Table of Contents

• Title and Copyright Information
• Preface
  • Audience
  • Related Documents
  • Conventions
• Changes in This Release for Oracle Key Vault
  • Changes for Oracle Key Vault Release 21.5
    • Reverse Migrate Functionality on the HSM Screen
  • Changes for Oracle Key Vault Release 21.3
    • Ability to Configure Other HSMs for Oracle Key Vault
  • Changes for Oracle Key Vault Release 21.2
    • Changes in the Oracle Key Vault Management Console
• Getting Started with HSM
  • How Oracle Key Vault Works with Hardware Security Modules
  • Installing the HSM Client Software on an Oracle Key Vault Server
  • Enrolling Oracle Key Vault as a Client of the HSM
• Configuring an HSM for Oracle Key Vault
  • HSM-Enabling in a Standalone Oracle Key Vault Deployment
  • HSMs in a Multi-Master Cluster
    • About HSMs in a Multi-Master Cluster
    • Configuring an HSM for a Multi-Master Cluster Starting with Single Node (Recommended)
    • Configuring an HSM for a Multi-Master Cluster with Multiple Nodes
      • About Configuring an HSM for a Multi-Master Cluster with Multiple Nodes
      • Step 1: Create and Copy the Bundle after HSM-Enabling the First Node
      • Step 2: Configure the Remaining Nodes
  • Backup and Restore Operations in an HSM-Enabled Oracle Key Vault Instance
    • Backup Operations in an HSM-Enabled Oracle Key Vault Instance
    • Restore Operations in an HSM-Enabled Oracle Key Vault Instance
  • Reverse Migration Operations
    • Reverse Migrating a Standalone Deployment
    • Reverse Migrating a Multi-Master Cluster
    • Reverse Migrating a Primary-Standby Deployment
  • Disabling Reverse Migration on the Management Console
  • HSM-Enabling in a Primary-Standby Oracle Key Vault Deployment
• Upgrade Considerations When Using HSMs in Oracle Key Vault
  • Upgrades from Oracle Key Vault Release 12.2
    • Upgrading from an Oracle Key Vault Release 12.2 Standalone Deployment
    • Upgrading from an Oracle Key Vault Release 12.2 Primary-Standby Deployment
  • Upgrade Considerations for Entrust
    • Remaking Hardserver Changes While Upgrading Oracle Key Vault
    • Overriding Security Assurances for the Oracle Key Vault Upgrade
    • Reinstallation of Entrust Software While Upgrading Oracle Key Vault from 18.x to 21.x
  • Using a Token Label After Upgrading Oracle Key Vault without Reverse-Migrating
• Oracle Key Vault HSM Support Guidance
  • General Troubleshooting
    • Trace Files for Diagnosing Issues
    • HSM Alert
    • Could Not Get Slot for HSM Error
    • Could Not Load PKCS#11 Library Error
    • Oracle Key Vault Management Console Does Not Start After Restarting HSM-Enabled Oracle Key Vault Server
    • Primary-Standby Errors
    • Errors from HSM-Enabled Oracle Key Vault Backups
    • Restoration of a Backed Up HSM-Enabled Oracle Key Vault Server
  • Vendor Specific Notes for Thales
    • Installing the HSM Client Software on the Oracle Key Vault Server for Thales
    • HSM Credential for Thales
    • Token Label for Thales
    • Enrolling Oracle Key Vault as a Client of a Thales HSM
    • HSM Provider Value for Thales
    • HSM Vendor Specific Checks for Thales
  • Vendor Specific Notes for Entrust
    • Installing the HSM Client Software on the Oracle Key Vault Server for Entrust
    • HSM Credential for Entrust
    • Token Label for Entrust
    • Enrolling Oracle Key Vault as a Client of an Entrust HSM
    • HSM Provider Value for Entrust
  • Vendor Specific Notes for Utimaco
    • Installing the HSM Client Software on the Oracle Key Vault Server for Utimaco
    • HSM Credential for Utimaco
    • Token Label for Utimaco
    • HSM Provider Value for Utimaco
    • HSM Vendor Specific Checks for Utimaco
  • Vendor Specific Notes for Other HSMs
    • About Vendor Specific Notes for Other HSMs
    • Installing the HSM Client Software on the Oracle Key Vault Server for Other Vendors
    • Configuring the okv_hsm.conf Parameters
    • Configuring the okv_hsm_env Environment File
    • Configuring the okv_hsm_mid_upgrade Script
    • Executing Pre- or Post-Upgrade Validation Scripts
• Vendor Instructions for Integrating an HSM as the Root of Trust for Oracle Key Vault
  • About Integrating an HSM as a Root of Trust for Oracle Key Vault
  • Requirements Before Starting the Integration
    • Requirements for the Vendor’s HSM Client Installation Software
    • Requirements for the PKCS#11 Library
    • Configuration Requirements for Enrolling Oracle Key Vault as the HSM Client
  • Integrating the HSM
    • okv_hsm.conf Parameters
    • okv_hsm_env Environment File
    • okv_hsm_mid_upgrade Script
    • Pre- or Post-Upgrade Validation Scripts
  • Confirming the Success of the HSM Configuration
    • Enabling the HSM in a Standalone Environment
    • Performing an Upgrade of an HSM-Enabled Oracle Key Vault Server
    • Performing a Backup of an HSM-Enabled Oracle Key Vault Server
    • Performing a Restore of an HSM-Enabled Oracle Key Vault Server
    • Confirming the Success of the HSM Configuration in a Multi-Master Cluster
      • Starting with an HSM-Enabled Single Node
      • HSM-Enabling a Cluster with Multiple Nodes
    • Confirming the Success of the HSM Configuration in a Primary-Standby Environment
      • Creating an HSM-Enabled Primary Standby Configuration
      • Performing an HSM-Enabled Primary-Standby Switchover Operation
      • Performing a Reverse Migration of an HSM-Enabled Primary-Standby Configuration
    • Performing a Reverse Migration Operation
  • Validating the HSM as a Root of Trust for Oracle Key Vault
    • Test Cases for Standalone Configurations
    • Test Cases for Multi-Master Cluster Configurations
    • Test Cases for Primary-Standby Configurations