Configuring Transparent Data Encryption(TDE) in Oracle 19c Standalone Database.

Oracle Nexus

4 min read

·

Jun 26, 2026

--

Listen

Share

Press enter or click to view image in full size

TDE can be enabled for the data protection in database. TDE used for the encryption of Tablespaces, Individual Columns, Tables, Index, LOB Data, Partitioned Table, MView, XML Data Type, Secure Files.

In this blog, we are going to configure TDE for a standalone database.

High Level Steps:

1. Create wallet directory at OS level.
2. Set wallet_root parameter.
3. Create TDE wallet, open it and create Master key.
4. Enable Auto-login.

Explanation:

1. What is Keystore?

A keystore (also called a wallet) is a secure container that stores Oracle’s encryption keys.

2. What is a Master Key?

The master key is the top-level encryption key used by TDE. It does not encrypt your table data directly. Instead, it protects the keys that do.

Encryption Flow:

                  Keystore
              (ewallet.p12)
                     │
                     │ stores
                     ▼
             MASTER ENCRYPTION KEY
                     │
                     │ encrypts
                     ▼
         Tablespace Encryption Key
                     │
                     │ encrypts
                     ▼
         Data Blocks inside Datafiles

Configuration:

Step 1: Check for any pre-existing wallet,

SELECT STATUS,
       WALLET_TYPE,
       KEYSTORE_MODE
FROM V$ENCRYPTION_WALLET;

Step 2: Create a wallet directory at OS level.

Step 3: Verify the current status of wallet_root parameter and change the parameter.

show parameter wallet_root
SHOW PARAMETER tde_configuration

If the above parameters returns no value, change the values to,

ALTER SYSTEM SET WALLET_ROOT='/u01/apps/oracle/product/UAT/home/UAT/wallet'
SCOPE=SPFILE;
<--Database Bounce-->
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=FILE'
SCOPE=BOTH;

Bounce the Database and verify,

Step 4: Create Software keystore (wallet).

ADMINISTER KEY MANAGEMENT
CREATE KEYSTORE
IDENTIFIED BY "Oracle$123";

This will create a directory tde inside the wallet dir and .p12 file will be created inside the tde directory.

Step 5: Open the wallet,

ADMINISTER KEY MANAGEMENT
SET KEYSTORE OPEN
IDENTIFIED BY "Oracle$123";

To Verify,

SELECT STATUS,
       WALLET_TYPE,
       KEYSTORE_MODE
FROM V$ENCRYPTION_WALLET;

Step 6: Create a Master Encryption key,

ADMINISTER KEY MANAGEMENT
SET KEY
IDENTIFIED BY "Oracle$123"
WITH BACKUP;

This command automatically will create a backup of this master key.

Verify the Master key:

SELECT KEY_ID,
       ACTIVATION_TIME
FROM V$ENCRYPTION_KEYS;

Press enter or click to view image in full size

Verify the wallet status:

SET LINESIZE 200
SET PAGESIZE 100
COLUMN STATUS         FORMAT A20
COLUMN WALLET_TYPE    FORMAT A12
COLUMN KEYSTORE_MODE  FORMAT A12

SELECT STATUS,
       WALLET_TYPE,
       KEYSTORE_MODE
FROM   V$ENCRYPTION_WALLET;

Step 7: Create Auto-Login wallet,

ADMINISTER KEY MANAGEMENT
CREATE AUTO_LOGIN KEYSTORE
FROM KEYSTORE
'/u01/apps/oracle/product/UAT/home/UAT/wallet/tde'
IDENTIFIED BY "Oracle$123";

For auto-login, *.sso* file will be created automatically inside the tde directory.

Step 8: Do a Database bounce and check the wallet is converted into autologin.

SELECT STATUS,
       WALLET_TYPE,
       KEYSTORE_MODE
FROM V$ENCRYPTION_WALLET;

Tablespace Encryption:

1. To Encrypt a existing Tablespace,

ALTER TABLESPACE SK ENCRYPTION ONLINE ENCRYPT;

2. Verify the Tablespace Encryption,

SELECT TABLESPACE_NAME,
       ENCRYPTED
FROM DBA_TABLESPACES;

To Decrypt a Encrypted Tablespace:

ALTER TABLESPACE SK ENCRYPTION ONLINE DECRYPT;