Oracle Key Vault Installation Requirements

The Oracle Key Vault installation requirements cover areas such as CPU, memory, disk space, network interfaces, and supported endpoint platforms.

System Requirements

System requirements include CPU, memory, disk, network interface, and hardware compatibility.

The Oracle Key Vault installation removes existing software on a server.

You can install Oracle Key Vault on dedicated servers, as guests into your virtualization platform, or as a guest into a compute instance in your Oracle Cloud Infrastructure (OCI) tenancy, deployed in minutes from the Oracle Cloud Marketplace. Visit the following site:

https://marketplace.oracle.com/

The minimum hardware requirements for deploying Oracle Key Vault on dedicated hardware or as VM guests are:

Other Installation Considerations:

Related Topics

Additional or Third-Party Software

Oracle does not support Oracle Key Vault installations with any third-party software.

Network Port Requirements

Network port requirements includes requirements for SSH/SCP, SNMP, HTTPS, listeners, KMIP, and TCP ports.

Oracle Key Vault and its endpoints use a set of specific ports for communication. Network administrators must ensure that these ports are open.

The following table lists the required network ports for Oracle Key Vault:

Port Number Protocol Port Type Descriptions
22 SSH/SCP port TCP Used by Oracle Key Vault administrators and support personnel to remotely administer Oracle Key Vault.
Note: You can change the default value of the port. After you change the default value on one node, apply the new port number to all the nodes of the cluster one-by-one.
161 SNMP port UDP Used by monitoring software to poll Oracle Key Vault for system information.
443 HTTPS port TCP Used by web clients such as browsers and RESTful Administrative commands to communicate with Oracle Key Vault.
5695 HTTPS port TCP Used by RESTful Key Management commands to communicate with Oracle Key Vault.
1522 Database TCPS listener ports TCP

In a cluster configuration, listener ports used to communicate between read/write peer nodes.

Note: You can change the default value of this port. Oracle Key Vault automatically applies the new port number to all the cluster nodes.

7443 HTTPS port TCP The listener port used in a primary-standby configuration to run operating system commands. This port is also used when you add a new node to a cluster.
5696 KMIP port TCP Used by Oracle Key Vault endpoints and third party KMIP clients to communicate with the Oracle Key Vault KMIP server.
7093 TCP port TCP Used by Oracle GoldenGate for transmitting data in a multi-master cluster configuration.

If you are installing Oracle Key Vault in an OCI Marketplace instance or if you are creating a hybrid multi-master cluster between on-premises and OCI nodes, then consider the following network configuration:

  1. Add rules to open the ports listed in the table.

  2. Add the following ingress rules:

    • ICMP Type 3, Code 4 (destination unreachable, fragmentation required and Don't Fragment flag is set).

    • ICMP Type 8, Code 0 (echo request, destination network is unreachable).

  3. If you are using a site-to-site VPN or fastConnect, then ensure that your router allows traffic between the nodes of the multi-master cluster:

    • Add rules to open the ports.

    • In case of highly secured routers, add URL exceptions for your on-premises subnet at layers 3, 4, and 7.

    • Ensure that no packets are interpreted as threats by your routers.

Note: Oracle Key Vault allows the configuration of network ports only for SSH/SCP (default port 22) and Database TCPS listener (default port 1522).

Supported Endpoint Platforms

Oracle Key Vault supports both UNIX and Windows endpoint platforms.

Oracle supports 64-bit Linux endpoints, and only 64-bit endpoints are supported for Oracle databases that use the online master encryption key. The operating systems on which the endpoint runs must be compatible with Transport Layer Security (TLS) 1.2, either directly or with appropriate patches.

The supported endpoint platforms in this release are as follows:

Endpoint Database Requirements

Administrators can use online master encryption keys and the Oracle Database COMPATIBLE initialization parameter to manage Oracle Database endpoints.

Administrators can use the online master encryption key to manage TDE master encryption keys for endpoints that are Oracle Database 12.1.0.2 or later. Administrators who want to use Oracle Key Vault for wallet management only or who are migrating existing wallets deployments to Oracle Key Vault can use the okvutil upload command to upload Oracle wallets to Oracle Key Vault.

Administrators who manage endpoints that are Oracle Database may need to set the COMPATIBLE initialization parameter.

For an endpoint that is Oracle Database release 12.1 or later, set the COMPATIBLE initialization parameter to 12.1.0.0 or later. A COMPATIBLE setting of 12.1.0.0 or later enables Transparent Data Encryption to work with Oracle Key Vault. For example:

SQL> ALTER SYSTEM SET COMPATIBLE = '12.1.0.0' SCOPE=SPFILE;

This applies to an Oracle Database endpoint that use the online master encryption key to manage TDE master encryption keys. This compatibility mode setting is not required for Oracle wallet upload or download operations.

Also note that after setting the COMPATIBLE parameter to 12.1.0.0, you cannot set it to a lower value such as 10.2. After you set the COMPATIBLE parameter, you must restart the database.

For Microsoft Windows endpoints, Oracle Key Vault supports the latest available database release versions at the time of the Oracle Key Vault release, including any associated Manufacturing Execution Systems (MES) libraries that may have been upgraded.