Configuring the Credential Wallet and Encryption Keystore

All database backup pieces are DEK encrypted before any copy-to-tape or archive-to-cloud operation.

These steps create a shared wallet to be used by all nodes of the Recovery Appliance. The wallet stores TDE master keys that encrypt the individual DEK keys.

1. Create the Recovery Appliance credential wallet. You are prompted to enter new passwords for the keystore and then the wallet. The credentials to access the Recovery Appliance encryption keystore are saved in this wallet.

   [root@myComputeNodeX ~]# racli add credential_wallet
   
   Fri Jan 1 08:56:27 2018: Start: Add Credential Wallet
   Enter New Keystore Password: <OKV_endpoint_password>
   Confirm New Keystore Password:
   Enter New Wallet Password: <ZDLRA_credential_wallet_password>
   Confirm New Wallet Password:
   Re-Enter New Wallet Password:
   Fri Jan 1 08:56:40 2018: End: Add Credential Wallet

   For details on the command options, refer to “racli add credential_wallet”.

2. Configure the Recovery Appliance encryption keystore. This keystore contains one or more TDE Master keys for each Recovery Appliance client database, plus the Recovery Appliance’s TDE Master key. The per-client TDE Master keys are used to encrypt backups pieces that are copied to the cloud.

   Caution: The Recovery Appliance database is restarted to activate the keystore; plan for a short outage.

   [root@myComputeNodeX ~]# racli add keystore --type hsm --restart_db
   
   Updating log /opt/oracle.RecoveryAppliance/log/racli.log
   Fri Jan 1 08:57:03 2018: Start: Configure Wallets
   Fri Jan 1 08:57:04 2018: End: Configure Wallets
   Fri Jan 1 08:57:04 2018: Start: Stop Listeners, and Database
   Fri Jan 1 08:59:26 2018: End: Stop Listeners, and Database
   Fri Jan 1 08:59:26 2018: Start: Start Listeners, and Database
   Fri Jan 1 09:02:16 2018: End: Start Listeners, and Database

   For details on the command options, refer to “racli add keystore”.

A shared wallet is created that all nodes of the Recovery Appliance use. It stores TDE master keys that encrypt the individual DEK keys.