Aller au contenu principal

Deployment Bundle Example (Windows)

This is exactly what Export Bundle → Windows produces from the Oracle TDE app detail page (see Getting Started on Windows), with realistic placeholder values substituted for the real app_id, access_guid, and access_token. Deploying on Linux instead? See the Linux bundle example.

# Oracle TDE Deployment Bundle
# App: my-oracle-db
# Access GUID: a8a7344f-244a-4f10-966d-b2f3094612c3
# Master key: TDE-MASTER-20260811 (8ce6e566-5ee3-4a38-9700-a55113a2fecc)

## 1. pkcs11.toml  (install at: C:\oracle\dke\pkcs11.toml)
# DKE Oracle TDE PKCS#11 Provider Configuration
# Generated: 2026-08-11 13:29:59 UTC

[http_config]
server_url = "https://cockpit-api-test.duokey.cloud/api/apps/7d3b929b-18cb-4bd7-b518-47a49a9cb2de/tde/pkcs11/a8a7344f-244a-4f10-966d-b2f3094612c3"
access_token = "8ed23e3a5a568b497d4447e15302c3a6f5464e0fc0d583fa69787c3fc8153c16"
timeout_secs = 30
verify_tls = true

[pkcs11]
slot_id = 0
logging_level = "info"
logging_folder = "C:\oracle\dke\logs"

## 2. Install the PKCS#11 library  (target: C:\oracle\extapi\64\hsm\DuoKey\1.0\dke_pkcs11.dll)
# dke_pkcs11.dll must be built with a statically-linked C runtime, or it fails to load (Win32
# error 126) on any host without the matching Visual C++ Redistributable installed: build with
# RUSTFLAGS="-C target-feature=+crt-static" cargo build --release -p dke-pkcs11 and verify with
# dumpbin /DEPENDENTS dke_pkcs11.dll (no VCRUNTIME140.dll or api-ms-win-crt-*.dll should appear).
# Separately, the Oracle Windows service runs as a per-service virtual account
# (NT SERVICE\OracleService<SID>), a distinct security principal from whatever account created
# the config/log files — grant it explicit access (see below) or the library fails to read its
# own config with a generic CKR_GENERAL_ERROR and zero log output, surfaced by Oracle as an
# unhelpful ORA-28407/ORA-28353.
New-Item -ItemType Directory -Force -Path 'C:\oracle\extapi\64\hsm\DuoKey\1.0'
Copy-Item dke_pkcs11.dll 'C:\oracle\extapi\64\hsm\DuoKey\1.0\dke_pkcs11.dll'
New-Item -ItemType Directory -Force -Path 'C:\oracle\dke'
icacls 'C:\oracle\dke' /grant 'NT SERVICE\OracleService<SID>:(OI)(CI)(F)'

## 3. Environment variables
DKE_PKCS11_LOGGING_LEVEL=info
DKE_PKCS11_CONF=C:\oracle\dke\pkcs11.toml

## 4. SQL deployment scripts

-- 1. Set Wallet Root
-- Configure the Oracle wallet root directory. On Windows, create this directory before running
-- this statement — Oracle does not always create it for you, and a missing directory produces a
-- wallet-open failure later that looks unrelated to this step.
ALTER SYSTEM SET WALLET_ROOT='C:\oracle\admin\ORCL\wallet' SCOPE=SPFILE;

-- 2. Restart Database
-- Restart required for WALLET_ROOT to become active. This MUST run before the next step —
-- setting TDE_CONFIGURATION while WALLET_ROOT is still pending (SPFILE-only) fails with
-- ORA-32017/ORA-46693.
SHUTDOWN IMMEDIATE;
STARTUP;

-- 3. Set TDE Configuration
-- Set TDE to use HSM mode. Run only after the restart above.
ALTER SYSTEM SET TDE_CONFIGURATION='KEYSTORE_CONFIGURATION=HSM' SCOPE=BOTH;

-- 4. Open HSM Keystore
-- Open the HSM-backed keystore for every container (CDB root + all PDBs). The PIN is a syntactic
-- placeholder only — the real credential is access_token in pkcs11.toml, presented as
-- Authorization: Bearer — but Oracle's grammar requires a literal string here, not EXTERNAL STORE.
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<pin>" CONTAINER=ALL;

-- 5. Set TDE Master Key
-- Create and activate the master encryption key for every container. Run this in the SAME
-- session as the previous step — Oracle's default 3-second HSM heartbeat can close the keystore
-- if too much time passes between separate sqlplus sessions.
ADMINISTER KEY MANAGEMENT SET KEY
  IDENTIFIED BY "<pin>"
  WITH BACKUP USING 'dke_tde_backup_20260811'
  CONTAINER=ALL;

-- 6. Enable Auto-Login (Optional)
-- Auto-open keystore on startup.
ADMINISTER KEY MANAGEMENT CREATE LOCAL AUTO_LOGIN KEYSTORE
  FROM KEYSTORE '<wallet_root>/tde'
  IDENTIFIED BY "<wallet_password>";

-- 7. Encrypt Tablespace (Example)
-- Example: encrypt USERS tablespace.
ALTER TABLESPACE USERS ENCRYPTION ONLINE
  USING 'AES256'
  ENCRYPT;

-- 8. Verify Encryption
-- Verify TDE is active.
SELECT KEY_ID, KEYSTORE_TYPE, ACTIVATION_TIME
FROM V$ENCRYPTION_KEYS
WHERE ACTIVATION_TIME IS NOT NULL;

SELECT TABLESPACE_NAME, ENCRYPTED
FROM DBA_TABLESPACES;

SELECT WRL_TYPE, STATUS, WALLET_TYPE
FROM V$ENCRYPTION_WALLET;
Two things that only apply on Windows — both easy to misdiagnose as Oracle bugs
  1. The library path is fixed and independent of ORACLE_HOME/ORACLE_BASE. C:\oracle\extapi\64\hsm\DuoKey\1.0\ is scanned regardless of where the database software actually lives — a library placed under the "obvious" per-instance path is silently never found.
  2. Replace <SID> in the icacls command with your actual database instance name (e.g. OracleServiceORCL), and confirm it with Get-WmiObject Win32_Service -Filter "Name='OracleService<SID>'" | Select-Object StartName first. Oracle's Windows service runs as this per-service virtual account — a distinct principal from whichever account placed these files — and without this grant the library can't even read its own config, failing silently with zero log output.

See Getting Started on Windows for the full walkthrough and Troubleshooting for the underlying investigation.

server_url uses the API hostname, not the frontend one

Notice cockpit-api-test.duokey.cloud, not cockpit-test.duokey.cloud — Cockpit v2 serves the machine-facing API and the browser UI on separate hostnames. A curl/Invoke-WebRequest against it should return JSON ({"ok":true,"status":"ready",...}), never an HTML page.

Never commit this file to version control or paste it into a ticket/chat — it contains the real access_token bearer credential.