database after opened wallet :
SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY Oracle123Ace;
keystore altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE
——————–
WRL_PARAMETER
——————————————————————————–
STATUS WALLET_TYPE WALLET_OR KEYSTORE FULLY_BAC
—————————— ——————– ——— ——– ———
CON_ID
———-
FILE
C:\APP\ORAUSER\ADMIN\TESTDB\WALLET\tde
OPEN PASSWORD SINGLE NONE NO
0
RMAN> restore database;
Starting restore at 15-MAR-22
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=20 device type=DISK
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00001 to C:\APP\ORAUSER\ORADATA\TESTDB\SYSTEM01.DBF
channel ORA_DISK_1: restoring datafile 00003 to C:\APP\ORAUSER\ORADATA\TESTDB\SYSAUX01.DBF
channel ORA_DISK_1: restoring datafile 00004 to C:\APP\ORAUSER\ORADATA\TESTDB\UNDOTBS01.DBF
channel ORA_DISK_1: restoring datafile 00007 to C:\APP\ORAUSER\ORADATA\TESTDB\USERS01.DBF
channel ORA_DISK_1: reading from backup piece C:\APP\ORAUSER\FAST_RECOVERY_AREA\TESTDB\BACKUPSET\2022_03_15\O1_MF_NNNDF_TAG20220315T180619_K31BVDZ6_.BKP
channel ORA_DISK_1: piece handle=C:\APP\ORAUSER\FAST_RECOVERY_AREA\TESTDB\BACKUPSET\2022_03_15\O1_MF_NNNDF_TAG20220315T180619_K31BVDZ6_.BKP tag=TAG20220315T180619
channel ORA_DISK_1: restored backup piece 1
channel ORA_DISK_1: restore complete, elapsed time: 00:00:25
Finished restore at 15-MAR-22
RMAN> recover database;
Starting recover at 15-MAR-22
using channel ORA_DISK_1
starting media recovery
media recovery complete, elapsed time: 00:00:01
Finished recover at 15-MAR-22
RMAN> alter database open;
Statement processed
RMAN>
Auto login wallet can able to enable. If its enable, it will automatically open the wallet
If we suppose need to restore the database, we need to copy wallet file manually to the target server and enable wallet location, open the wallet with key and restore database .