Wallet encryption or Transparent Data Encryption (TDE) in Oracle

For more information about TDE or wallet please refer the Oracle Documentation via below link.

https://docs.oracle.com/cd/B28359_01/network.111/b28530/asotrans.htm#g1011122

Basic Description what is Wallet Open issue all about??

Oracle has many security features available within the database, but until now there has been no "out-of-the-box" method for protecting the data at the operating system level. The Transparent Data Encryption (TDE) feature introduced in Oracle 10g Database Release 2 allows sensitive data to be encrypted within the datafiles to prevent access to it from the operating system
.

In this blog we will try to solve the

ORA-28365: wallet is not open in Oracle Database 

Basic Note:

Encrypted Column

Before attempting to create a table with encrypted columns, a wallet must be created to hold the encryption key. The search order for finding the wallet is as follows:

    If present, the location specified by the ENCRYPTION_WALLET_LOCATION parameter in the sqlnet.ora file.
    If present, the location specified by the WALLET_LOCATION parameter in the sqlnet.ora file.
    The default location for the wallet. If the $ORACLE_BASE is set, this is "$ORACLE_BASE/admin/DB_UNIQUE_NAME/wallet", otherwise it is "$ORACLE_HOME/admin/DB_UNIQUE_NAME/wallet", where DB_UNIQUE_NAME comes from the initialization parameter file.
   
    If above directories is not present then definitely will be present in $ORACLE_HOME/network/admin/sqlnet.ora  file

We must complete three steps to encrypt our data.

    Create a Wallet
    Create a Tablespace
    Test the encryption

Login to DB


db name:rms


select * from v$encryption_wallet;


If it is open good - WRL_TYPE             WRL_PARAMETER             STATUS

-------------------- ------------------------- ----------

file                 /rms/admin/wallet        OPEN


If status is showing CLOSED , then we have to reset the password of wallet


Solution to ORA-28365:wallet is not open in oracle database.


1.       Go to ORARMS server as oracle user.

2.       Move to $ORACLE_HOME/network/admin

3.       Cat sqlnet.ora file like below and look for ENCRYPTION_WALLET_LOCATION

 

 

  

 

 

Step-5 

The below step may be different in different project.
the goal is to just we have to find out the where the password of wallet has been encrypted.
So identify that particualr file

************************************************************************************************
Now go to /rman/admin/scripts and look for oracle process start script.

 xyz server >/rms/admin/scripts=>ls -lrt *start*sh
-rwxr-x---    1 oracle   oradba         1584 Dec 25 2012  rms_start_oracle.ksh
xyz server > /rms/admin/scripts=>cat rms_start_oracle.ksh
In the file we will see below 2 commands

startup

ALTER SYSTEM SET WALLET OPEN IDENTIFIED BY "jpkin8y";
alter system set encryption key identified by "jpkin8y";

*********************************************************************************************** 

1.        

    Step 6. Issue the above commands in database (alter the same password) and ask user to check to access table.

Done !!

Reset the password using above query and  validate the wallet status  ,even if after resetting the password, wallet is still closed. Then,

Follow the below steps:

To validate password of wallet:

Caution: Never open the Wallet file through (cat ewallet.p12),there might be chances of corruption of the file. So never ever do that


So how to do it:

Do scp the wallet file to another server




Now log into ORARPM server and set the profile and execute the below command


orapki wallet display -wallet <<wallet file location>> -pwd "jpkin8y"
So in present scenario:


ABC server:/apps/oracle> . /rpm/admin/profile/oracle.profile


ABC server:/apps/oracle> orapki wallet display -wallet /apps/oracle/ -pwd "jpkin8y"

Requested Certificates:

Subject:        CN=oracle

User Certificates:

Oracle Secret Store entries:

ORACLE.SECURITY.DB.ENCRYPTION.AaaX/NUg508Lv+Losykrc8MAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.ARkOtZ4z50+kv3mpSfhAAecAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.ASuYQTrtgk+Mv3LH+baJMSUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AU2H1URpZE8Xv+F0i5NViLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AUVk1fGkBk/Xv38cdYdMHjQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AV/gVEG7kk8Cvy4c15h+b5cAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AWyox3b9eU8lv6uhDXkscB0AAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AX8aZ50Uwk9sv9W0EdlJtxYAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AXHnru4QG0/Av3mOLJg7D8UAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY

ORACLE.SECURITY.TS.ENCRYPTION.BYTeDm1KmVWZ2tqqLXpGDbECAwAAAAAAAAAAAAAAAAAAAAAAAAAA

Trusted Certificates:

Subject:        CN=STANDALONE EIX.COM,OU=I.T.,O=Edison International,L=Irvine,ST=CA,C=US

Subject:        Email=hugo.reyes@sce.com,CN=EPP,OU=PP,O=SCE,L=ROSEMEAD,ST=CA,C=US

Subject:        CN=STANDALONE EIX.COM,OU=I.T.,O=Edison International,L=Irvine,ST=CA,C=US




If contents are coming it means password is good and if not password is not working