ORA-28374: typed master key not found in wallet

<<Back to Oracle DB Security Main Page

ORA-46665: master keys not activated for all PDBs during REKEY

SQL> ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = ALL ;
ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = ALL
*
ERROR at line 1:
ORA-46665: master keys not activated for all PDBs during REKEY

I found following in the trace file

REKEY: Create Key in PDB 3 resulted in error 46658
*** 2019-02-06T15:27:04.667485+01:00 (CDB$ROOT(1))
REKEY: Activation of Key AdnU5OzNP08Qv1mIyXhP/64AAAAAAAAAAAAAAAAAAAAAAAAAAAAA in PDB 3 resulted in error 28374
REKEY: Keystore needs to be restored from the REKEY backup.Aborting REKEY!

Cause:

All this hassle started because I accidently deleted the wallet and all wallet backup files too and also forgot the keystore password. There was no way to restore the wallet back.

Fortunately in my case the PDB which had encrypted data was supposed to be decommissioned so dropped the PDB. After dropping the PDB I verified if still any encrypted object is present or not

SQL> select * from dba_encrypted_columns;
no rows selected
SQL> select * from cdb_encrypted_columns;
no rows selected
SQL> select * from sys.enc$;
no rows selected
SQL> select t.owner,t.table_name, t.tablespace_name from dba_tables t,
dba_tablespaces s where t.tablespace_name=s.tablespace_name
and s.encrypted = 'YES';
no rows selected
SQL> select tablespace_name from dba_tablespaces where encrypted = 'YES';
no rows selected

Then I tried to create the keystore (since ewallet.p12 cwallet.sso was already accidently deleted) I created the Keystore but as soon as I tried to set the master encryption Key a new error appeared. 

ORA-28374: typed master key not found in wallet

SQL>  ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = current;
 ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = current
*
ERROR at line 1:
ORA-28374: typed master key not found in wallet
**************************************************************************
$ oerr ora 28374
28374, 0000, "typed master key not found in wallet"
// *Cause:  You attempted to access encrypted tablespace or redo logs with
//          a typed master key not existing in the wallet.
// *Action: Copy the correct Oracle Wallet from the instance where the tablespace
//          was created.
//
****************************************************************************
TO overcome with this error we found out _db_discard_lost_masterkey parameter 
SQL> ALTER SYSTEM SET "_db_discard_lost_masterkey"=TRUE SCOPE=MEMORY;
System altered.
SQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY xxxx WITH BACKUP ;
keystore altered.
SQL> startup force;
ORACLE instance started.
Total System Global Area 2147483648 bytes
Fixed Size                  8794848 bytes
Variable Size            1912605984 bytes
Database Buffers          218103808 bytes
Redo Buffers                7979008 bytes
Database mounted.
Database opened.
SQL> select STATUS,WRL_PARAMETER WALLET_DIR,WALLET_TYPE from V$ENCRYPTION_WALLET;
STATUS                WALLET_DIR                       WALLET_TYPE
--------------------- -------------------------------- --------------------
OPEN                  /u01/dbatst1/admin/wallet/TST1T/ AUTOLOGIN
 NOTE: This was my personal experience. Please always contact oracle to set any "_ " parameter