Upgrade encrypted databases to 26ai

TDE_HEALTHCHECK 

The TDE health-check was planned to give Oracle Support personnel a quick overview about your TDE setup, but eventually it was decided to include it in recent Oracle Database RUs in 19c and 26ai.

In Oracle database 19c before 19.30, you need to apply patch 38486044.

It is very easy to use: First, compile it with:

SQL> @$ORACLE_HOME/rdbms/admin/tde_healthcheck.sql

To get the complete results, simply execute:

SQL> execute tde_healthcheck.get_tde_healthcheck_report;

Individual checks allow for a more targeted validation:

SQL> exec tde_healthcheck.get_wallet_root;

Display WALLET_ROOT from gv$parameter. 

SQL> exec tde_healthcheck.get_wallet_location;

Where are my TDE wallets? Usually in WALLET_ROOT/tde 

SQL> exec tde_healthcheck.get_tde_config;

Shows the value of the parameter TDE_CONFIGURATION.

SQL> exec tde_healthcheck.get_props_details;

Read the TDE configuration from internal tables. 

SQL> exec tde_healthcheck.validate_tde_primary_keystore;

Compares the TDE settings in the spfile with internal tables. 

SQL> exec tde_healthcheck.get_tablespace_encryption_config;

Shows the value of the parameter TABLESPACE_ENCRYPTION.  

SQL> exec tde_healthcheck.get_encwallet_details;

Validates TDE wallet location type (FILE, ASM, OKV), united or isolated PDBs, and other details.

SQL> exec tde_healthcheck.get_enckeys_details;

Key-IDs (in base64), creation and activation times of TDE keys in CDB and PDBs.

SQL> exec tde_healthcheck.get_pdbs_enckeys;

Shows activated TDE keys (in hex) for CDB and all PDBs. 

SQL> exec tde_healthcheck.get_encrypted_tablespaces;

Shows list of encrypted tablespaces in CDB and all PDBs, with their encryption algorithm.

SQL> exec tde_healthcheck.get_missingkey_info_from_allinstance;

Shows required vs. available keys; if keys are missing, call Oracle Support.

SQL> exec tde_healthcheck.get_encrypted_datafiles;

Shows list of encrypted data files in CDB and all PDBs.

Link to LinkedIn post.