Use the procedure below to set up a CSP Vault for Databases test environment. 

Prerequisites

Before you begin, make sure you have completed the following tasks:

• Install an independent CSP Vault cluster for the test environment. For more information, see the page for your deployment environment:
  • CSP Vault OVA Installation
  • CSP Vault ISO Installation for Hypervisor
  • CSP Vault ISO Installation for Bare Metal Server
  • CSP Vault in Amazon Web Services
  • CSP Vault in Google Cloud Platform
  • CSP Vault in Microsoft Azure
• Create a CSP Vault for Databases on the independent CSP Vault cluster. For more information about creating a vault, see: Creating a Vault.

To set up a CSP Vault test environment

1. Log in to the Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
2. (optional) Create a CSP cluster node mapping. For more information, see: Creating a Cluster Node Mapping for CSP Vault for Databases.
   

   A CSP cluster node mapping helps Entrust client on the database node to failover in case one of the CSP node fails.

3. Download the TDE script bundle. For more information, see: Downloading the TDE Script Bundle for Oracle.
   

   The prefix specified when downloading the TDE scripts is stored in entrust.conf as the DBSet name. The DBSet name does not represent an actual object. It serves as the base name for generating the associated CVMSet and KeySet names. For example, if the DBSet name is oracle, the scripts create the KeySet oracle_keyset and the CVMSet oracle_cvmset. You can change the DBSet name in entrust.conf after downloading the TDE scripts.

   The CVMSet and KeySet names must be the same in the production and test environments. When setting up the connection between the test database server and test CSP Vault for Databases, use the same DBSet name in entrust.conf as in the production environment.

4. Copy the TDE script bundle to the test Oracle server node.
   

   The bundle is a ZIP file named <name>.zip, where <name> is the name you specified when downloading the bundle in To set up a CSP Vault test environment. For example, oracle_toi.zip. 

   The steps below use oracle_toi as an example.

5. Open Git bash.
6. Run the following command to copy the TDE script bundle from the CSP Vault test environment:
   
   scp Downloads/oracle_toi\.zip oracle@<ip-address>:oracle_toi.zip
7. Open your test Oracle server node.
8. Navigate to the folder where the TDE scripts are stored.
9. Extract the TDE script bundle into the folder by running the following command:
   
   Unzip -Path "<path-to-your-file>" -DestinationPath "<destination-path>"
   For example:
   
   Unzip -Path .\oracle_toi.zip -DestinationPath C:\Users\Administrator\oracle

   The bundle contains the following files:

   • entrust.conf

   • setup.ps1

   • encryptclust.ps1

10. Verify the CSP Vault-related configuration settings in the entrust.conf file:
    
    grep kcv entrust.conf

    Note that the terminal displays the IP address of first Oracle server node because that is the first node in the CSP cluster.

11. Set up the test Oracle server node by running the following command as the Oracle user:

    sudo ./setup.sh first ./entrust.conf

    The test environment is independent of the production environment. Perform this step as a first-node setup to create the CVM Set and KeySet in the test environment.

12. At the prompt, enter the password for the vault administrator of the CSP Vault for Databases.
13. At the prompt, log in to the CSP Vault for Databases as the vault administrator. The setup script creates the KeySet and the CVMset in your CSP Vault for Databases.
14. At the prompt, verify that the Oracle server node can communicate with CSP Vault for Databases:
    /opt/hcs/bin/check_connection /opt/oracle/entrust/oracle_toi.conf
    
    You now have two independent CSP Vault for Databases and Oracle server environments: a production environment and a test environment.