Setting up the Oracle environment and the Futurex PKCS #11 Library

4min

If you plan to run Oracle Database in a Docker container, skip this section. A later section covers the steps to set up the Oracle environment and configure the  PKCS #11 library for container implementation.
Set up Oracle Database environment
The oraenv tool sets up the Oracle database environment for the current session and allows the use of the sqlplus command. To set the Oracle environment, run the commands shown in the following example. 
When prompted, specify the system ID (SID) for the instance (orcl in this example) or use the default value indicated between the brackets in line 4 in the following sample. All instances on the system require a unique SID.
Shell
$ su oracle

$ cd ~

$ . /usr/local/bin/oraenv
ORACLE_SID = [oracle] ? orcl
$ su oracle

$ cd ~

$ . /usr/local/bin/oraenv
ORACLE_SID = [oracle] ? orcl
﻿
Upon success, the command returns the following message:
Shell
The Oracle base has been set to /home/oracle/app/oracle
The Oracle base has been set to /home/oracle/app/oracle
﻿
Set the ENCRYPTION_WALLET_LOCATION
The ENCRYPTION_WALLET_LOCATION parameter specifies the location of the Oracle wallet. You must modify this parameter to specify the use of an HSM in place of the software wallet. Use the following steps to set the ENCRYPTION_WALLET_LOCATION parameter.
1
Go to the $ORACLE_HOME/network/admin directory.
Shell
$ env | grep ORACLE_HOME
ORACLE_HOME=/home/oracle/app/oracle/product/12.2.0/dbhome_1

$ cd /home/oracle/app/oracle/product/12.2.0/dbhome_1/network/admin
$ env | grep ORACLE_HOME
ORACLE_HOME=/home/oracle/app/oracle/product/12.2.0/dbhome_1

$ cd /home/oracle/app/oracle/product/12.2.0/dbhome_1/network/admin
﻿
2
Open the sqlnet.ora file in a text editor. If the ENCRYPTION_WALLET_LOCATION parameter is already present, change the METHOD value to HSM. If the ENCRYPTION_WALLET_LOCATION parameter is not present, add the parameter as follows:
Text
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=HSM))
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=HSM))
﻿
If a DIRECTORY value is present in the ENCRYPTION_WALLET_LOCATION parameter, do not delete it. Although the  does not require a DIRECTORY value, the value specifies the locatation of the old software wallet when migrating to HSM-based TDE. Also, the DIRECTORY value might be required by tools such as the Recovery Manager (RMAN) to locate the software wallet.
3
Save and close the file.
Copy the Futurex PKCS #11 library to the correct path
1
Copy the  PKCS #11 library file (libfxpkcs11.so) to the path /opt/oracle/extapi/[32,64]/hsm/futurex/X.X/ where X.X is the library version.
2
Copy the PKCS11Manager and fxpkcs11.cfg files into the /etc directory.
﻿
﻿
﻿
﻿

Updated 26 Aug 2024

Did this page help you?

Configure TLS authentication

Edit the Futurex PKCS #11 configuration file