The keys for PDBs having keystore in united mode, can be created from CDB root or from the PDB. You can perform general administrative tasks with Transparent Data Encryption in united mode.

Administering Transparent Data Encryption in United Mode.

Administering Keystores and TDE Master Encryption Keys in United ModeĪfter you configure a keystore and master encryption key for use in united mode, you can perform tasks such as rekeying TDE master encryption keys.In united mode, an external keystore resides in an external key manager, which is designed to store encryption keys.

Configuring an External Keystore in United Mode.

In united mode, the software keystore resides in the CDB root but the master keys from this keystore are available for the PDBs that have their keystore in united mode.

Configuring a Software Keystore for Use in United Mode.

Configuring the Keystore Location and Type for United Modeįor united mode, you can configure the keystore location and type by using only parameters or a combination of parameters and the ALTER SYSTEM statement.

Operations That Are Not Allowed in a United Mode PDBĪDMINISTER KEY MANAGEMENT operations that are not allowed in a united mode PDB can be performed in the CDB root.

Many ADMINISTER KEY MANAGEMENT operations performed in the CDB root apply to keystores and encryption keys in the united mode PDB.

Operations That Are Allowed in United Mode.

In united mode, you create the keystore and TDE master encryption key for CDB and PDBs that reside in the same keystore.

About Managing Keystores and TDE Master Encryption Keys in United Mode.

Key root master