Appendix: Migrate from a software keystore to an HSM keystore

4min
This section provides instructions about migrating a preexisting software keystore to an HSM keystore.
Preparation
To perform this process, enable the following command on the role you created for the integration:
Command
Description
﻿
GPED
General Purpose Encryption and Decryption
﻿
Migrate the keystore
Perform the following steps to migrate a software keystore to a HSM keystore:
1
Connect to your database as the sysdba user:
Shell
sqlplus / as sysdba
sqlplus / as sysdba
﻿
2
Configure the Wallet Root parameter to point to the libfxpkcs11.so file:
SQL
ALTER SYSTEM SET WALLET_ROOT = '/opt/oracle/extapi/64/hsm/futurex/4.45/libfxpkcs11.so' SCOPE=SPFILE;
ALTER SYSTEM SET WALLET_ROOT = '/opt/oracle/extapi/64/hsm/futurex/4.45/libfxpkcs11.so' SCOPE=SPFILE;
﻿
3
Stop and restart the database:
SQL
SHUTDOWN IMMEDIATE;

STARTUP;
SHUTDOWN IMMEDIATE;

STARTUP;
﻿
4
Configure the TDE_CONFIGURATION parameter for using an HSM:
SQL
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM' SCOPE=BOTH SID='*';
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM' SCOPE=BOTH SID='*';
﻿
5
Stop and restart the database:
SQL
SHUTDOWN IMMEDIATE;

STARTUP;
SHUTDOWN IMMEDIATE;

STARTUP;
﻿
6
Open the HSM KeyStore by using the identity password created on the HSM:
SQL
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "hsm_identity_pass";
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "hsm_identity_pass";
﻿
7
Change back to the software keystore wallet location:
SQL
ALTER SYSTEM SET WALLET_ROOT = '/PATH/TO/SOFTWARE/WALLET' SCOPE=SPFILE;
ALTER SYSTEM SET WALLET_ROOT = '/PATH/TO/SOFTWARE/WALLET' SCOPE=SPFILE;
﻿
8
Stop and restart the database:
SQL
SHUTDOWN IMMEDIATE;

STARTUP;
SHUTDOWN IMMEDIATE;

STARTUP;
﻿
9
Configure the TDE_CONFIGURATION parameter for FILE:
SQL
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=FILE' SCOPE=BOTH SID='*';
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=FILE' SCOPE=BOTH SID='*';
﻿
10
Stop and restart the database:
SQL
SHUTDOWN IMMEDIATE;

STARTUP;
SHUTDOWN IMMEDIATE;

STARTUP;
﻿
11
Open the software keystore:
SQL
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY sw_keystore_pass;
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY sw_keystore_pass;
﻿
12
Add the HSM identity password as a secret to the Software Keystore:
SQL
ADMINISTER KEY MANAGEMENT ADD SECRET 'hsm_identity_pass' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY sw_keystore_pass WITH BACKUP;
ADMINISTER KEY MANAGEMENT ADD SECRET 'hsm_identity_pass' FOR CLIENT 'HSM_PASSWORD' IDENTIFIED BY sw_keystore_pass WITH BACKUP;
﻿
13
Alter the software keystore password to match the hsm_identity_pass to convert a software keystore to open with the HSM keystore:
SQL
ADMINISTER KEY MANAGEMENT ALTER KEYSTORE PASSWORD FORCE KEYSTORE IDENTIFIED BY sw_keystore_pass SET hsm_identity_pass WITH BACKUP;

ADMINISTER KEY MANAGEMENT ALTER KEYSTORE PASSWORD FORCE KEYSTORE IDENTIFIED BY sw_keystore_pass SET hsm_identity_pass WITH BACKUP;
﻿
sw_keystore_pass and the hsm_identity_pass are now the same.
14
Create an autologin and specify the software keystore by using the keystore location:
SQL
ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE '/PATH/TO/SOFTWARE/WALLET' IDENTIFIED BY software_keystore_pass;
ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE '/PATH/TO/SOFTWARE/WALLET' IDENTIFIED BY software_keystore_pass;
﻿
15
Switch the TDE_CONFIGURATION parameter to HSM and FILE:
SQL
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM|FILE' SCOPE=BOTH SID = '*';
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM|FILE' SCOPE=BOTH SID = '*';
﻿
16
Stop and restart the database:
SQL
SHUTDOWN IMMEDIATE;

STARTUP;
SHUTDOWN IMMEDIATE;

STARTUP;
﻿
17
Confirm that both the FILE and HSM keystores are open with no master key for the HSM keystore:
SQL
SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;
﻿
You should see an output similar to the following:
SQL
SQL> SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;

WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
WALLET_TYPE	     STATUS
-------------------- ------------------------------
FILE
/u01/app/oracle/admin/orcl/wallet/tde/
AUTOLOGIN	     OPEN

HSM

HSM		     OPEN_NO_MASTER_KEY

SQL> SELECT WRL_TYPE, WRL_PARAMETER, WALLET_TYPE, STATUS FROM V$ENCRYPTION_WALLET;

WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
WALLET_TYPE	     STATUS
-------------------- ------------------------------
FILE
/u01/app/oracle/admin/orcl/wallet/tde/
AUTOLOGIN	     OPEN

HSM

HSM		     OPEN_NO_MASTER_KEY
﻿
18
Migrate the software keystore to the HSM keystore:
SQL
ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY IDENTIFIED BY "hsm_identity_pass" MIGRATE USING sw_keystore_pass;
ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY IDENTIFIED BY "hsm_identity_pass" MIGRATE USING sw_keystore_pass;
﻿
19
Switch the TDE_CONFIGURATION to HSM and confirm that you can still decrypt your database with just the HSM Keystore. Confirm that the keys are present on the HSM as well.
SQL
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM' SCOPE=BOTH SID='*';
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM' SCOPE=BOTH SID='*';
﻿
﻿
﻿
﻿
﻿
Updated 27 Aug 2024
Did this page help you?
Opening the wallet or hardware keystore
Digital signing