ORA-28311 Error After Refreshing an Encrypted VDB (KBA9615)

Issue

Attempts to access a newly encrypted tablespace in a VDB fails due to the following error:

ERROR at line 1:
ORA-28311: Oracle encrypted data block not encrypted (file # 34, block # 130)
ORA-01110: data file 34:
'/mnt/provision/VCDO_4JE-CDOMLOTG658C/datafile/u01/app/oracle/oradata/CDOMLOSR99
17/D96D585E3D2E9CDBE05304D96E0A87C5/datafile/o1_mf_unenc_ts_kodbnf0c_.dbf'

Applicable Delphix Versions

Click here to view the versions of the Delphix engine to which this article applies

Major Release	All Sub Releases
6.0	6.0.6.0, 6.0.6.1, 6.0.7.0, 6.0.8.0, 6.0.8.1, 6.0.9.0, 6.0.10.0, 6.0.10.1, 6.0.11.0, 6.0.12.0, 6.0.12.1, 6.0.13.0, 6.0.13.1, 6.0.14.0, 6.0.15.0, 6.0.16.0, 6.0.17.0, 6.0.17.2
7.0 and later	All

Resolution

This issue can occur due to an offline encryption operation being performed on the dSource database.

1. Tablespace taken offline.
2. Tablespace is encrypted.
3. Tablespace is brought online.
4. Delphix incremental snapshot performed.
5. VDB provisioned or refreshed from incremental snapshot.

The failure is due to the incremental snapshot provided by Oracle not including the newly encrypted blocks. After performing the offline encryption operation all datafiles in the tablespace must have a full backup performed.

The full backup can either be performed for

• The entire dSource - Force Full Backup.
• The specific datafiles on the newly encrypted tablespace - cli-support-for-partial-full-backup-in-oracle. 

After performing a full backup of the affected datafiles, the VDB must be refreshed from the new snapshot.

 

If the VDB needs to be used without a refresh, the tablespace in the VDB can be rekeyed, allowing access to the tablespace.

alter tablespace <tablespace> encryption online rekey;

 

---