Use the procedures below to set up a CSP Vault for Databases production environment. 

Prerequisites

Before you begin, make sure you have created a CSP Vault for Databases. For more information about creating a vault, see: Creating a Vault.

To set up a CSP Vault production environment

  1. Log in to the Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. (optional) Create a CSP cluster node mapping. For more information, see: Creating a Cluster Node Mapping for CSP Vault for Databases.

    A CSP cluster node mapping helps Entrust client on the database node to failover in case one of the CSP node fails.

  3. Download the TDE script bundle. For more information, see: Downloading the TDE Script Bundle for Oracle.

    The prefix specified when downloading the TDE scripts is stored in entrust.conf as the DBSet name. The DBSet name does not represent an actual object. It serves as the base name for generating the associated CVMSet and KeySet names. For example, if the DBSet name is oracle, the scripts create the KeySet oracle_keyset and the CVMSet oracle_cvmset. You can change the DBSet name in entrust.conf after downloading the TDE scripts.


To set up a CSP Vault production environment

  1. Copy the TDE script bundle to the first Oracle server node.

    The bundle is a ZIP file named <name>.zip, where <name> is the name you specified when downloading the bundle in To set up a CSP Vault production environment. For example, oracle_toi.zip.

    The steps below use oracle_toi.zip as an example.

  2. Open Git bash.
  3. Run the following command to download the TDE script bundle from the CSP Vault production environment:
    scp Downloads/oracle_toi.zip oracle@<ip-address>:oracle_toi.zip
  4. Open your Oracle server.
  5. Unzip the the TDE script bundle:
    unzip oracle_toi.zip
  6. Navigate to the TDE script bundle folder:
    cd oracle_toi
  7. List the contents in the TDE script bundle folder:
    ls
  8. Set up the first Oracle server node as root:
    sudo ./setup.sh first ./entrust.conf
  9. At the prompt, enter your password for the Oracle server node.
  10. At the prompt, enter the password for the CSP Vault for Database.
  11. At the prompt, log in to the Oracle server node as the vault administrator. The system creates the keyset and the CVMset.
  12. At the prompt, verify that the Oracle server node can communicate with CSP Vault for Database:
    /opt/hcs/bin/check_connection /opt/oracle/entrust/oracle_toi.conf