Encrypt tablespaces with TDE (new and existing, online/offline)

Command

-- Prerequisite: keystore OPEN and master key set (v$encryption_wallet.status = 'OPEN')

-- 1) New encrypted tablespace:
CREATE TABLESPACE customer_enc
  DATAFILE '+DATA' SIZE 1G AUTOEXTEND ON NEXT 256M MAXSIZE 20G
  ENCRYPTION USING 'AES256' ENCRYPT;

-- 2a) Encrypt an existing tablespace ONLINE (12.2+, needs extra space temporarily):
ALTER TABLESPACE customer_data ENCRYPTION ONLINE USING 'AES256' ENCRYPT;
-- If not OMF: ... ENCRYPT FILE_NAME_CONVERT = ('customer_data01.dbf', 'customer_data01_enc.dbf');

-- 2b) OFFLINE conversion (no extra space, tablespace unavailable meanwhile):
ALTER TABLESPACE customer_data OFFLINE NORMAL;
ALTER TABLESPACE customer_data ENCRYPTION OFFLINE ENCRYPT;
ALTER TABLESPACE customer_data ONLINE;

-- 3) Progress and status:
SELECT t.name AS tablespace_name, e.encryptionalg, e.status, e.con_id
FROM   v$encrypted_tablespaces e
  JOIN v$tablespace t ON t.ts# = e.ts# AND t.con_id = e.con_id;
SELECT tablespace_name, encrypted FROM dba_tablespaces ORDER BY tablespace_name;

What it does

Tablespace encryption encrypts every block written to the datafiles; data is clear in the buffer cache, so no application or SQL changes are needed. Online conversion builds an encrypted copy of the datafile and switches to it while DML continues; offline conversion encrypts blocks in place.

When to use it

To encrypt application tablespaces holding sensitive data at rest, to move data into a new encrypted tablespace, or to close an audit finding.

Caution

On-premises requires the Advanced Security option (extra cost). Online conversion needs extra space equal to the datafiles being encrypted and generates heavy I/O and redo; a Data Guard standby performs the same work. Offline conversion must be run separately on a Data Guard standby. SYSTEM/SYSAUX/UNDO can be encrypted online in 12.2+ but need extra care. Backups of encrypted tablespaces cannot be restored without the keystore.