Migrating an OCI Vault TDE-enabled vPDB

Migrating an OCI Vault TDE-enabled virtual pluggable database (vPDB) from one container database to another container database on the same target host or a different target host involves the following steps:

Disable the vPDB.
Migrate.
(Applicable only for an OCI Vault TDE-Enabled vPDB) For an OCI Vault TDE-enabled vPDB, additional steps are required before enabling.

These steps are essential because the exported keyfiles are not present on Delphix Continuous Data Storage:
1. Copy the parent cdb.json and cwallet.sso from the original target host to the new target host into the parent keystore path. If the vPDB is being migrated to a different CDB on the same target host, then this step is not needed. If the new host has the parent keystore in a different location, then the parent keystore path for the vPDB needs to be updated before enabling the vPDB.
2. Copy the artifact directory for the vPDB from the original target host to the new target host.
3. Make sure to change the tde_configuration of new target CDB from OKV|FILE to HSM|FILE.
4. Make sure to create the $WALLET_ROOT/tde_seps for new target CDB and copy the $WALLET_ROOT/tde/cwallet.sso to $WALLET_ROOT/tde_seps/ directory as well as the make sure this directory and file have the same permission as $WALLET_ROOT/tde. You need to perform this steps as Oracle install user.
5. Previous target CDB's primary key ocidshould be added as secondary key in the new Target CDB instance for all the nodes using OCI utility. Previous CDB's primary key ocid can be found inside KMS PKCS11 configuration file of previous target CDB.
  
  Steps to add secondary key in the target CDB:
  1. On each node of the Target database, log in as Oracle install user and run the following command.
```
sudo su - oracle  
/usr/bin/kms-tde-cli add-secondary-keys --force --oracle-sid=<instance_name> "<source_primary_key_ocid>”
```
  2. Verify secondary keys are added.
```
/usr/bin/kms-tde-cli print-secondary-keys
```
  3. After merging, the cdb.json of new target database looks as below.
```
{
  "version": "1",
  "primaryKeyClient": {
    "keyOcid": "ocid1.key.oc1.phx.eftvt2peaaemm.abyhqljrhxgw7bupw6qpsg7j2rave77oxue2on5fnbm2t2n7m2kx6zilrgxq",
    "kmsDnsSuffix": "kms.us-phoenix-1.oraclecloud.com",
    "authConfig": {
      "type": "RESOURCE_PRINCIPAL_V1",
      "authEndpoint": "https://auth.us-phoenix-1.oraclecloud.com",
      "rptIssuingEndpoint": "https://database.us-phoenix-1.oraclecloud.com"
    }
  },
  "secondaryKeyClients": [
    {
      "keyOcid": "ocid1.key.oc1.phx.eftvt2peaaemm.abyhqljstx6tyklqp5qpx2kt7pozunoyojxhdsaxvi6hnpo4xqb6ufmwek5a",
      "kmsDnsSuffix": "kms.us-phoenix-1.oraclecloud.com",
      "authConfig": {
        "type": "RESOURCE_PRINCIPAL_V1",
        "authEndpoint": "https://auth.us-phoenix-1.oraclecloud.com",
        "rptIssuingEndpoint": "https://database.us-phoenix-1.oraclecloud.com"
      }
    }
  ]
}
```

Last updated

Oct 9, 2026

Steps to add secondary key in the target CDB: