Oracle 19c: Resolving ORA-28374 “Typed Master Key Not Found in Wallet” After Creating a New PDB

Introduction

While working with Oracle Database 19c in a multitenant environment with Transparent Data Encryption (TDE) enabled, I ran into an issue while adding a datafile to a newly created Pluggable Database (PDB).

The operation failed with:

ORA-28374: typed master key not found in wallet

This post walks through the root cause, the diagnostic steps I took, and how I resolved it — so other DBAs can fix this quickly if they hit the same error during PDB provisioning.

Environment

  • Oracle Database 19c (19.28)
  • Oracle Standard Edition 2
  • ASM Storage (+DATA)
  • TDE Enabled
  • Auto-login Wallet

Problem Statement

After creating a new PDB and opening it in READ WRITE mode, any attempt to add a datafile or tempfile failed with ORA-28374.

Create PDB

CREATE PLUGGABLE DATABASE UAT
ADMIN USER Admin IDENTIFIED BY DEV2012Sugu#Q;

ALTER PLUGGABLE DATABASE UAT OPEN READ WRITE;

ALTER SESSION SET CONTAINER = UAT;

Error

ORA-28374: typed master key not found in wallet

Diagnosis

First, check the wallet status:

SELECT * FROM v$encryption_wallet;

Output:

STATUS       : OPEN_NO_MASTER_KEY
WALLET_TYPE  : AUTOLOGIN

The wallet was open, but no master encryption key existed for the newly created PDB.

Root Cause

In a multitenant environment, creating a new PDB does not automatically create or activate a TDE master encryption key for that PDB. As a result:

  • The wallet remains open
  • The PDB has no active encryption key of its own
  • Any encrypted operation fails
  • Oracle raises ORA-28374

In short: an open wallet at the container level does not guarantee that every PDB inside it has its own active master key.

Solution

Step 1: Create a PDB Encryption Key

ADMINISTER KEY MANAGEMENT
CREATE ENCRYPTION KEY
USING TAG ‘UAT_rekey’
FORCE KEYSTORE
IDENTIFIED BY “UAT2012Sugu#Q”
WITH BACKUP USING ‘UAT_rekey’;

Step 2: Verify Key Creation

SELECT key_id, tag
FROM v$encryption_keys
WHERE tag = ‘UAT_rekey’;

Step 3: Activate the Key

ADMINISTER KEY MANAGEMENT
USE ENCRYPTION KEY ‘<KEY_ID>’
FORCE KEYSTORE
IDENTIFIED BY “UAT2012Sugu#Q”
WITH BACKUP;

Step 4: Retry the Operation

CREATE TABLESPACE UAT
DATAFILE ‘+DATA’
SIZE 1G
AUTOEXTEND ON NEXT 128M MAXSIZE 30G;

The tablespace creation completed successfully.

Verification

Confirm the available encryption keys:

SELECT key_id, tag, activation_time
FROM v$encryption_keys;

Check the wallet status again to confirm it now shows an active master key:

SELECT * FROM v$encryption_wallet;

Key Takeaways

  • ORA-28374 occurs when a PDB does not have an active TDE master key.
  • An open wallet does not guarantee that a master key exists for every PDB in the container.
  • After creating a new PDB, always validate the encryption configuration before creating encrypted objects.
  • Creating and activating a PDB-specific encryption key resolves the issue.

DBA Checklist — After Creating a New PDB

  1. Open the PDB in READ WRITE mode.
  2. Check V$ENCRYPTION_WALLET.
  3. Verify encryption keys in V$ENCRYPTION_KEYS.
  4. Create a master encryption key if one doesn’t exist.
  5. Activate the key.
  6. Proceed with tablespace, tempfile, or datafile creation.

Conclusion

ORA-28374 is a common issue in Oracle multitenant environments using TDE. It occurs because a newly created PDB doesn’t automatically inherit an active master encryption key — even though the wallet itself is open. By creating and activating a PDB-specific encryption key, DBAs can complete encrypted operations without running into wallet-related failures.

I hope this helps fellow DBAs quickly diagnose and resolve ORA-28374 during new PDB provisioning in Oracle 19c

Recent Posts