Recovering Forgotten Oracle Database TDE Wallet Password: Step-by-Step Guide

Transparent Data Encryption (TDE) is a critical security feature in Oracle Databases, widely used by BFSI (Banking, Financial Services, and Insurance) organizations to comply with regulatory requirements. TDE ensures data-at-rest encryption, making it a mandatory feature for cloud-hosted databases as well.

Since many databases are configured with Auto-Login, DBA teams rarely use the TDE Wallet password. However, certain operations still require manual authentication. This guide provides a step-by-step solution for recovering access to the TDE Wallet without knowing the original password, using the Wallet Merge method.

When is the TDE Wallet Password Required (Even with Auto-Login)?

Even if Auto-Login is configured, you will need the TDE Wallet password for:

Rekeying the wallet (changing the master encryption key).
Generating a new master key.
Exporting keys for Pluggable Database (PDB) migration.
Performing remote cloning of a PDB.
Migrating a file-based wallet to Oracle Key Vault (OKV).

Scenario: Forgotten TDE Wallet Password

A database administrator (DBA) encountered an issue where they needed to migrate a database TDE Wallet to OKV but found that the wallet password was not working. Given that the database was 350TB, a full export/import to a new database was not a feasible option.

To resolve this issue, the Wallet Merge method was used. This method does not impact the original database and does not compromise security.

Solution: Wallet Merge Method

Step 1: Take a Backup of Existing Wallet Files

Before making any changes, take a full backup of the current TDE Wallet files:

cp -r /u01/app/oracle/admin/<DB_UNIQUE_NAME>/tde

/backup/wallet_backup_$(date +%d%m%Y)/

This ensures that you can restore the original wallet if anything goes wrong.

Step 2: Create a New Wallet

Connect to SQL*Plus and create a new TDE Wallet at a different location:

sqlplus / as sysdba
ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '<NEW_LOCATION>'

IDENTIFIED BY Welcome;

Step 3: Merge the Existing Wallet into the New Wallet

To merge the existing wallet files into the newly created wallet:

ADMINISTER KEY MANAGEMENT MERGE KEYSTORE '<ORIGINAL_LOCATION_FILES>'
INTO EXISTING KEYSTORE '<NEW_LOCATION>'
IDENTIFIED BY "<NEW_KEYSTORE_PASSWORD>" WITH BACKUP;

This operation securely merges the old wallet’s contents into the new keystore.

Step 4: Validate the New Wallet

Use the orapki utility to verify that the new wallet contains the required encryption keys:

orapki wallet display -wallet <NEW_LOCATION>

You will be prompted for a password. Enter the new wallet password, and it should display the existing master keys.

Step 5: Create Auto-Login Wallet

Once validated, configure Auto-Login for the new wallet to avoid future password dependency:

ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE

FROM KEYSTORE '<NEW_LOCATION>' IDENTIFIED BY Welcome;

Step 6: Replace the Old Wallet with the New Wallet

Copy the new wallet files to the original TDE Wallet location:

cp -r <NEW_LOCATION>/* /u01/app/oracle/admin/<DB_UNIQUE_NAME>/tde/

Also, ensure these files are copied to all nodes in a RAC environment and to any standby databases.

Step 7: Restart and Validate Wallet Access

To finalize the migration:

ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE;
ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "Welcome";

If everything is configured correctly, the wallet should now open without issues, allowing seamless TDE operations.

Please do like and subscribe to my youtube channel: https://www.youtube.com/@foalabs If you like this post please follow,share and comment

Recovering Forgotten Oracle Database TDE Wallet Password: Step-by-Step Guide