If the master key has to be rotated while there is an active Data Guard managed standby, you must stop the redo log apply on the standby node to temporarily prevent synchronization with the Primary database.

1. Stop the redo log apply on the standby node.

   Copy

   ./encrypt.sh standby stop_redo_log_apply

2. Rotate the key on the Primary node.

   Copy

   ./encrypt.sh rotate_key

3. After the key has been successfully rotated, restart the redo log apply on the standby.

   Copy

   ./encrypt.sh standby restart_redo_log_apply

4. Check the status of the Managed Recovery Process (MRP) to ensure that the new key has been synchronized. If the MRP has not started, then wait for a few seconds then restart it again.

   Copy

   ./encrypt.sh standby restart_redo_log_apply

5. Check the status.

   Copy

   ./encrypt.sh status