<<Back to Oracle DB Security Main Page
How To Merge One Software into Another Existing Software Keystore
There are many situations when you need to merge the Keystores eg. You added a New key in primary database Keystore having physical standby database to replicate the keys you must merge key stores of primary database with physical standby.You can merge any combination of software keystores, but the merged keystore must be password-based
SQL> ADMINISTER KEY MANAGEMENT MERGE KEYSTORE '+DG_TST_DATA/TST1T/wallet/' IDENTIFIED BY xxxx INTO EXISTING KEYSTORE '/u01/dbatst1/admin/wallet/TST1T/' IDENTIFIED BY xxxx WITH BACKUP USING 'Merg_bkp';
keystore altered.
Validate the presence of Keys in New Wallet
$orapki wallet display -wallet /u01/dbatst1/admin/wallet/TST1T/
Syntax
ADMINISTER KEY MANAGEMENT MERGE KEYSTORE 'keystore1_location'
[IDENTIFIED BY software_keystore1_password]
INTO EXISTING KEYSTORE 'keystore2_location'
IDENTIFIED BY software_keystore2_password
[WITH BACKUP [USING 'backup_identifier]];
How to Merge Two Software Keystores into a Third New Keystore
SQL> ADMINISTER KEY MANAGEMENT MERGE KEYSTORE '+DG_TST_DATA/TST1T/wallet/' IDENTIFIED BY xxxx AND KEYSTORE '/u01/dbatst1/admin/wallet/TST1T/' IDENTIFIED BY xxxx INTO NEW KEYSTORE '/u01/dbatst1/admin/wallet/TST1T/Third_Keystore' IDENTIFIED BY xxxx;keystore altered.
Validate the presence of Keys in New Wallet
$orapki wallet display -wallet /u01/dbatst1/admin/wallet/TST1T/
Syntax
ADMINISTER KEY MANAGEMENT MERGE KEYSTORE 'keystore1_location'
[IDENTIFIED BY software_keystore1_password] AND KEYSTORE 'keystore2_location'
[IDENTIFIED BY software_keystore2_password]
INTO NEW KEYSTORE 'keystore3_location'
IDENTIFIED BY software_keystore3_password;
Reversing a Software Keystore Merge Operation
You cannot directly reverse a keystore merge operation but you can restore it from previous backup.When you merge a keystore into an existing keystore (rather than creating a new one),
you must include the WITH BACKUP clause in the ADMINISTER KEY MANAGEMENT statement to
create a backup of this existing keystore. Later on, if you decide that you must reverse
the merge, you can replace the merged software keystore with the one that you
backed up.
Comments
Post a Comment