Create the TDE master encryption key

Open the HSM key store, and then create the TDE master encryption key. Oracle Database sends the CryptoHub endpoint PIN to the Futurex PKCS #11 library, and the library logs in to CryptoHub as the endpoint identity.

Put the CryptoHub endpoint PIN in double quotes in every IDENTIFIED BY clause. Without double quotes, Oracle Database changes the value to uppercase, and CryptoHub rejects the login.

In the commands on this page, replace CRYPTOHUB_ENDPOINT_PIN with the PIN that you copied from fxpkcs11.cfg.

Connect to the database as SYSDBA:

sqlplus / as sysdba

Open the HSM key store:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "CRYPTOHUB_ENDPOINT_PIN";

Oracle Database returns keystore altered.

Create the TDE master encryption key on CryptoHub:

ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "CRYPTOHUB_ENDPOINT_PIN" WITH BACKUP;

Oracle Database returns keystore altered.

Confirm that the HSM key store is open:

SELECT WRL_TYPE, STATUS, WALLET_TYPE FROM v$encryption_wallet;

The output shows this row:

WRL_TYPE             STATUS                         WALLET_TYPE
-------------------- ------------------------------ --------------------
HSM                  OPEN                           HSM

Record the ID of the master encryption key:

SELECT masterkeyid FROM v$database_key_info;

The master encryption key on CryptoHub has a label that starts with ORACLE.TDE.HSM.MK.06 and then this ID. You use the ID to find the key in CryptoHub when you verify the integration.

The HSM key store stays open until you close it or the database stops. Unless you configure auto-login, you must open the HSM key store after every database restart. The next page configures auto-login.

Continue to Configure auto-login for the HSM key store.