Unplug PDB command fails ORA-46680 Master Keys Of The Container Database Must Be Exported

Unplug PDB command fails ORA-46680 Master Keys Of The Container Database Must Be Exported

Facing the issue while unplugging PDB after the clone.

SQL> alter pluggable database PDB1 unplug into '/u01/app/oracle/19.0.0/dbs/PDB1.xml'

*

ERROR at line 1:

ORA-46680: master keys of the container database must be exported

SQL> alter pluggable database pdb1 close;

Pluggable database altered.

SQL> conn / as sysdba

Connected.

SQL> alter pluggable database pdb1 unplug into '/u01/app/oracle/19.0.0/dbs/PDB1.xml';

alter pluggable database pdb1 unplug into '/u01/app/oracle/19.0.0/dbs/PDB1.xml'

*

ERROR at line 1:

ORA-46680: master keys of the container database must be exported 

This PDB have TDE configured and so the TDE mkeyid have to be exported into .exp file before the PDB unplug. So later during this PDB plug, the mkeyid can be imported from this .exp file into the new container wallet file.

Solution:

Export the TDE encryption keys of this PDB, before PDB unplug using ADMINISTER KEY MANAGEMENT EXPORT ENCRYPTION KEYS command.

SQL> alter session set container=PDB1;

Session altered.

SQL> select * from v$encryption_wallet; -- make sure the wallet is in open status.

 

SQL> ADMINISTER KEY MANAGEMENT EXPORT ENCRYPTION KEYS WITH SECRET "my_secret" TO '/u01/app/oracle/19.0.0/dbs/exportpdb1.exp' IDENTIFIED BY "<wallet password>";

keystore altered.

SQL> conn / as sysdba

Connected.

SQL> alter pluggable database pdb1 close;

Pluggable database altered.

SQL> alter pluggable database pdb1 unplug into '/u01/app/oracle/19.0.0/dbs/PDB1.xml';

Pluggable database altered.

Please do like and subscribe to my youtube channel: https://www.youtube.com/@foalabs If you like this post please follow,share and comment