Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in Oracle Key Vault 12.2

• New Features in Bundle Patch 11
  • Re-Enroll All Endpoints With a Single RESTful Command
• New Features in Bundle Patch 10
  • Oracle Key Vault Server Certificate Rotation
  • Re-Enroll All Endpoints With a Single RESTful Command
  • Periodically Verify Oracle Key Vault Access to RoT in HSM in Alert Job
• New Features in Bundle Patch 9
• New Features in Bundle Patch 8
• New Features in Bundle Patch 7
  • Automatic Endpoint Configuration tuning using OKV Management Console
  • UEFI BOOT MODE Support 
  • Support for IBM AIX 5.3 Endpoint Platform
• New Features in Bundle Patch 6
  • Quick Discovery of Unreachable Key Vault Server
  • Extend Persistent Master Key Cache for Improved Resiliency with Unavailable Key Vault Servers
  • Support for Bring Your Own TDE Master Encryption Keys
  • Update SNMP Settings on Standby Server
  • New Alerts for High Availability Operations
    • Generate alert when FSFO failure causes HA configuration process to fail
    • Generate alert when HA nodes are not successfully synchronized
  • New install option to update the Oracle database-specific okvclient.ora symlink
  • Support for Oracle Database 12.2.0.1.0 on Windows Server 2008 and 2012
• New Features in Bundle Patch 5
  • Support for Read- Only Restricted Mode
  • Additional Attributes on the All Items page to improve Key Searchability
  • Support for Sending Audit Records to Remote Syslog
  • Persistent Cache - New Mode and Lookup
  • Upgraded to Oracle Linux 6.9
  • Two Disc Installation
• New Features in Bundle Patch 4
  • Support for Oracle Database 11.2.0.4 (BP 9 and later) and 12.1.0.2 on Windows Server 2008 and 2012
• New Features in Bundle Patch 3
  • Persistent Master Key Cache
  • Integration with nCipher Hardware Security Module (HSM)
  • Support for NIST CNSA Suite
  • SMTP Business Service for Email Notification
  • New REST API to Manage Virtual Wallets
• New Features in Bundle Patch 2
  • Support for New Endpoint Platforms
  • Support for Modern Hardware
  • Preconfigured Management Reports
  • Compliance
  • Third-party CA support for the Management Console
  • Automatic Email Notifications
  • Remote Monitoring via SNMP v3
  • Automation of Endpoint Enrollment Using the RESTful Software Utility
  • Audit consolidation using Oracle Audit Vault and Database Firewall
  • Diagnostics
• New Features in Bundle Patch 1
  • Support for Oracle Cloud Database as a Service Endpoints
  • Oracle Key Vault HSM Integration

1 Introduction to Oracle Key Vault

• 1.1 About Oracle Key Vault and Key Management
• 1.2 Benefits of Using Oracle Key Vault
• 1.3 Who Should Use Oracle Key Vault?
• 1.4 Major Features of Oracle Key Vault
  • 1.4.1 Centralized Storage and Management of Security Objects
  • 1.4.2 Management of Key Lifecycle
  • 1.4.3 Reporting and Alerts
  • 1.4.4 Separation of Duties for Oracle Key Vault Users
  • 1.4.5 Support for a High Availability Environment
  • 1.4.6 Persistent Master Key Cache
  • 1.4.7 Backup and Restore Functionality for Security Objects
  • 1.4.8 Automation of Endpoint Enrollment Using Protected RESTful Services
  • 1.4.9 Support for OASIS Key Management Interoperability Protocol (KMIP)
  • 1.4.10 Database Version and Platform Support
  • 1.4.11 Integration with External Audit and Monitoring Services
  • 1.4.12 MySQL Integration with Oracle Key Vault
• 1.5 Oracle Key Vault Interfaces
• 1.6 Overview of a Successful Oracle Key Vault Deployment

2 Oracle Key Vault Concepts

• 2.1 Overview of Oracle Key Vault Concepts
• 2.2 Oracle Key Vault Deployment Architecture
• 2.3 Oracle Key Vault Use Cases
  • 2.3.1 Centralized Storage of Oracle Wallet Files and Java Keystores
  • 2.3.2 Centralized Management of TDE Master Keys Using Online Master Key
  • 2.3.3 Storage of Credential Files
• 2.4 Access Control Configuration
  • 2.4.1 About Access Control Configuration
  • 2.4.2 Access Grants
  • 2.4.3 Access Control Options
• 2.5 Administrative Roles within Oracle Key Vault
  • 2.5.1 About Administrative Roles in Oracle Key Vault
  • 2.5.2 Separation of Duties
  • 2.5.3 Overview of Administrative Roles
  • 2.5.4 Emergency System Recovery Process
• 2.6 Endpoint Administrators

3 Oracle Key Vault Installation and Configuration

• 3.1 Oracle Key Vault Installation Requirements
  • 3.1.1 System Requirements
  • 3.1.2 Network Ports
  • 3.1.3 Supported Endpoint Platforms
  • 3.1.4 Endpoint Database Requirements
• 3.2 Installing and Configuring Oracle Key Vault 12.2.0.5.0 and Later
  • 3.2.1 Downloading the Oracle Key Vault Appliance Software
  • 3.2.2 Installing the Oracle Key Vault Appliance Software
  • 3.2.3 Performing Post-Installation Tasks
• 3.3 Logging In to the Oracle Key Vault Management Console
• 3.4 Overview of the Management Console
• 3.5 Performing Actions and Searches
  • 3.5.1 Actions Menus
  • 3.5.2 Search Bars

4 High Availability, Backup and Restore Operations

• 4.1 Why High Availability?
• 4.2 About High Availability for Oracle Key Vault
  • 4.2.1 How High Availability for Oracle Key Vault Works
  • 4.2.2 Configuring High Availability
  • 4.2.3 Switching Primary and Standby Servers
  • 4.2.4 Restoring High Availability After a Failover
  • 4.2.5 Disabling High Availability
  • 4.2.6 High Availability Read-Only Restricted Mode
    • 4.2.6.1 About High Availability Read-Only Restricted Mode
      • 4.2.6.1.1 How High Availability Read-Only Restricted Mode Works
      • 4.2.6.1.2 High Availability without Read-Only Restricted Mode
      • 4.2.6.1.3 High Availability with Read-Only Restricted Mode
    • 4.2.6.2 States of Read-Only Restricted Mode
    • 4.2.6.3 Recovering from Read-Only Restricted Mode
    • 4.2.6.4 Read-Only Restricted State Functionality
    • 4.2.6.5 Enabling Read-Only Restricted Mode
    • 4.2.6.6 Disabling Read-Only Restricted Mode
    • 4.2.6.7 Best Practices
• 4.3 Backup and Restore Oracle Key Vault Data
  • 4.3.1 About Backing Up and Restoring Data in Key Vault
  • 4.3.2 Backing Up Key Vault Data
    • 4.3.2.1 About Key Vault Backup Destinations
    • 4.3.2.2 Create a Remote Backup Destination
    • 4.3.2.3 Change Settings on a Remote Backup Destination
    • 4.3.2.4 Delete a Remote Backup Destination
  • 4.3.3 About Backup Schedule Types and States
    • 4.3.3.1 Two Types of Key Vault Backups
    • 4.3.3.2 Scheduled Backup States in Key Vault
  • 4.3.4 Scheduling and Managing Key Vault Backups
    • 4.3.4.1 Schedule a Backup on Key Vault
    • 4.3.4.2 Change Backup Schedule on Oracle Key Vault
    • 4.3.4.3 Delete a Backup Schedule from Key Vault
    • 4.3.4.4 How High Availability Affects Key Vault Backups
    • 4.3.4.5 Protecting the Backup Using the Recovery Passphrase
  • 4.3.5 Restoring Oracle Key Vault Data
    • 4.3.5.1 About the Key Vault Restore Process
    • 4.3.5.2 Restore Key Vault Data
    • 4.3.5.3 High Availability and the Restore Operation
    • 4.3.5.4 Third-Party Certificates and the Restore Operation
    • 4.3.5.5 Changes Resulting from a System State Restore
  • 4.3.6 Backup and Restore Best Practices

5 Managing Oracle Key Vault Users

• 5.1 About Oracle Key Vault Users
  • 5.1.1 Types of Oracle Key Vault Users
  • 5.1.2 Create an Oracle Key Vault User
  • 5.1.3 Grant, Change or Revoke Administrative Roles
    • 5.1.3.1 Grant or Change an Administrative Role of a User
    • 5.1.3.2 Revoke an Administrative Role from a User
  • 5.1.4 Delete Oracle Key Vault User(s)
  • 5.1.5 View User Details
• 5.2 About Changing User Passwords
  • 5.2.1 How User Password Changes Work
  • 5.2.2 Change Your Own Password
  • 5.2.3 Reset Another User's Password
    • 5.2.3.1 Reset Password Manually
    • 5.2.3.2 Reset Password Automatically
    • 5.2.3.3 Reset Operating System User Account Passwords
• 5.3 Grant a User Access to a Virtual Wallet
• 5.4 About User Email
  • 5.4.1 Disable Email Notifications for a User
  • 5.4.2 Change User Email
• 5.5 Manage User Groups
  • 5.5.1 How User Groups Work
  • 5.5.2 Create a User Group
  • 5.5.3 Add a User to a User Group
  • 5.5.4 Remove a User from a User Group
  • 5.5.5 Grant a User Group Access to a Virtual Wallet
  • 5.5.6 Modify User Group Description
  • 5.5.7 Delete a User Group

6 Managing Oracle Key Vault Virtual Wallets and Security Objects

• 6.1 About Virtual Wallets
  • 6.1.1 How Virtual Wallets Work
  • 6.1.2 Create a Virtual Wallet
  • 6.1.3 Add Security Objects to a Virtual Wallet
  • 6.1.4 Remove Security Objects from a Virtual Wallet
  • 6.1.5 Delete a Virtual Wallet
• 6.2 Manage Access to Virtual Wallets from Keys & Wallets Menu
  • 6.2.1 How Access to Virtual Wallets from Keys & Wallets Menu Works
  • 6.2.2 Grant Access to Endpoint Groups, Endpoints, User Groups, and Users
  • 6.2.3 Modify Access to Endpoint Groups, Endpoints, User Groups, and Users
• 6.3 Manage Access to Virtual Wallets from User’s Menu
  • 6.3.1 How Access to Virtual Wallets from User's Menu Works
  • 6.3.2 Grant a User Access to a Virtual Wallet
  • 6.3.3 Revoke User Access from a Virtual Wallet
  • 6.3.4 Grant a User Group Access to a Virtual Wallet
  • 6.3.5 Revoke User Group Access from a Virtual Wallet
• 6.4 Manage State of a Security Object
  • 6.4.1 Activate a Key or Security Object
  • 6.4.2 Deactivate a Key or Security Object
  • 6.4.3 Revoke a Key or Security Object
  • 6.4.4 Destroy a Key or Security Object
• 6.5 Manage Details of Security Objects
  • 6.5.1 Search for Security Object Items
  • 6.5.2 View Details of a Security Object
  • 6.5.3 Add or Modify Details of a Security Object

7 Managing Oracle Key Vault Endpoints

• 7.1 About Managing Endpoints
• 7.2 Managing Endpoints
  • 7.2.1 Types of Endpoint Enrollment
  • 7.2.2 Add an Endpoint as a Key Vault System Administrator
  • 7.2.3 Add an Endpoint Using Self-Enrollment
  • 7.2.4 Configuring Endpoint Configuration Parameters
  • 7.2.5 Delete, Suspend or Reenroll Endpoints
    • 7.2.5.1 About Deleting Endpoints
    • 7.2.5.2 Delete One or More Endpoint(s)
    • 7.2.5.3 Delete one Endpoint
    • 7.2.5.4 Suspend one Endpoint
    • 7.2.5.5 Reenroll an Endpoint
• 7.3 Manage Endpoint Access to a Virtual Wallet
  • 7.3.1 Grant an Endpoint Access to a Virtual Wallet
  • 7.3.2 Revoke Endpoint Access to a Virtual Wallet
  • 7.3.3 View Wallet Items
• 7.4 Associate a Default Wallet with an Endpoint
• 7.5 Set the Default Wallet for an Endpoint
• 7.6 Manage Endpoint Groups
  • 7.6.1 Create an Endpoint Group
  • 7.6.2 Modify Endpoint Group Details
  • 7.6.3 Grant an Endpoint Group Access to a Virtual Wallet
  • 7.6.4 Remove an Endpoint from an Endpoint Group
  • 7.6.5 Delete Endpoint Groups
• 7.7 Manage Endpoint Details
  • 7.7.1 About Endpoint Details
  • 7.7.2 Modify Endpoint Details
  • 7.7.3 Add an Endpoint to an Endpoint Group
  • 7.7.4 Configuring Global Endpoint Configuration Parameters
  • 7.7.5 Delete an Endpoint from an Endpoint Group
  • 7.7.6 Upgrade Endpoint Software

8 Enrolling Endpoints for Oracle Key Vault

• 8.1 About Endpoints for Oracle Key Vault
• 8.2 Overview of Endpoint Enrollment and Provisioning
• 8.3 Finalizing Enrollment and Provisioning
  • 8.3.1 Task 1: Enroll Endpoint and Download Software
  • 8.3.2 Task 2: Install Oracle Key Vault Software on the Endpoint
• 8.4 Special Notes About Endpoint Provisioning
• 8.5 Transparent Data Encryption Endpoint Management
• 8.6 Endpoint okvclient.ora Configuration File
• 8.7 Oracle Key Vault okvutil Endpoint Utility Reference
  • 8.7.1 About the okvutil Utility
  • 8.7.2 okvutil Command Syntax
  • 8.7.3 okvutil upload Command
  • 8.7.4 okvutil list Command
  • 8.7.5 okvutil download Command
  • 8.7.6 okvutil changepwd Command
  • 8.7.7 okvutil diagnostics Command
• 8.8 Upgrading Endpoint Software on an Enrolled Endpoint

9 Oracle Cloud Database as a Service Endpoints

• 9.1 About Managing Database as a Service Endpoints
• 9.2 Preparing a Database as a Service Instance to be an Oracle Key Vault Endpoint
  • 9.2.1 Setup a Database Cloud Service Instance
  • 9.2.2 Create Low Privileged Operating System User on Database as a Service
• 9.3 Set up an SSH Tunnel between Key Vault and Database as a Service Instance
• 9.4 Manageability of SSH Tunnel
• 9.5 Register and Enroll Database as a Service Instance as Key Vault Endpoint
• 9.6 Suspend a Database Cloud Service's Access to Oracle Key Vault
• 9.7 Resume a Database Cloud Service's Access to Oracle Key Vault
• 9.8 Resuming a Database Endpoint Configured with a Password-based Keystore

10 Endpoint Enrollment Automation with RESTful Services

• 10.1 About RESTful Services
• 10.2 Enable RESTful Services
  • 10.2.1 Step 1: Enable Network Services
  • 10.2.2 Step 2: Enable RESTful Services
  • 10.2.3 Step 3: Download the RESTful Software Utility
• 10.3 Creating the RESTful Services Configuration File
• 10.4 Examples of Configuration Files
• 10.5 Executing a Single RESTful Command
• 10.6 Executing Multiple RESTful Commands Using a Script
• 10.7 Script Creation Guidelines
• 10.8 Disable RESTful Services
• 10.9 RESTful Services Command Reference
  • 10.9.1 RESTful Services Command Syntax
  • 10.9.2 RESTful Services Wallet Command Syntax
  • 10.9.3 Commands to Add and Enroll Endpoints
    • 10.9.3.1 create_endpoint Command
    • 10.9.3.2 get_enrollment_token Command
    • 10.9.3.3 download Command
    • 10.9.3.4 provision Command
    • 10.9.3.5 re_enroll Command
    • 10.9.3.6 re_enroll_all Command
    • 10.9.3.7 delete_endpoint Command
  • 10.9.4 Modify Endpoint Details Commands
    • 10.9.4.1 modify_endpoint_name Command
    • 10.9.4.2 modify_endpoint_type Command
    • 10.9.4.3 modify_endpoint_platform Command
    • 10.9.4.4 modify_endpoint_desc Command
    • 10.9.4.5 modify_endpoint_email Command
  • 10.9.5 Endpoint Group Commands
    • 10.9.5.1 create_endpoint_group Command
    • 10.9.5.2 add_epg_member Command
    • 10.9.5.3 drop_epg_member Command
    • 10.9.5.4 delete_endpoint_group Command
    • 10.9.5.5 modify_endpoint_group_desc Command
  • 10.9.6 Virtual Wallet Commands
    • 10.9.6.1 create_wallet Command
    • 10.9.6.2 modify_wallet_desc Command
    • 10.9.6.3 add_wallet_access_ep Command
    • 10.9.6.4 modify_wallet_access_ep Command
    • 10.9.6.5 drop_wallet_access_ep Command
    • 10.9.6.6 set_default_wallet Command
    • 10.9.6.7 get_default_wallet Command
    • 10.9.6.8 get_wallets Command
    • 10.9.6.9 add_wallet_access_epg Command
    • 10.9.6.10 modify_wallet_access_epg Command
    • 10.9.6.11 drop_wallet_access_epg Command
    • 10.9.6.12 delete_wallet Command
  • 10.9.7 Error Reporting
    • 10.9.7.1 About Error Reporting
    • 10.9.7.2 Command Line Error Reporting
    • 10.9.7.3 Error Reporting while Running Commands from a Script
    • 10.9.7.4 See Valid Options Using -h or --help
    • 10.9.7.5 See List of RESTful Commands Using -H or --list

11 Oracle Key Vault Use Case Scenarios

• 11.1 Uploading and Downloading Oracle Wallets
  • 11.1.1 About Uploading and Downloading Oracle Wallets
  • 11.1.2 Uploading Oracle Wallets
  • 11.1.3 Downloading Oracle Wallets
  • 11.1.4 Recommendations for Uploading and Downloading Oracle Wallets
• 11.2 Uploading and Downloading JKS and JCEKS Keystores
  • 11.2.1 About Uploading and Downloading JKS and JCEKS Keystores
  • 11.2.2 Uploading JKS or JCEKS Keystores
  • 11.2.3 Downloading JKS or JCEKS Keystores
  • 11.2.4 Recommendations for Uploading and Downloading JKS and JCEKS Keystores
• 11.3 Uploading and Downloading Credential Files
  • 11.3.1 About Uploading and Downloading Credential Files
  • 11.3.2 Uploading a Credential File
  • 11.3.3 Downloading a Credential File
  • 11.3.4 Recommendations for Uploading and Downloading Credential Files
• 11.4 Using an Online Master Key with Oracle Key Vault
  • 11.4.1 About Using an Online Master Key with Oracle Key Vault
  • 11.4.2 Other Oracle Database Features That Oracle Key Vault Supports
  • 11.4.3 Configuring a Connection Between Oracle Key Vault and a New TDE-Enabled Database
  • 11.4.4 Migrating Existing TDE Wallets to Oracle Key Vault
    • 11.4.4.1 About Migrating Existing TDE Wallets to Oracle Key Vault
    • 11.4.4.2 Migrating an Existing TDE Wallet to Oracle Key Vault
    • 11.4.4.3 Restoring Database Contents Previously Encrypted by TDE Using an Oracle Wallet
  • 11.4.5 Persistent Master Key Cache
    • 11.4.5.1 About the Persistent Master Key Cache
    • 11.4.5.2 About Oracle Key Vault Persistent Master Key Cache Architecture
    • 11.4.5.3 Persistent Master Key Cache Modes of Operation
      • 11.4.5.3.1 Oracle Key Vault First Mode
      • 11.4.5.3.2 Persistent Master Key Cache First Mode
    • 11.4.5.4 Persistent Master Key Cache - Refresh Window
    • 11.4.5.5 Persistent Master Key Cache Parameters
      • 11.4.5.5.1 PKCS11_CACHE_TIMEOUT Parameter
      • 11.4.5.5.2 PKCS11_PERSISTENT_CACHE_TIMEOUT Parameter
      • 11.4.5.5.3 PKCS11_PERSISTENT_CACHE_FIRST Parameter
      • 11.4.5.5.4 PKCS11_PERSISTENT_CACHE_REFRESH_WINDOW Parameter
    • 11.4.5.6 Listing the Contents of the Persistent Master Key Cache
    • 11.4.5.7 Oracle Database Deployments and Persistent Master Key Cache
  • 11.4.6 Minimizing Downtime
• 11.5 Using an User-Defined Key as the TDE Master Encryption Key
  • 11.5.1 How Using a User-Defined Key as the TDE Master Encryption Key Works
  • 11.5.2 Uploading the User-Defined Key
  • 11.5.3 Activating the User-Defined Key as a TDE Master Encryption Key
• 11.6 Using a TDE-Configured Oracle Database in an Oracle RAC Environment
• 11.7 Using a TDE-Configured Oracle Database in an Oracle GoldenGate Environment
  • 11.7.1 About Uploading Oracle Wallets in an Oracle GoldenGate Environment
  • 11.7.2 Using an Online Master Key in an Oracle GoldenGate Deployment
  • 11.7.3 Migrating TDE Wallets on an Oracle GoldenGate Deployment to Oracle Key Vault
• 11.8 Using a TDE-Configured Oracle Database in an Oracle Active Data Guard Environment
  • 11.8.1 About Uploading Oracle Wallets in an Oracle Active Data Guard Environment
  • 11.8.2 Uploading Oracle Wallets in an Oracle Active Data Guard Environment
  • 11.8.3 Performing an Online Master Key Connection in an Oracle Active Data Guard Environment
  • 11.8.4 Migrating Oracle Wallets in an Oracle Active Data Guard Environment
  • 11.8.5 Reverse Migrating Oracle Wallets in an Active Data Guard Environment
  • 11.8.6 Migrating an Oracle TDE Wallet to Oracle Key Vault for a Logical Standby Database
  • 11.8.7 Checking the Oracle TDE Wallet Migration for a Logical Standby Database
• 11.9 MySQL Integration with Oracle Key Vault
• 11.10 Upload a Keystore from Automatic Storage Management to Oracle Key Vault

12 General Oracle Key Vault Management

• 12.1 About General Oracle Key Vault Management
• 12.2 Remote Monitoring Using SNMP
  • 12.2.1 About Using SNMP for Oracle Key Vault
  • 12.2.2 Granting SNMP Access to Users
  • 12.2.3 Changing the SNMP User Name and Password
  • 12.2.4 Changing SNMP Settings on the Standby Server
  • 12.2.5 Remotely Monitoring Oracle Key Vault Using SNMP
  • 12.2.6 SNMP Management Information Base Variables for Oracle Key Vault
  • 12.2.7 Example: Simplified Remote Monitoring of Oracle Key Vault Using SNMP
• 12.3 Email Notification
  • 12.3.1 About Email Notification
  • 12.3.2 Configure Email Settings
  • 12.3.3 Test the Email Configuration
  • 12.3.4 Disable Email Notifications for a User
• 12.4 Oracle Key Vault System Administration
  • 12.4.1 Configure System Settings
  • 12.4.2 System Recovery
    • 12.4.2.1 Recovering Credentials for Administrators
    • 12.4.2.2 Change the Recovery Passphrase
    • 12.4.2.3 Change the Installation Passphrase
  • 12.4.3 Download System Diagnostics
  • 12.4.4 View the Oracle Key Vault Dashboard
  • 12.4.5 Status Panes in the Dashboard
• 12.5 Oracle Key Vault Alert Configuration
  • 12.5.1 About Configuring Alerts
  • 12.5.2 Configuring Alerts
  • 12.5.3 Viewing Open Alerts
• 12.6 Oracle Key Vault Auditing
  • 12.6.1 About Auditing in Oracle Key Vault
  • 12.6.2 Configuring Syslog to Store Audit Records
  • 12.6.3 View Audit Records
  • 12.6.4 Export or Delete Audit Records
  • 12.6.5 Audit Consolidation with Audit Vault and Database Firewall
• 12.7 Oracle Key Vault Reports
  • 12.7.1 About Oracle Key Vault Reports
  • 12.7.2 View Reports for Endpoint, User, Keys and Wallets, and System
    • 12.7.2.1 View Endpoint Reports
    • 12.7.2.2 View User Reports
    • 12.7.2.3 View Keys and Wallets Reports
    • 12.7.2.4 View System Reports
• 12.8 Upgrade Oracle Key Vault Server Software
  • 12.8.1 How an Oracle Key Vault Server Software Upgrade Works
  • 12.8.2 Step 1: Backup the Server before Upgrade
  • 12.8.3 Step 2: Pre-Upgrade Tasks for Release 12.2.0.0.0
  • 12.8.4 Step 3: Upgrade the Oracle Key Vault Server or Server Pair
    • 12.8.4.1 About the Upgrade of an Oracle Key Vault Server or Server Pair
    • 12.8.4.2 Upgrade a Standalone Key Vault Server
    • 12.8.4.3 Upgrade a Pair of Key Vault Servers in a High Availability Deployment
  • 12.8.5 Step 4: Upgrade Endpoint Software
  • 12.8.6 Step 5: Backup Just Upgraded Server

13 Managing Certificates

• 13.1 Rotating Certificates
  • 13.1.1 About Rotating Certificates
  • 13.1.2 Advice for Managing Certificate Rotations
  • 13.1.3 Rotating All Certificates
  • 13.1.4 Checking the Certificate Rotation Status
• 13.2 Third Party Certificates
  • 13.2.1 Download Certificate Request
  • 13.2.2 Getting Certificate Signed
  • 13.2.3 Upload Signed Certificate to Oracle Key Vault
  • 13.2.4 Notes on Using Third-Party Certificates

A Installing and Configuring Oracle Key Vault 12.2.0.4.0 and Earlier

• A.1 Downloading the Oracle Key Vault Appliance Software
• A.2 Installing the Oracle Key Vault Appliance Software
• A.3 Performing Post-Installation Tasks

B Troubleshooting Oracle Key Vault

• B.1 Key Vault Pre-Installation Checklist
• B.2 Audit Vault Database Firewall Integration Instructions
• B.3 RESTful Services Troubleshooting Help
• B.4 Error: Cannot Open Keystore Message
• B.5 KMIP Error: Invalid Field
• B.6 WARNING: Could Not Store Private Key Errors
• B.7 Errors After Upgrading Oracle Key Vault
• B.8 Error: Failed to Open Wallet
• B.9 Error: Provision Command Fails if /usr/bin/java does not Exist
• B.10 Transaction Check Error: Diagnostics Generation Utility
• B.11 Fast-Start Failover (FSFO) Suspended (ORA-16818)
• B.12 SSH Tunnel Add Failure
• B.13 TDE Endpoint Integration Issues
• B.14 Failover Situations in High Availability Mode
  • B.14.1 Types of Failover Situations
  • B.14.2 Failover Situations without Read-Only Restricted Mode
  • B.14.3 Failover Situations with Read-Only Restricted Mode
  • B.14.4 Performing a Planned Shutdown
    • B.14.4.1 Primary Server Planned Shutdown
      • B.14.4.1.1 Performing a Primary Server Planned Shutdown during Upgrade
      • B.14.4.1.2 Performing a Primary Server Planned Shutdown during Maintenance
    • B.14.4.2 Standby Server Planned Shutdown
      • B.14.4.2.1 Performing a Standby Server Planned Shutdown during Upgrade
      • B.14.4.2.2 Performing a Standby Server Planned Shutdown during Maintenance

C Security Technical Implementation Guides Compliance Standards

• C.1 About Security Technical Implementation Guides
• C.2 Enabling and Disabling STIG Rules on Oracle Key Vault
  • C.2.1 Enabling STIG Rules on Oracle Key Vault
  • C.2.2 Disabling STIG Rules on Oracle Key Vault
• C.3 Current Implementation of STIG Rules on Oracle Key Vault
• C.4 Current Implementation of Database STIG Rules
• C.5 Additional Notes
  • C.5.1 DG0008-ORACLE11 STIG Rule
• C.6 Current Implementation of Operating System STIG Rules

D Prerequisites for Endpoint Installation on AIX 5.3

Glossary

Index