Error
Error Code: ORA-28417

Oracle Error ORA-28417

📦 Oracle Database
📋

Description

The ORA-28417 error indicates that a password-based keystore, which is required for certain security operations, is not currently open. This error typically arises when attempting to perform operations that require access to the keystore, such as encryption or decryption, without first opening it.
💬

Error Message

ORA-28417: password-based keystore is not open
🔍

Known Causes

3 known causes
⚠️
Keystore Not Opened
The password-based keystore was simply not opened before attempting to use it for cryptographic operations.
⚠️
Auto-Login Keystore Conflict
An auto-login keystore is open, preventing the password-based keystore from being accessed. Oracle prioritizes auto-login keystores.
⚠️
Incorrect Keystore Configuration
The database configuration may be pointing to the wrong keystore location, or the keystore is corrupted.
🛠️

Solutions

3 solutions available

1. Open the Password-Based Keystore easy

Directly open the password-based keystore using SQL*Plus.

1
Connect to the Oracle database as a user with SYSDBA privileges.
sqlplus / as sysdba
2
Execute the ALTER SYSTEM command to open the keystore. You will be prompted for the keystore password.
ALTER SYSTEM SET ENCRYPTION KEYSTORE OPEN IDENTIFIED BY "your_keystore_password";
3
Verify that the keystore is open by querying V$ENCRYPTION_KEYS.
SELECT * FROM V$ENCRYPTION_KEYS;

2. Ensure Keystore is Opened During Database Startup medium

Configure the database to automatically open the keystore during startup.

1
Connect to the Oracle database as a user with SYSDBA privileges.
sqlplus / as sysdba
2
Set the `ENCRYPTION_WALLET` parameter in the database's SPFILE to point to the keystore location. Replace `/path/to/your/keystore` with the actual path.
ALTER SYSTEM SET ENCRYPTION_WALLET = '/path/to/your/keystore' SCOPE=SPFILE;
3
Restart the Oracle database instance for the change to take effect.
SHUTDOWN IMMEDIATE;
STARTUP;
4
After startup, verify the keystore is open.
SELECT * FROM V$ENCRYPTION_KEYS;

3. Check and Correct Keystore Password medium

Verify the provided keystore password is correct and change it if necessary.

1
Connect to the Oracle database as a user with SYSDBA privileges.
sqlplus / as sysdba
2
Attempt to open the keystore with a known password. If this fails, the password might be incorrect.
ALTER SYSTEM SET ENCRYPTION KEYSTORE OPEN IDENTIFIED BY "potential_correct_password";
3
If you suspect the password is wrong, you can change it using the `SET KEYSTORE PASSWORD` command. You will be prompted for the current password (if known) and the new password.
SET ENCRYPTION WALLET PASSWORD "new_strong_password";
4
After setting a new password, attempt to open the keystore again with the new password.
ALTER SYSTEM SET ENCRYPTION KEYSTORE OPEN IDENTIFIED BY "new_strong_password";