{
  "date": "2016-11-23T06:20:25",
  "slug": "12cr2-upgrade-by-remote-clone-with-tde-in-dbaas",
  "link": "https://www.dbi-services.com/blog/12cr2-upgrade-by-remote-clone-with-tde-in-dbaas/",
  "title": {
    "rendered": "12cR2: Upgrade by remote clone with TDE in DBaaS"
  },
  "content": {
    "rendered": "<h2>By Franck Pachot</h2>\n<p>.<br />\nUpgrading from 12.1 to 12.2 is easy in Oracle Public Cloud DBaaS because you are in multitenant. Here is how to clone a 12.1 PDB to 12.2 service.<br />\n<!--more--><br />\nI&#8217;ve a service HP121 in 12.1.0.2 with one pluggable database PDB1 and a service HP122 in 12.2.0.1 with an empty CDB (only CDB$ROOT and PDB$SEED containers).</p>\n<h3>Export TDE key</h3>\n<p>The Oracle Public Cloud uses Transparent Data Encryption to secure the datafiles. When you move the pluggable databases you need to export/import the encryption keys.</p>\n<p>Here is the key:</p>\n<pre><code>\n18:42:58 HP121 SQL&gt;select wrl_type,wrl_parameter,wallet_type from v$encryption_wallet;\n&nbsp;\nWRL_TYPE WRL_PARAMETER                            WALLET_TY\n-------- ---------------------------------------- ---------\nFILE     /u01/app/oracle/admin/HP121/tde_wallet/  AUTOLOGIN\n&nbsp;\n18:42:58 HP121 SQL&gt;select key_id from v$encryption_keys where creator_pdbname='PDB1';\n&nbsp;\nKEY_ID\n------------------------------------------------------------------------------\nAQqCc8XWV09uvxkaw0Bm5XUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n</code></pre>\n<p>The instance uses an auto-login wallet and you cannot export the keys from that:</p>\n<pre><code>\n18:42:58 HP121 SQL&gt;administer key management export encryption keys with secret \"oracle\" to '/tmp/cdb2pdb1.p12' identified by \"Ach1z0#d\" with identifier in (select key_id from v$encryption_keys where creator_pdbname='PDB1');\nadminister key management export encryption keys with secret \"oracle\" to '/tmp/cdb2pdb1.p12' identified by \"Ach1z0#d\" with identifier in (select key_id from v$encryption_keys where creator_pdbname='PDB1')\n*\nERROR at line 1:\nORA-28417: password-based keystore is not open\n</code></pre>\n<p>You need to open it with the password:</p>\n<pre><code>\n18:42:58 HP121 SQL&gt;administer key management set keystore close;\nkeystore altered.\n&nbsp;\n18:42:58 HP121 SQL&gt;administer key management set keystore open identified by \"Ach1z0#d\";\nkeystore altered.\n&nbsp;\n18:42:58 HP121 SQL&gt;select wrl_type,wrl_parameter,wallet_type from v$encryption_wallet;\n&nbsp;\nWRL_TYPE WRL_PARAMETER                            WALLET_TY\n-------- ---------------------------------------- ---------\nFILE     /u01/app/oracle/admin/HP121/tde_wallet/  PASSWORD\n</code></pre>\n<p>And then you can export it:</p>\n<pre><code>\n18:42:58 HP121 SQL&gt;administer key management export encryption keys with secret \"oracle\" to '/tmp/cdb2pdb1.p12' identified by \"Ach1z0#d\" with identifier in (select key_id from v$encryption_keys where creator_pdbname='PDB1');\nkeystore altered.\n</code></pre>\n<h3>Import TDE key</h3>\n<p>I copy the file /tmp/cdb2pdb1.p12 to the destination (scp) and then I can import it, giving the same &#8216;secret&#8217; identifier. Here again i have to open the wallet with password because it cannot be imported when opened </p>\n<pre><code>\n18:43:04 HP122 SQL&gt;administer key management set keystore close;\nkeystore altered.\n18:43:04 HP122 SQL&gt;administer key management set keystore open identified by \"Ach1z0#d\";\nkeystore altered.\n18:43:04 HP122 SQL&gt;administer key management import encryption keys with secret \"oracle\" from '/tmp/cdb2pdb1.p12' identified by \"Ach1z0#d\";\nkeystore altered.\n</code></pre>\n<h3>Database link</h3>\n<p>We need to create a database link to the source (don&#8217;t forget to open the port for the listener):</p>\n<pre><code>\n18:43:04 HP122 SQL&gt;select dbms_tns.resolve_tnsname('//HP121/HP121.demnov.oraclecloud.internal') from dual;\n&nbsp;\nDBMS_TNS.RESOLVE_TNSNAME('//HP121/HP121.DEMNOV.ORACLECLOUD.INTERNAL')\n--------------------------------------------------------------------------------\n(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=HP121.demnov.oraclecloud.internal)(CID=\n(PROGRAM=oracle)(HOST=HP122.compute-demnov.oraclecloud.internal)(USER=oracle)))(\nADDRESS=(PROTOCOL=TCP)(HOST=10.196.202.47)(PORT=1521)))\n&nbsp;\n18:43:04 HP122 SQL&gt;create database link  HP121@HP121 connect to system identified by \"Ach1z0#d\" using '//HP121/HP121.demnov.oraclecloud.internal';\nDatabase link created.\n&nbsp;\n18:43:04 HP122 SQL&gt;select host_name from v$instance@HP121@HP121;\n&nbsp;\nHOST_NAME\n----------------------------------------------------------------\nHP121.compute-demnov.oraclecloud.internal\n</code></pre>\n<h3>Remote clone</h3>\n<p>You need to have the source PDB1 opened read-only, and the cloning is only one command:</p>\n<pre><code>\n18:43:09 HP122 SQL&gt;create pluggable database PDB1 from PDB1@HP121@HP121 keystore identified by \"Ach1z0#d\";\nPluggable database created.\n</code></pre>\n<h3>Upgrade</h3>\n<p>Now that you have the PDB you can open it (because you have imported the TDE key) but the dictionary is still in 12.1 so you have to run:</p>\n<pre><code>\n[oracle@HP122 ~]$ dbupgrade -c PDB1\n</code></pre>\n<p>This is described in previous post: <a href=\"http://dbi-services.com/blog/12cr2-how-long-to-upgrade-a-pdb/\" target=\"_blank\" rel=\"noopener noreferrer\">http://dbi-services.com/blog/12cr2-how-long-to-upgrade-a-pdb/</a></p>\n",
    "protected": false
  }
}