Wallet Consistency in Autonomous Database (ADB) DG

Ensuring Wallet Consistency in Autonomous Database (ADB) with Data Guard: A Cross-Region Implementation Guide

Introduction

When working with Oracle Autonomous Database (ADB) and Autonomous Data Guard (ADG), ensuring that wallets are synchronized between Primary and Standby databases is crucial.

🚨 Common Issues Due to Wallet Mismatch:

• Database connection failures due to mismatched SSL certificates.
• Application disruptions during a failover event.

This blog walks through a real-world scenario where we detected wallet mismatches between Primary and Standby ADB instances, and provides best practices for ensuring seamless failover and connectivity.

🚫 Why Can’t You Alter the Wallet in Autonomous Database?

Unlike traditional Oracle databases, in Autonomous Database, you cannot manually manage the wallet using SQL commands like:

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY 'password';
ALTER SYSTEM SET ENCRYPTION WALLET CLOSE;
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY 'password' WITH BACKUP;


✅ Oracle manages encryption keys and TDE automatically—you don’t need to open or close the wallet manually.
✅ Wallet rotation and key updates are fully automated—you cannot modify them.
✅ If a switchover happens, the wallet automatically updates on the new Primary—but you must download it again.

🔍 Step 1: Testing the Primary Wallet Connection

First, we test the connection using the wallet from Primary ADB.

source /Users/rmisri/Downloads/temp_wallet/Test_adw_wallet/prim/env_file
sqlplus admin@adb_high


Output:

SQL*Plus: Release 19.0.0.0.0 - Production
Connected to: Oracle Database 19c Enterprise Edition

✅ Primary wallet is working fine.

🔄 Step 2: Performing a Switchover in Autonomous Data Guard

Use the OCI Console or CLI:

✅ How to Switchover via OCI Console:

1. Go to OCI Console → Autonomous Database.
2. Click on your Primary ADB instance.
3. Under Autonomous Data Guard, select Switchover.
4. Confirm the action and wait for Oracle to handle the process.

✅ How to Switchover via OCI CLI:

oci db autonomous-database switchover --autonomous-database-id <DB_OCID>


✅ How to Trigger Failover via OCI CLI:

oci db autonomous-database failover --autonomous-database-id <DB_OCID>


🛠 Step 3: Testing the Wallet on Standby

After switchover, we check connectivity using the Standby wallet.

sqlplus admin@adb_high


Output:

SQL*Plus: Release 19.0.0.0.0 - Production
Connected to: Oracle Database 19c Enterprise Edition

✅ Standby wallet is also working.

🔍 Step 4: Comparing Wallet Files

To ensure that both wallets are identical, we run checksum (md5sum) and certificate (openssl x509) comparisons.

🔸 Comparing Auto-Login Wallet (cwallet.sso)

md5sum cwallet.sso


Output:

Primary: bfde2a75dfdaf8ce8a0126f78eb834a3
Standby: 3f03b4c12b349b6f36fa0410da872c5a

🚨 Mismatch detected! The auto-login wallets are different.

🔸 Comparing SSL Certificates

openssl x509 -in ewallet.pem -noout -fingerprint


Output:

Primary: SHA1 Fingerprint=74:82:7A:37:83:7F:1B:0E:53:5E:08:E3:08:4F:E4:61:DA:97:CA:C7
Standby: SHA1 Fingerprint=BC:A0:1F:30:63:23:75:2F:02:B3:89:67:D8:89:CD:E2:27:85:DD:19

🚨 Mismatch detected! The certificates do not match.

🛠 Step 5: Fixing the Wallet Mismatch

To resolve the issue, we synchronize the Standby wallet with the Primary wallet.

✅ Fixing the Issue – Steps

1. Download the Primary Wallet from OCI Console:

• Navigate to Autonomous Database (Primary).
• Click Database Connection → Download Wallet.

1. Replace the Standby Wallet:
   unzip Wallet_Primary.zip -d /tmp/primary_wallet/ scp /tmp/primary_wallet/* standby_server:/tmp/standby_wallet/
2. Restart Standby Database:

• Since ALTER SYSTEM SET ENCRYPTION WALLET is not allowed in ADB, simply reconnect using the new wallet.

1. Verify That the Wallets Match:
   md5sum cwallet.sso & openssl x509 -in ewallet.pem -noout -fingerprint
   ✅ Ensure Wallets now match!

🌎 Step 6: Preparing for Cross-Region Failover

Oracle’s Recommendation for Cross-Region Wallets

According to Oracle’s documentation, wallet handling in Autonomous Data Guard works as follows:

• Primary and Standby wallets contain different database hostnames and connection strings.
• Oracle recommends using the wallet from the same region as the primary database.
• If you need a single wallet that works across both regions, update tnsnames.ora manually.

✅ How to Manually Construct a Cross-Region Wallet

1. Download wallets from both Primary and Standby OCI Consoles.
2. Extract both tnsnames.ora files.
3. Copy the Standby database connection descriptor into the Primary tnsnames.ora.
4. Repackage the updated wallet.

zip -r Updated_Wallet.zip /tmp/primary_wallet/

With this approach, failover becomes seamless, as the wallet supports both the Primary and Standby hostnames.

🚀 Final Thoughts & Best Practices

✔ Always download the latest wallet after a switchover or failover.
✔ Verify wallet consistency before performing failover.
✔ Modify tnsnames.ora manually for cross-region support.
✔ Automate wallet verification to prevent disruptions.

Would you like a script to automate wallet verification and downloads after failover?🚀Let me know in the comments!

Author: Rohit Mishri