These release notes list the new features for this release of Oracle Key Vault, how to download the latest product software and documentation, and how to address known issues in Oracle Key Vault.
1.1 Changes in This Release for Oracle Key Vault
This Oracle Key Vault release introduces new features that enhance the use of Oracle Key Vault in a large enterprise.
- Changes for Oracle Key Vault Release 21.2
Oracle Key Vault release 21.2 introduces one new feature that is related to installation and upgrade operations. - Changes for Oracle Key Vault Release 21.1
Oracle Key Vault release 21.1 introduces several new features.
Parent topic: Release Notes
1.1.1 Changes for Oracle Key Vault Release 21.2
Oracle Key Vault release 21.2 introduces one new feature that is related to installation and upgrade operations.
- Certificate and Secret Objects Expiration Alerts
Starting with this release, you can configure alert notifications for the expiration of certificate and secret objects. - New C and Java SDK APIs for Certificates, Certificate Requests, Private Keys, and Public Keys
In Oracle Key Vault release 21.2, new APIs enable you to perform operations such as registering and fetching objects, and adding attributes to those objects (for example, length, type, ID, subject, issuer, and algorithm). - New and Changed RESTful Services Utility Commands
Several new and changedokv managed-object
RESTful services utility commands are available starting with this release. - Changes in the Oracle Key Vault Management Console
In Oracle Key Vault release 21.2, the Oracle Key Vault management console user interface has had minor changes throughout.
Parent topic: Changes in This Release for Oracle Key Vault
1.1.1.1 Certificate and Secret Objects Expiration Alerts
Starting with this release, you can configure alert notifications for the expiration of certificate and secret objects.
In previous releases, expiration alerts for all managed objects shared a common configuration under the Key Rotations
alert. Starting with this release, you can separately configure the expiration alerts for certificate and secret objects. The expiration alerts for the certificate and secret objects are no longer reported as Key Rotations
alerts. Similar to alerts such as those for cluster components or user password expiration, you can set this type of alert to notify users when the deactivation date for a certificate or secret object is within its threshold value.
The new alerts for certificate and secret objects are as follows:
Certificate Object Expiration
Secret Object Expiration
The object expiration alerts are now raised only when the object is in the PRE-ACTIVE
or ACTIVE
state. Previously, they were raised regardless of the object state.
The object expiration alerts are now deleted when an object is revoked or destroyed. Previously, they were deleted when object was destroyed.
Related Topics
Parent topic: Changes for Oracle Key Vault Release 21.2
1.1.1.2 New C and Java SDK APIs for Certificates, Certificate Requests, Private Keys, and Public Keys
In Oracle Key Vault release 21.2, new APIs enable you to perform operations such as registering and fetching objects, and adding attributes to those objects (for example, length, type, ID, subject, issuer, and algorithm).
C SDK APIs
Registration and fetch operations are as follows:
-
okvGetCertificate
-
okvGetCertificateRequest
-
okvGetPrivateKey
-
okvGetPublicKey
-
okvRegCertificate
-
okvRegCertificateRequest
-
okvRegPrivateKey
-
okvRegPublicKey
Attribute operations are as follows:
-
okvAttrAddCertLen
-
okvAttrAddCertType
-
okvAttrAddDigitalSignAlgo
-
okvAttrAddX509CertId
-
okvAttrAddX509CertIss
-
okvAttrAddX509CertIssAltName
-
okvAttrAddX509CertSubj
-
okvAttrAddX509CertSubjAltName
-
okvAttrGetCertLen
-
okvAttrGetCertType
-
okvAttrGetDigitalSignAlgo
-
okvAttrGetX509CertId
-
okvAttrGetX509CertIdIssuerLen
-
okvAttrGetX509CertIdSerialNoLen
-
okvAttrGetX509CertIss
-
okvAttrGetX509CertIssAltName
-
okvAttrGetX509CertIssAltNameLen
-
okvAttrGetX509CertIssDNLen
-
okvAttrGetX509CertSubj
-
okvAttrGetX509CertSubjAltName
-
okvAttrGetX509CertSubjAltNameLen
-
okvAttrGetX509CertSubjDNLen
Java SDK APIs
Registration and fetch operations are as follows:
-
okvGetCertificate
-
okvGetCertificateRequest
-
okvGetPrivateKey
-
okvGetPublicKey
-
okvRegCertificate
-
okvRegCertificateRequest
-
okvRegPrivateKey
-
okvRegPublicKey
Attribute operations are as follows:
-
okvAttrAddArchiveDate
-
okvAttrAddCertLen
-
okvAttrAddCertType
-
okvAttrAddDigitalSignAlgo
-
okvAttrAddInitialDate
-
okvAttrAddLastChangeDate
-
okvAttrAddState
-
okvAttrAddX509CertId
-
okvAttrAddX509CertIss
-
okvAttrAddX509CertIssAltName
-
okvAttrAddX509CertSubj
-
okvAttrAddX509CertSubjAltName
-
okvAttrGetCertLen
-
okvAttrGetCertType
-
okvAttrGetDigitalSignAlgo
-
okvAttrGetX509CertId
-
okvAttrGetX509CertIss
-
okvAttrGetX509CertIssAltName
-
okvAttrGetX509CertSubj
-
okvAttrGetX509CertSubjAltName
Related Topics
Parent topic: Changes for Oracle Key Vault Release 21.2
1.1.1.3 New and Changed RESTful Services Utility Commands
Several new and changed okv managed-object
RESTful services utility commands are available starting with this release.
The new okv managed-object
RESTful services commands, which add support for get
and register
operations for certificate requests, private keys, and public keys, are as follows:
okv managed-object certificate-request get
okv managed-object certificate-request register
okv managed-object private-key get
okv managed-object private-key register
okv managed-object public-key get
okv managed-object public-key register
The changed okv managed-object
RESTful services commands are as follows:
okv managed-object certificate register
okv managed-object object locate
Related Topics
Parent topic: Changes for Oracle Key Vault Release 21.2
1.1.1.4 Changes in the Oracle Key Vault Management Console
In Oracle Key Vault release 21.2, the Oracle Key Vault management console user interface has had minor changes throughout.
These changes are the result of modified terms, updates to the current release, and enhancements for better usability. The overall interface has not had major changes.
Parent topic: Changes for Oracle Key Vault Release 21.2
1.1.2 Changes for Oracle Key Vault Release 21.1
Oracle Key Vault release 21.1 introduces several new features.
- Dual NIC Network Interface Support
Starting with this release, Oracle Key Vault supports the use of two network interfaces, referred to as dual NIC configuration. - LDAP User Authentication and Authorization in Oracle Key Vault
Starting with this release, you can configure authentication and authorization of Oracle Key Vault users to be centrally managed in a Microsoft Active Directory. - RESTful Services Utility Command-Line Interface for Appliance Management
In Oracle Key Vault release 21.1, the the RESTful service command-line interface has been expanded and redesigned to provide more functionality. - Support for SFTP to Transfer External Backups
Oracle Key Vault now supports the use of SSH Secure File Transfer Protocol (SFTP) for the transfer of (scheduled) external backups to remote backup destinations. - Development Using the Java SDK
This release introduces a new Java language software development kit that you can use to integrate custom endpoints with the Oracle Key Vault server. - Development Using the C SDK
This release introduces a new C language software development kit that you can use to integrate custom endpoints with the Oracle Key Vault server.
Parent topic: Changes in This Release for Oracle Key Vault
1.1.2.1 Dual NIC Network Interface Support
Starting with this release, Oracle Key Vault supports the use of two network interfaces, referred to as dual NIC configuration.
In a dual NIC configuration, Oracle Key Vault combines the two network interfaces into a single logical interface using the Linux NIC bonding mechanism to provide redundancy at the network layer. The dual NIC configuration maintains the network availability of an Oracle Key Vault in case one of the interfaces becomes unavailable. Depending upon the dual NIC configuration mode, load balancing of the network traffic may also be achieved.
This type of configuration is particularly useful in large Oracle Key Vault deployments where need for operational continuity is higher despite physical or software failures. Configuring a dual NIC network interface helps to avoid the scenario where, for example, a network interface associated with an Oracle Key Vault server becomes unavailable, which can result in a loss of communication between the Oracle Key Vault nodes and between endpoints and Oracle Key Vault server.
In previous releases, Oracle Key Vault supported only one network interface. When you install and configure Oracle Key Vault in this release, you have the option of using a single network interface (Classic mode) or using dual NIC mode.
Parent topic: Changes for Oracle Key Vault Release 21.1
1.1.2.2 LDAP User Authentication and Authorization in Oracle Key Vault
Starting with this release, you can configure authentication and authorization of Oracle Key Vault users to be centrally managed in a Microsoft Active Directory.
This feature benefits large deployment environments where enterprise users are centrally managed in a Microsoft Active Directory. Centrally managing users, as opposed to creating user accounts in different systems and applications, is not only easier and more efficient for administrators, it improves compliance, control, and security. You enable the Microsoft Active Directory users to authenticate with Oracle Key Vault through the use of their directory credentials. You manage the authorization of the directory users in Oracle Key Vault through mapping definitions between Microsoft Active Directory groups and Oracle Key Vault administrative roles or user groups. When a directory user successfully logs in to Oracle Key Vault the first time, Oracle Key Vault automatically creates an Oracle Key Vault user account for this user.
Parent topic: Changes for Oracle Key Vault Release 21.1
1.1.2.3 RESTful Services Utility Command-Line Interface for Appliance Management
In Oracle Key Vault release 21.1, the the RESTful service command-line interface has been expanded and redesigned to provide more functionality.
This redesign includes the following:
- Structured and simplified command-line interface with the following format:
okv category resource action configuration-options command-options
- Profile support in configuration file to centrally administer multiple Oracle Key Vault endpoints.
- JSON support for command input and output.
- New commands to support system management tasks and monitoring of deployments, in addition to the enhancements for the current functionality for endpoints, wallets, and security objects.
In previous releases, the RESTful command-line interface covered only endpoint, wallet, and security object management commands. The addition of system management commands, which include commands for backup operations and server operations for standalone, multi-master, and primary-standby environments, benefits large deployments where the automation of these types of configuration is needed.
The previous RESTful services APIs are still supported.
Parent topic: Changes for Oracle Key Vault Release 21.1
1.1.2.4 Support for SFTP to Transfer External Backups
Oracle Key Vault now supports the use of SSH Secure File Transfer Protocol (SFTP) for the transfer of (scheduled) external backups to remote backup destinations.
SFTP enables the use of ZFS Storage Appliance as a backup destination. The use of Secure Copy Protocol (SCP) is also supported.
Parent topic: Changes for Oracle Key Vault Release 21.1
1.1.2.5 Development Using the Java SDK
This release introduces a new Java language software development kit that you can use to integrate custom endpoints with the Oracle Key Vault server.
The Java SDK enables developers to create their own custom endpoint integration solutions for Oracle Key Vault.
Parent topic: Changes for Oracle Key Vault Release 21.1
1.1.2.6 Development Using the C SDK
This release introduces a new C language software development kit that you can use to integrate custom endpoints with the Oracle Key Vault server.
The C SDK allows developers to create their own custom endpoint integration solutions for Oracle Key Vault.
Parent topic: Changes for Oracle Key Vault Release 21.1
1.2 Downloading the Oracle Key Vault Software and the Documentation
At any time, you can download the latest version of the Oracle Key Vault software and documentation.
1.2.1 Downloading the Oracle Key Vault Installation Software
For a fresh installation, you can download the Oracle Key Vault software
from the Software Delivery Cloud. You cannot use this package to
upgrade Oracle Key Vault. For an upgrade from an existing Oracle Key Vault
deployment, you can download the Oracle Key Vault upgrade software from the My Oracle Support website which includes a readme
file
with upgrade instructions.
1.3 Known Issues
At the time of this release, there are issues with Oracle Key Vault that could occur in rare circumstances. For each issue, a workaround is provided.
1.3.1 General Issues
This section describes general Oracle Key Vault issues.
- User Gets Locked and Expired with Multiple Failed Logins
- Private Keys Are Not Overwritten When a Java Keystore Is Uploaded Using the -o Option of the okvutil Utility
- OKV Alerts Still Show in the List After Fixing the Problem
- On HP-UX System, SELECT FROM V$ENCRYPTION_KEYS May Return ORA-28407 Occasionally
- Deleting a Default Wallet Causes Associated Endpoint to Not Be Able to Execute OKVUTIL LIST
- Oracle Key Vault Boot-Time Warnings When in FIPS Mode
- KMIPD May Be Stopped At The Same Time On Multiple Nodes During Certificate Rotation
- Assigning Default Wallet Fails if an Endpoint Already Has Access to Same Wallet
- Modal pages in system settings page are blank on page load and after saving
- Certificate Attributes Will Not Get Uploaded By okvutil For Windows Endpoints Using 11.2.0.4 DB
- DB Crashes On Windows When Using PKCS#11 To Perform Certificate Rotation
Parent topic: Known Issues
1.3.1.1 User Gets Locked and Expired with Multiple Failed Logins
Issue: The current password policy locks the user account for a day if the user has incorrectly entered the password more than three consecutive times. Therefore, the user will be able to log in only after the 24-hour lockout period expires.
Workaround: Make a note of the password and keep it accessible and secure.
Bug Number: 23300720
Parent topic: General Issues
1.3.1.2 Private Keys Are Not Overwritten When a Java Keystore Is Uploaded Using the -o Option of the okvutil Utility
Issue: When you upload a Java keystore (JKS) or Java Cryptography Extension keystore (JCEKS) to the Oracle Key Vault server using the -o
option of the okvutil upload
command, user-defined keys are not overwritten.
Workaround: Remove the private key from the wallet and then upload the keystore again.
Bug Number: 26887060
Parent topic: General Issues
1.3.1.3 OKV Alerts Still Show in the List After Fixing the Problem
Issue: User password expiration alerts are still showing even after the user changes their password.
Workaround: In the Oracle Key Vault management console, select Reports and then Configure Reports. Then uncheck the User Password Expiration option. Alternatively, ignore the alert.
Bug Number: 27620622
Parent topic: General Issues
1.3.1.4 On HP-UX System, SELECT FROM V$ENCRYPTION_KEYS May Return ORA-28407 Occasionally
Issue: On HP-UX operating system, a Transparent Data Encryption (TDE) query such as the following that is executed in a long-running database process or session may occasionally result in an ORA-28407 Hardware Security Module error detected
error:
SELECT * FROM V$ENCRYPTION_KEYS;
This is because the system could not create another thread-specific data key because
the process had reached or exceeded the system-imposed limit on the total number of keys
per process, which is controlled by the PTHREAD_KEYS_MAX
setting.
PTHREAD_KEYS_MAX
is typically set to 128
.
Workaround: Switch the database sessions and execute the TDE query again. If it is not convenient to switch the sessions, then set PTHREAD_USER_KEYS_MAX
to 16384
before starting the database and the listener.
Bug Number: 28270280
Parent topic: General Issues
1.3.1.5 Deleting a Default Wallet Causes Associated Endpoint to Not Be Able to Execute OKVUTIL LIST
Issue: When deleting a virtual wallet, if that virtual wallet is the
default wallet of an endpoint, the endpoint may not be able to execute okvutil
list
. This is because when the endpoint searches for the wallet, it is
unable to find it and therefore generates an error.
Workaround: Do not delete a virtual wallet without first being sure that no endpoint is currently using it as its default wallet. If the wallet is deleted, be sure to remove the default wallet from the endpoint via the Endpoint Details page and re-enroll the endpoint.
Bug Number: 30699255
Parent topic: General Issues
1.3.1.6 Oracle Key Vault Boot-Time Warnings When in FIPS Mode
Warning : Error inserting serpent_avx2(/lib/modules/4.1.12-124.34.1.1.el6uek.x86_64/kernerl/arch/x86/crypto/serpent_avx2): No such device
These are informational messages thrown on screen indicating that instruction sets for ciphers that are not available or not supported in FIPS mode are not being loaded. These warnings can be safely ignored.
Workaround: None.
Bug Number: 30844891
Parent topic: General Issues
1.3.1.7 KMIPD May Be Stopped At The Same Time On Multiple Nodes During Certificate Rotation
Issue: During certificate rotation, the kmip
and
kmipus
daemons are restarted several times, with downtime of a few
minutes each. It is possible that this restart can happen on multiple nodes at the same
time. Especially in smaller clusters, this means it is possible, although unlikely, that
all of the kmip
daemons in the cluster are unable to respond to
endpoint requests, potentially leading to downtime.
Workaround: Turn on or increase the in-memory cache timeout, persistent cache timeout, and persistent cache refresh window values prior to certificate rotation in order to avoid endpoint downtime.
Bug Number: 31311978
Parent topic: General Issues
1.3.1.8 Assigning Default Wallet Fails if an Endpoint Already Has Access to Same Wallet
Issue: If an endpoint already has access to a wallet, then making this wallet as a default wallet fails. As a side-effect, current default wallet setting is also removed.
Workaround: Remove the endpoint's access to the wallet before assigning it as a default wallet of the endpoint.
Bug Number: 31416663
Parent topic: General Issues
1.3.1.9 Modal pages in system settings page are blank on page load and after saving
Issue: The modal pages (pop-ups) in System Settings page will be blank while the page loads. Also on clicking Save, the page is loaded again and the page goes blank while loading the content.
Workaround: The pages usually will show up in about 5 to10 seconds after opening the modal page. Also, the page load time depends on the network speed on the client side.
Bug Number: 32283750
Parent topic: General Issues
1.3.1.10 Certificate Attributes Will Not Get Uploaded By okvutil For Windows Endpoints Using 11.2.0.4 DB
Issue: When you upload an object containing certificates to the Oracle Key Vault server from a Windows endpoint system that has Oracle Database release 11.2.0.4, the cryptographic algorithm and cryptographic length will not be displayed on the management console for such certificates uploaded.
Workaround: If you wish the cryptographic algorithm and cryptographic length to be displayed for certificates, then consider uploading such objects from a different combination of endpoint platform or Oracle Database version.
Bug Number: 32855953
Parent topic: General Issues
1.3.1.11 DB Crashes On Windows When Using PKCS#11 To Perform Certificate Rotation
Issue: When performing an Oracle Key Vault certificate rotation operation,
the endpoint certificates are regenerated and then are fetched by the endpoint, sent
from the server along with the normal KMIP response. Endpoints can fetch the new
certificates either via an okvutil
operation or by the Oracle Database
which is utilizing the PKCS#11 library. On Windows, if the certificates are fetched by
an endpoint using the PKCS#11 library, the database may crash.
Workaround: Before starting the certificate rotation operation, prepare for the event by shutting down endpoints on Windows machines. Get these endpoints’ new certificates by re-enrolling the endpoints once certificate rotation has proceeded to the stage where there is a message on the Oracle Key Vault management console saying that endpoint certificate rotation is in progress.
Bug Number: 33037993
Parent topic: General Issues
1.3.2.1 Unpair of Upgraded Primary-Standby Oracle Key Vault 18.x Servers May Fail Due to Permission Issues
ORA-48141: error creating directory during ADR initialization: [/var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb/metadata_pv] ORA-48189: OS command to create directory failed
/var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb/metadata_pv
directory has
the right permissions using the steps below:
- Log into the primary Oracle Key Vault system as user
support
through ssh.$ ssh support@okv_instance_ip_address
- Switch to user
root
.support$ su - root
- Check the permissions on directory
/var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb/metadata_pv
.root# ls -l /var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb
The output should be similar to this output.drwxr-xr-x 2 root oinstall 4096 Apr 24 22:01 metadata_pv
- If the directory is owned by user
root
, as shown above, execute the following command:root# chown oracle:oinstall /var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb/metadata_pv
List the file and verify that the owner is noworacle
.root# ls -l /var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb
The output should be similar to this output.drwxr-xr-x 2 oracle oinstall 4096 Apr 24 22:01 metadata_pv
Bug Number: 29693700
Parent topic: Upgrade Issues
1.3.2.2 OKV Systems That Were Unpaired Before Being Upgraded Need a DB_UNIQUE_NAME Reset
Issue: Oracle Key Vault systems that were part of an Oracle Key Vault 12.2 high availability (now primary-standby) configuration before being unpaired, and then upgraded, have their DB_UNIQUE_NAME parameters set to 'DBFWDB_HA1' or 'DBFWDB_HA2'. This parameter needs to be reset to 'DBFWDB' before the system is converted to cluster mode, as attempting to add the node to a cluster would otherwise fail.
- Log into the primary Oracle Key Vault system as user
support
through ssh.$ ssh support@okv_instance_ip_address
- Switch to user
root
.support$ su - root
- Check the owner and group on directory
/var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb/metadata_pv
.root# ls -l /var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb
The output should be similar to this output.drwxr-xr-x 2 root oinstall 4096 Apr 24 22:01 metadata_pv
- If the directory is owned by user
root
, as shown above, execute the following command:root# chown oracle:oinstall /var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb/metadata_pv
List the file and verify that the owner is noworacle
.root# ls -l /var/lib/oracle/diag/rdbms/dbfwdb/dbfwdb
The output should be similar to this output.drwxr-xr-x 2 oracle oinstall 4096 Apr 24 22:01 metadata_pv
- Switch to user
oracle
.root# su oracle
- Start
SQL*Plus.
oracle$ sqlplus / as sysdba
- Execute the following
statement:
show parameter db_unique_name;
- If the
DB_UNIQUE_NAME
is something other thanDBFWDB
, then execute the following statements:alter system set db_unique_name='DBFWDB' scope=spfile; exit
- As user
root
, execute the following commands:oracle$ service dbfwdb stop oracle$ service dbfwdb start
- Verify that the
DB_UNIQUE_NAME
parameter has changed.Start SQL*Plus.oracle$ sqlplus / as sysdba
- Execute the following
statement:
show parameter db_unique_name
The output returned should match the output shown here.NAME TYPE VALUE --------------------- ----------- ----------- db_unique_name string DBFWDB
Bug Number: 29696058
Parent topic: Upgrade Issues
1.3.3 Primary-Standby Issues
This section describes Oracle Key Vault issues specific to a primary-standby configuration.
- SSH Tunnel Status Shows as Disabled on Failover Case in Primary-Standby
- HA Setup Succeeds with Different Primary & Standby RO Restricted Mode Config
- Re-pair After Un-pair from HA 12.2 BP5 to new OKV Server Still Shows Standalone
- Audit Trail is not Sent To Remote Syslog on Switchover in Primary-Standby Pair
- Failover Issues When Primary OKV Experiences a Controlled Shutdown
Parent topic: Known Issues
1.3.3.1 SSH Tunnel Status Shows as Disabled on Failover Case in Primary-Standby
Issue: After a failover operation, the new Oracle Key Vault primary server does not show the correct status of the SSH tunnel. It shows the SSH tunnel as disabled when the SSH tunnel is available. The dashboard also shows an alert, warning that the setup of an SSH tunnel failed. This is because after the failover operation, Oracle Key Vault tried to establish two SSH tunnels to the same database as a service endpoint, resulting in the incorrect status and dashboard alert. The second SSH tunnel to the database as a service endpoint does not affect connectivity between the Oracle Key Vault server and the database as a service endpoint. The first SSH tunnel to the database as a service endpoint is functional and available after the failover.
Workaround: After a failover, the new Oracle Key Vault primary server shows the correct SSH status as available and connected to the database as a service endpoints. You also can use the okvutil list
on the database as a service endpoint to check the status of the SSH tunnel.
Bug Number: 24679516
Parent topic: Primary-Standby Issues
1.3.3.2 HA Setup Succeeds with Different Primary & Standby RO Restricted Mode Config
Issue: For a primary-standby configuration, before pairing if read-only restricted mode is enabled on one Oracle Key Vault server and not on the other Oracle Key Vault server, then the configuration succeeds. This mismatch can lead to issues and confusion in a primary-standby deployment.
Workaround: Use the Oracle Key Vault management console to ensure that both servers have the same read-only restricted mode state applied. To do so, select the System tab, then Primary-Standby. Select the Allow Read-Only Restricted Mode option. Only then apply the primary-standby configuration on each server.
Bug Number: 26536033
Parent topic: Primary-Standby Issues
1.3.3.3 Re-pair After Un-pair from HA 12.2 BP5 to new OKV Server Still Shows Standalone
Issue: When an unpaired Oracle Key Vault primary server running Oracle Key Vault 12.2.0.5.0 or later is paired with a newly installed Oracle Key Vault server, the Current status on the Primary-Standby page shows that the server is in standalone mode. The Standalone status indicates that the primary-standby configuration has failed. The primary-standby setup fails because the SSH configuration on the primary server is not re-enabled.
Workaround: Before pairing an unpaired Oracle Key Vault primary server running Oracle Key Vault, disable and re-enable the SSH configuration. You should disable and then re-enable the SSH configuration after you perform the primary-standby configuration on the primary server after unpairing it with the standby server.
Note:
Before pairing an unpaired Oracle Key Vault primary server running Oracle Key Vault, ensure that you have closed all other browser instances.Bug Number: 26617880
Parent topic: Primary-Standby Issues
1.3.3.4 Audit Trail is not Sent To Remote Syslog on Switchover in Primary-Standby Pair
Description: With syslog configured on the primary, the audit logs are also written to the syslog. On switchover, the audit logs may not be written to the syslog. This is because the syslog has not been configured on the standby. Syslog needs to be configured on primary and standby separately.
Workaround: Configure the syslog on standby after switchover to enable write of audit logs to syslog.
Bug Number: 28790364
Parent topic: Primary-Standby Issues
1.3.3.5 Failover Issues When Primary OKV Experiences a Controlled Shutdown
Issue: Periodically, the primary Oracle Key Vault node in a primary-standby
pair may have a controlled shutdown. For example, a user
performs the shutdown by pressing a power off button in the
management console or executes the shutdown command from the
terminal. When this happens, there will be no failover operation
and the standby Oracle Key Vault node will not take over as the
primary server. This can be predicted by the existence of the
file /var/lock/subsys/dbfwdb
on the primary
Oracle Key Vault node. If the file exists on the primary at the
time of the controlled shutdown, there will not be a failover.
If it does not exist, then a failover should occur.
Note that failover still does occur in other situations such as power loss on the primary or database failure, regardless of the file's existence.
Workaround: If performing a controlled shutdown in an attempt to cause the standby node to take over as the new primary node, instead perform a switchover.
Bug Number: 29666606
Parent topic: Primary-Standby Issues
1.3.4 Multi-Master Cluster Issues
This section describes Oracle Key Vault issues specific to a multi-master cluster configuration.
- System Settings Changed on an OKV Node After Conversion to a Candidate Node Do Not Reflect On The Controller Node
- Replication May Fail to Resume After Multiple System Failures in OKV Cluster
- Oracle Key Vault Should Prevent Enabling From Finishing If It Takes Longer Than MDND
- RMAN Automatically Cleans Up Archivelogs Still Necessary for OGG
- Read-Write Nodes in Read-Only Restricted Mode After a Reboot
- Certificate Must Be Rotated Before Converting To Cluster If Upgrading From 12.2 BP4 or Older
- After Force-Deleting A Read-Write Node In 18.1 Cluster And Then Upgrading, May Not Be Able To Replace Force-Deleted Node In Higher Version
- Backup From Oracle Key Vault 18.1, 18.2 or 18.3 Cluster Node That Is Then Upgraded and Used To Make Another Cluster May Not Be Able To Add A Read-Write Peer
- Cluster Service Status Is Down After Rotating Server Certificate
- OGG Bug 32079454 Causes Intermittent Distribution Path Failures Causing Replication to Break
- When Password Expiration Alert Is Raised, Administrators Receiving an Email Storm
Parent topic: Known Issues
1.3.4.1 System Settings Changed on an OKV Node After Conversion to a Candidate Node Do Not Reflect On The Controller Node
Issue: If system settings are changed on an Oracle Key Vault node after it has been converted to a candidate node, and after the controller node's initial attempt to verify the candidate node's settings has failed, the updated settings do not reflect on the controller node. The pairing process must be aborted on both the controller and candidate nodes.
Workaround: None. Abort the pairing process on both the controller and candidate nodes. Change the system settings on the candidate node as desired, then re-attempt the pairing process.
Bug Number: 29430349
Parent topic: Multi-Master Cluster Issues
1.3.4.2 Replication May Fail to Resume After Multiple System Failures in OKV Cluster
Issue: Due to GoldenGate Bug 29624366, after multiple system failures in an Oracle Key Vault cluster, replication from some nodes may fail to resume. Specifically, GoldenGate replicats will terminate and not be able to process new change logs in the GoldenGate trail file when it happens.
Workaround: Manually reposition such replicats to skip erroneous records in the trail file or forcefully delete the troubled Oracle Key Vault nodes from the cluster and add new nodes to replace them.
Bug Number: 29700647
Parent topic: Multi-Master Cluster Issues
1.3.4.3 Oracle Key Vault Should Prevent Enabling From Finishing If It Takes Longer Than MDND
Issue: If you enable or disable an Oracle Key Vault node before the Maximum Disable Node Duration time limit, but the enabling does not finish before the Maximum Disable Node Duration time limit expires, it is possible that there could be cleanup of archivelogs and trail files that would cause inconsistency in the cluster. Don't allow the enabling process to finish in this case.
Workaround: Delete or force delete the node from the cluster if it takes longer than the Maximum Disable Node Duration amount of time to finish enabling.
Bug Number: 30533066
Parent topic: Multi-Master Cluster Issues
1.3.4.4 RMAN Automatically Cleans Up Archivelogs Still Necessary for OGG
Issue: RMAN automatically manages the archivelogs in the fast recovery area. Under normal circumstances, RMAN will not delete archivelogs that may still be needed by Oracle GoldenGate. However, under space pressure, RMAN may clean up the needed archivelogs. These archivelogs getting cleaned up will break replication from the current node to all other nodes except the node's read-write peer node. Oracle Key Vault attempts to mitigate this issue by performing regular clean up of the fast recovery area, but under rare circumstances, the fast recovery area may be filled up and this issue may occur.
Workaround: Identify the source of space pressure in the fast recovery
area and remedy the issue. You may identify space pressure in the fast recovery area by
keeping tabs on the disk space. The fast recovery area is located under
/var/lib/oracle/fast_recovery_area/
. If replication has broken
because of this issue, take a remote backup of the node and then force delete it from
the cluster. Note that you may need to make sure that any keys or other objects created
on that node are also on all other nodes in the cluster, and manually re-upload them if
they are not.
Bug Number: 30558372
Parent topic: Multi-Master Cluster Issues
1.3.4.5 Read-Write Nodes in Read-Only Restricted Mode After a Reboot
Issue: After rebooting a read-write node, sometimes the node or its read-write peer will become stuck in read-only restricted mode.
Workaround: When you reboot a node, it is normal for a node's read-write peer node to temporarily run in read-only restricted mode. However, soon after the node finishes booting, the read-write peer should transition back to read-write mode within a few minutes. The node that was rebooted may come up in read-only restricted mode, but should also transition back to read-write mode within a few minutes. However, if either a node or its read-write peer does not leave read-only restricted mode, redo shipping may be stuck. It may be fixed by rebooting the node still in read-only restricted mode.
Bug Number: 30589921
Parent topic: Multi-Master Cluster Issues
1.3.4.6 Certificate Must Be Rotated Before Converting To Cluster If Upgrading From 12.2 BP4 or Older
Issue: If you upgrade from Oracle Key Vault 12.2 BP4 or older and do not generate a new certificate before converting the upgraded Oracle Key Vault server to a cluster node, you will receive the following error message:
Failed to convert server to cluster node, detected use of weak signature
algorithms in OKV server credentials. Please perform a certificate rotation
operation before converting this server to a cluster node.
- Upgrade from Oracle Key Vault 12.2 BP4 to 12.2 BP11, and perform a certificate rotation operation.
- Upgrade from Oracle Key Vault 12.2 BP11 to Oracle Key Vault release 18.4.
Bug Number: 30673249
Related Topics
Parent topic: Multi-Master Cluster Issues
1.3.4.7 After Force-Deleting A Read-Write Node In 18.1 Cluster And Then Upgrading, May Not Be Able To Replace Force-Deleted Node In Higher Version
Issue: When force-deleting a read-write node, it should be shutdown first. However, due to GoldenGate bug 30413969, if the force-deleted node is shut down, the downstream extract on the deleted node's read-write peer node is not fully cleaned up. The workaround for this bug is present in Oracle Key Vault versions 18.2 and higher. However, if upgrading from an Oracle Key Vault 18.1 multi-master cluster that has had a read-write node force-deleted, if attempting to replace it after upgrade, it will still not succeed because the cleanup was not executed when the force-delete happened in version 18.1.
Workaround: The following steps are to be executed with caution. Executing these steps on the wrong Oracle Key Vault server will break replication and result in having to force-delete the node on which they were executed.
ssh support@Oracle_Key_Vault_IP_address
su - root
su - oracle
/var/lib/oracle/dbfw/bin/sqlplus / as sysdba
exec sys.dbms_xstream_adm.drop_outbound('OGG$OKV_DEXT');
exec sys.dbms_streams_adm.remove_queue('OGG$Q_OKV_DEXT', TRUE, TRUE);
After the above steps are successfully executed on Node A, it can be used as the controller node to add another node to the cluster as Node A's read-write peer.
Bug Number: 31216736
Parent topic: Multi-Master Cluster Issues
1.3.4.8 Backup From Oracle Key Vault 18.1, 18.2 or 18.3 Cluster Node That Is Then Upgraded and Used To Make Another Cluster May Not Be Able To Add A Read-Write Peer
Issue: When restoring a backup taken on a cluster node to a standalone Oracle
Key Vault server, the global_name
of the database on Oracle Key Vault
may be either DBFWDB.DBFWDB
or DBFWDB_HA2.DBFWDB
,
depending on the global_name of the cluster node on which the backup was taken. If the
global_name is DBFWDB_HA2.DBFWDB
, and the standalone Oracle Key Vault
server is converted to a cluster node, then it will not be able to successfully add a
read-write peer node due to the global_name
mismatch. The global name
is fixed during backup restore in versions 18.4 and higher, but if the backup was taken
and restored on a lower version, the issue will persist even after upgrading to 18.4 or
higher.
global_name
is
DBFWDB_HA2.DBFWDB
. Do not proceed with the
global_name
update if the global_name
returned by
the below select statement is not DBFWDB_HA2.DBFWDB
or if the server
has already been converted to a cluster
node.ssh support@Oracle_Key_Vault_IP_address
su - root
su - oracle
/var/lib/oracle/dbfw/bin/sqlplus / as sysdba
select global_name from global_name;
alter database rename global_name to DBFWDB.DBFWDB;
Bug Number: 31241245
Parent topic: Multi-Master Cluster Issues
1.3.4.9 Cluster Service Status Is Down After Rotating Server Certificate
Issue: Rotating the server certificate will stop multiple processes in order to replace the certificates. However, under normal circumstances, they are restarted soon after they are stopped. During or after certificate rotation, on the Monitoring page under the Cluster tab, the Cluster Services Status may show a downward arrow, indicating that one or more cluster services are not running. This will cause replication to be broken to and from this node. If it persists for more than a few minutes, it is likely that this bug has occurred.
Workaround: If this issue occurs, try to restart the cluster services by clicking the Restart Cluster Services button on the Monitoring page. After a few minutes, refresh the page. If the Cluster Service Status still shows a red downward arrow, contact Oracle Support.
Bug Number: 31371440
Parent topic: Multi-Master Cluster Issues
1.3.4.10 OGG Bug 32079454 Causes Intermittent Distribution Path Failures Causing Replication to Break
Issue: Due to Oracle GoldenGate bug 32079454, distribution paths will
intermittently encounter SSL errors that cause them to fail and not automatically
restart. This can cause replication between non-read-write peer nodes to break. Other
side effects are objects that transition from PENDING
to
ACTIVE
status to be stuck in PENDING
status. You
will also get replication lag alerts. You can see if a distribution path has potentially
failed by checking the Monitoring page under the
Cluster tab, and looking for red, downward arrows in the
Cluster Link State section.
Workaround: If restarting the cluster link on the Monitoring page under the Cluster tab does not resolve the issue, restart the node and verify that there are no red, downward arrows on the Monitoring page afterward.
Bug Number: 32079491
Parent topic: Multi-Master Cluster Issues
1.3.4.11 When Password Expiration Alert Is Raised, Administrators Receiving an Email Storm
Issue: The expiration date of an Oracle Key Vault user’s password may be slightly different on different nodes in a multi-master cluster environment. This causes the text of the alert raised on each node to differ, which may result in each Oracle Key Vault node sending many emails.
Workaround: To prevent all emails and notifications for the User Password Expiration alert, disable the alert. To disable the alert, navigate to the Configure Alerts page, deselect the Enabled check box next to User Password Expiration, then click Save.
Bug Number: 34095430
Parent topic: Multi-Master Cluster Issues
1.3.5 Software Development Kit Issues
The Oracle Key Vault Software Development Kit (SDK) has the following issues when working with Oracle Key Vault server.
-
If an unsupported attribute for an object type is added using the attribute addition or registration APIs, the server adds the attribute to the KMIP object, and no error is given by server.
APIs impacted are: okvAddAttribute, okvCreateKey, okvRegKey, okvRegSecretData, okvRegOpaqueData, okvRegTemplate, okvRegPrivateKey, okvRegPublicKey, okvRegCertificateRequest, okvRegCertificate
-
If a positive integer is passed as value for attribute index for a single instance attribute in request TTLV for registration, addition, modification and delete APIs , the server will add/modify/delete the attribute at index 0 and will return success irrespective of the index passed in the request.
APIs impacted are : okvAddAttribute, okvModifyAttribute, okvDeleteAttribute, okvCreateKey, okvRegKey, okvRegSecretData, okvRegOpaqueData, okvRegPrivateKey, okvRegPublicKey, okvRegCertificateRequest, okvRegCertificate
-
If an invalid integer is passed as value for attribute index for a multi instance attribute in request TTLV for modification and deletion APIs, the server will not modify or delete the attribute value and also will not throw any error.
APIs impacted are : okvModifyAttribute, okvDeleteAttribute
-
The server doesn’t validate the cryptographic usage mask value passed in request TTLV and the value will be added in case of attribute addition and modification.
APIs impacted are: okvModifyAttribute, okvAddAttribute, okvCreateKey, okvRegKey, okvRegSecretData, okvRegPrivateKey, okvRegPublicKey, okvRegCertificate
-
Oracle Key Vault server currently stores type of name attribute as Uninterpreted Text string in all cases irrespective of the name type in request TTLV.
APIs impacted are: okvAddAttribute, okvModifyAttribute, okvDeleteAttribute, okvCreateKey, okvRegKey, okvRegSecretData, okvRegOpaqueData, okvRegPrivateKey, okvRegPublicKey, okvRegCertificateRequest, okvRegCertificate
-
If an invalid custom attribute identifier is passed in request TTLV for modification or deletion, the server returns success and no attribute value is modified or deleted.
APIs impacted are: okvModifyAttribute, okvDeleteAttribute
-
If multiple single instance attributes are added to request TTLV, then no error will be thrown and the first value will get added.
APIs impacted are: okvCreateKey, okvRegKey, okvRegSecretData, okvRegOpaqueData, okvRegTemplate, okvRegPrivateKey, okvRegPublicKey, okvRegCertificateRequest, okvRegCertificate
-
The objects created using SDK are not downloadable by
okvutil
as of today. Attempting to run theokvutil download
command may show the warningWARNING: Could not store <Unique Identifier of the object>
. This warning can be safely ignored as we are skipping the download of keys, secrets & objects created through SDK (if found) to the given wallet. Support for the same will be provided in future releases. -
Whenever a server operation is performed using C SDK, Java SDK, or RESTful utility, the configuration file
okvclient.ora
does not get updated with the latest state. The configuration file remains static as it is when the endpoint software is installed. For example, if there is a new node added to the Oracle Key Vault cluster, the client configuration fileokvclient.ora
will not get updated with the new node information whenever a server operation is performed using Oracle Key Vault SDK or RESTful utility.
Parent topic: Known Issues
1.4 Oracle Key Vault Considerations
Below are details and changes of behavior of this release of Oracle Key Vault.
1.4.1 Oracle TDE and Oracle Key Vault Integration
Depending on the Oracle Database version used and on the feature of TDE used, there might be a need to patch the Oracle database for smooth operations.
Refer to the MOS-NOTE with Doc ID 2535751.1 to ascertain if your deployment needs a database patch.
The MOS-NOTE lists known issues with Oracle Database Transparent Data Encryption (TDE) feature when it is configured to use Oracle Key Vault as the keystore. The document also lists the fixes that resolve the issues enabling smoother integration between Oracle Database TDE and Oracle Key Vault. The issues could be defects, reducing the user burden with simplified operations, or improving the integration between TDE and OKV. The document is for Database Administrators and others tasked with managing the TDE Master Keys with Oracle Key Vault.
Parent topic: Oracle Key Vault Considerations
1.4.2 Reports are Affected by Audit Replication in a Multi-Master Cluster
Oracle Key Vault reports and details in the home page are generated from Oracle Key Vault audit records. Each node will show reports of the operations specifically done on that node if audit replication is turned off. Each node will show reports of the operations done on all nodes in the cluster if audit replication is turned on.
The recommendation is to turn off audit replication and use a security information and event management (SIEM) solution like Oracle Audit Vault and Database Firewall (AVDF) to collect audit records from all nodes.
Related Topics
Parent topic: Oracle Key Vault Considerations
1.4.3 Updates in a Multi-Master Cluster are Slower Than in a Single Instance
An update in a multi-master cluster might check for an object's existence, which may result in a scan of all nodes in the cluster slowing down the update operation. The time will increase proportional to the number of nodes in the cluster. The update could take several minutes to complete.
Setting and rotating the TDE master encryption key are examples of update operations.
Parent topic: Oracle Key Vault Considerations
1.5 Supported Database Versions
The following versions of Oracle Database are supported with this release of Oracle Key Vault:
- Oracle DB 11.2 with the compatible parameter set to 11.2
- Oracle DB 12.1 with the compatible parameter set to 11.2
- Oracle DB 12.2
- Oracle DB 18c
- Oracle DB 19c
Parent topic: Release Notes
1.6 Critical Patch Updates Included in Release 21.2
Oracle Key Vault release 21.2 updated the underlying infrastructure to incorporate the April 2021 Release Update for Oracle Database 19 (19.11 DB RU) - April Release Update. Please sign in for full details.
https://www.oracle.com/security-alerts/cpuapr2021.html
Oracle Key Vault release 21.2 also includes security and stability fixes for Java and Oracle Linux (OL7U9) operating system.
Parent topic: Release Notes
1.7 Documentation Accessibility
For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.
Access to Oracle Support
Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.
Parent topic: Release Notes
1.8 Diversity and Inclusion
Oracle is fully committed to diversity and inclusion. Oracle respects and values having a diverse workforce that increases thought leadership and innovation. As part of our initiative to build a more inclusive culture that positively impacts our employees, customers, and partners, we are working to remove insensitive terms from our products and documentation. We are also mindful of the necessity to maintain compatibility with our customers' existing technologies and the need to ensure continuity of service as Oracle's offerings and industry standards evolve. Because of these technical constraints, our effort to remove insensitive terms is ongoing and will take time and external cooperation.
Parent topic: Release Notes
Oracle Key Vault Release Notes, 21.2
F39989-05
April 2022
Copyright © 2014, 2022, Oracle and/or its affiliates.