Configure Oracle Database for the HSM key store

Oracle Database 19c uses two initialization parameters to find its key store:

WALLET_ROOT sets the directory for key store files. Oracle Database needs this directory even when the master encryption key is on an HSM. You also use it for the auto-login key store later in this guide.
TDE_CONFIGURATION sets the key store type. The value KEYSTORE_CONFIGURATION=HSM tells Oracle Database to use the PKCS #11 library.

These parameters replace the ENCRYPTION_WALLET_LOCATION setting in sqlnet.ora. If sqlnet.ora has an ENCRYPTION_WALLET_LOCATION entry, remove it.

This guide configures a database that does not use TDE yet. If the database already has TDE master encryption keys in a software key store or in a different HSM, you must migrate those keys. A new master encryption key on CryptoHub cannot decrypt data that an earlier master encryption key protects. For the migration steps, see [Managing the Keystore and the Master Encryption Key](https://docs.oracle.com/en/database/oracle/oracle-database/19/asoag/managing-key store-and-tde-master-encryption-key.html) in the Oracle documentation.

Create the wallet directory

As the Oracle software owner, create the wallet directory:

su - oracle
mkdir -p /u01/app/oracle/admin/ORCL/wallet
chmod 700 /u01/app/oracle/admin/ORCL/wallet

Set the initialization parameters

Connect to the database as SYSDBA:

export ORACLE_HOME=/u01/app/oracle/product/19.0.0/db_1
export ORACLE_SID=ORCL
export PATH=$ORACLE_HOME/bin:$PATH
sqlplus / as sysdba

Set WALLET_ROOT. This parameter is static, so Oracle Database applies it at the next startup:

ALTER SYSTEM SET WALLET_ROOT='/u01/app/oracle/admin/ORCL/wallet' SCOPE=SPFILE;

Restart the database:

SHUTDOWN IMMEDIATE;
STARTUP;

Set TDE_CONFIGURATION to use the HSM key store. This parameter is dynamic, so it does not need a restart:

ALTER SYSTEM SET TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=HSM" SCOPE=BOTH;

Confirm the parameter values:

SELECT name, value FROM v$parameter WHERE name IN ('wallet_root', 'tde_configuration');

The output shows these values:

NAME                 VALUE
-------------------- --------------------------------------------------
wallet_root          /u01/app/oracle/admin/ORCL/wallet
tde_configuration    KEYSTORE_CONFIGURATION=HSM

Continue to Create the TDE master encryption key.

​Create the wallet directory

​Set the initialization parameters

Create the wallet directory

Set the initialization parameters