Configuring Transport Layer Security Authentication (original) (raw)

You can configure Oracle Database to use Transport Layer Security authentication.

23.1 Transport Layer Security and Secure Sockets Layer

Netscape Communications Corporation designed Transport Layer Security (TLS), previously called Secure Sockets Layer (SSL), to secure network connections.

23.1.1 The Difference Between Transport Layer Security and Secure Sockets Layer

Transport Layer Security (TLS) is an incremental version of Secure Sockets Layer (SSL) version 3.0.

Although SSL was primarily developed by Netscape Communications Corporation, the Internet Engineering Task Force (IETF) took over development of it, and renamed it Transport Layer Security (TLS). TLS is an IETF standard.

Oracle Database Security Guide uses the terms Transport Layer Security and TLS instead of Secure Sockets Layer and SSL since the Oracle Database has implemented TLS. However, other documentation in the Oracle Database library may still use the earlier terms Secure Socket Layer and SSL. Where distinctions occur between how you use or configure these protocols, Oracle Database Security Guide specifies what is appropriate for either SSL or TLS.

The Oracle Database software still uses some of the older terminology. For example, the netmgr tool still uses the terms Secure Socket Layer and SSL. Many SSL parameters, such as SSL_SERVER_CERT_DN, use the older terminology. The names of cipher suites and the wording in error messages also use the SSL terminology. However, all these features work with and apply to Transport Layer Security.

23.1.2 Using Transport Layer Security in a Multitenant Environment

Transport Layer Security (TLS) can be used in a multitenant environment for application containers.

If you want to use Transport Layer Security (TLS) in a multitenant environment for an application container, then you must ensure that each PDB is able to use its own wallet with its own certificates for TLS authentication.

  1. Connect to the PDB that uses the wallet.
  2. Place the wallet in a subdirectory of the wallet directory where the name of the subdirectory is the GUID of the PDB that uses the wallet.
    You must do this because there is no individual sqlnet.ora file for each PDB. For example, suppose the WALLET_LOCATION parameter in sqlnet.ora is set as follows:
(SOURCE=(METHOD=FILE)(METHOD_DATA=  
   (DIRECTORY=/home/oracle/wallet)))

Place each PDB’s wallet in the /home/oracle/wallet/PDB_GUID directory. You can find the existing PDBs and their GUIDs by querying the DBA_PDBS data dictionary view.
If the WALLET_LOCATION parameter is not specified, then you must place the PDB wallet in a leaf subdirectory of the default wallet path where the name of the subdirectory is the GUID of the PDB, and the name of the leaf subdirectory is TLS. For example: 

$ORACLE_BASE/admin/db_unique_name/PDB_GUID/TLS

Or if the ORACLE_BASE environment variable is not set, then you can use the Oracle home: 

$ORACLE_HOME/admin/db_unique_name/PDB_GUID/TLS

These default locations correspond to the default that is used by Oracle Enterprise User Security to locate wallets for authentication to LDAP.
To enable the PDB to use separate certificates, create a subdirectory under the $WALLET_LOCATION/PDB_GUID/TLS directory, and then copy the wallets to this subdirectory. 3. Close and then reopen PDB. 

ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;  
ALTER PLUGGABLE DATABASE pdb_name OPEN;

23.2 How Oracle Database Uses Transport Layer Security for Authentication

Transport Layer Security works with the core Oracle Database features such as encryption and data access controls.

By using Oracle Database TLS functionality to secure communications between clients and servers, you can

You can use TLS features by themselves or in combination with other authentication methods supported by Oracle Database. For example, you can use the encryption provided by TLS in combination with the authentication provided by Kerberos. TLS supports any of the following authentication modes:

23.3 How Transport Layer Security Works in an Oracle Environment: The TLS Handshake

When a network connection over Transport Layer Security is initiated, the client and server perform a TLS handshake before performing the authentication.

The handshake process is as follows:

  1. The client and server establish which cipher suites to use. This includes which encryption algorithms are used for data transfers.
  2. The server sends its certificate to the client, and the client verifies that the server's certificate was signed by a trusted CA. This step verifies the identity of the server.
  3. Similarly, if client authentication is required, the client sends its own certificate to the server, and the server verifies that the client's certificate was signed by a trusted CA.
  4. The client and server exchange key information using public key cryptography. Based on this information, each generates a session key. A key is shared by at least two parties (usually a client and a server) that is used for data encryption for the duration of a single communication session. Session keys are typically used to encrypt network traffic; a client and a server can negotiate a session key at the beginning of a session, and that key is used to encrypt all network traffic between the parties for that session. If the client and server communicate again in a new session, they negotiate a new session key. All subsequent communications between the client and the server is encrypted and decrypted by using this session key and the negotiated cipher suite.

The authentication process is as follows:

  1. On a client, the user initiates an Oracle Net connection to the server by using TLS.
  2. TLS performs the handshake between the client and the server.
  3. If the handshake is successful, then the server verifies that the user has the appropriate authorization to access the database.

23.4 Public Key Infrastructure in an Oracle Environment

A public key infrastructure (PKI) is a substrate of network components that provide a security underpinning, based on trust assertions, for an entire organization.

23.4.1 About Public Key Cryptography

Traditional private-key or symmetric-key cryptography requires a single, secret key shared by two or more parties to establish a secure communication.

This key is used to both encrypt and decrypt secure messages sent between the parties, requiring prior, secure distribution of the key to each party. The problem with this method is that it is difficult to securely transmit and store the key.

Public-key cryptography provides a solution to this problem, by employing public and private key pairs and a secure method for key distribution. The freely available public key is used to encrypt messages that can only be decrypted by the holder of the associated private key. The private key is securely stored, together with other security credentials, in an encrypted container called a wallet.

Public-key algorithms can guarantee the secrecy of a message, but they do not necessarily guarantee secure communications because they do not verify the identities of the communicating parties. To establish secure communications, it is important to verify that the public key used to encrypt a message does in fact belong to the target recipient. Otherwise, a third party can potentially eavesdrop on the communication and intercept public key requests, substituting its own public key for a legitimate key (the third-party attack).

In order to avoid such an attack, it is necessary to verify the owner of the public key, a process called authentication. Authentication can be accomplished through a certificate authority (CA), which is a third party that is trusted by both of the communicating parties.

The CA issues public key certificates that contain an entity's name, public key, and certain other security credentials. Such credentials typically include the CA name, the CA signature, and the certificate effective dates (From Date, To Date).

The CA uses its private key to encrypt a message, while the public key is used to decrypt it, thus verifying that the message was encrypted by the CA. The CA public key is well known and does not have to be authenticated each time it is accessed. Such CA public keys are stored in wallets.

23.4.2 Public Key Infrastructure Components in an Oracle Environment

Public key infrastructure (PKI) components in an Oracle environment include a certificate authority, certificates, certificate revocation lists, and wallets.

23.4.2.1 Certificate Authority

A certificate authority (CA) is a trusted third party that certifies the identity of entities, such as users, databases, administrators, clients, and servers.

When an entity requests certification, the CA verifies its identity and grants a certificate, which is signed with the CA's private key.

Different CAs may have different identification requirements when issuing certificates. Some CAs may verify a requester's identity with a driver's license, some may verify identity with the requester's fingerprints, while others may require that requesters have their certificate request form notarized.

The CA publishes its own certificate, which includes its public key. Each network entity has a list of trusted CA certificates. Before communicating, network entities exchange certificates and check that each other's certificate is signed by one of the CAs on their respective trusted CA certificate lists.

Network entities can obtain their certificates from the same or different CAs.

23.4.2.2 Certificates

A certificate is created when an entity's public key is signed by a trusted certificate authority (CA).

A certificate ensures that an entity's identification information is correct and that the public key actually belongs to that entity.

A certificate contains the entity's name, public key, and an expiration date, as well as a serial number and certificate chain information. (A certificate chain is an ordered list of certificates containing an end-user or subscriber certificate and its certificate authority certificate.) It can also contain information about the privileges associated with the certificate.

When a network entity receives a certificate, it verifies that it is a trusted certificate, that is, one that has been issued and signed by a trusted certificate authority. A certificate remains valid until it expires or until it is revoked.

23.4.2.3 Certificate Revocation Lists

When a CA signs a certificate binding a public key pair to a user identity, the certificate is valid for a specified time.

However, certain events, such as user name changes or compromised private keys, can render a certificate invalid before the validity period expires. When this happens, the CA revokes the certificate and adds its serial number to a Certificate Revocation List (CRL). The CA periodically publishes CRLs to alert the user population when it is no longer acceptable to use a particular public key to verify its associated user identity.

When servers or clients receive user certificates in an Oracle environment, they can validate the certificate by checking its expiration date, signature, and revocation status. Certificate revocation status is checked by validating it against published CRLs. If certificate revocation status checking is turned on, then the server searches for the appropriate CRL depending on how this feature has been configured. The server searches for CRLs in the following locations in this order:

  1. Local file system
  2. Oracle Internet Directory
  3. CRL Distribution Point (CRL DP), a location specified in the CRL Distribution Point (CRL DP) X.509, version 3, certificate extension when the certificate is issued. A CRL DP is an optional extension specified by the X.509 version 3 certificate standard, which indicates the location of the Partitioned CRL where revocation information for a certificate is stored. Typically, the value in this extension is in the form of a URL. CRL DPs allow revocation information within a single certificate authority domain to be posted in multiple CRLs. CRL DPs subdivide revocation information into more manageable pieces to avoid proliferating voluminous CRLs, thereby providing performance benefits. For example, a CRL DP is specified in the certificate and can point to a file on a Web server from which that certificate's revocation information can be downloaded.

Note:

To use CRLs with other Oracle products, refer to the specific product documentation. This implementation of certificate validation with CRLs is only available in the Oracle Database 12c release 1 (12.1) and later SSL adapter.

23.4.2.4 Wallets

A wallet is a container that stores authentication and signing credentials, including private keys, certificates, and trusted certificates TLS needs.

In an Oracle environment, every entity that communicates over TLS must have a wallet containing an X.509 version 3 certificate, private key, and list of trusted certificates, with the exception of Diffie-Hellman.

Security administrators use Oracle Wallet Manager to manage security credentials on the server. Wallet owners use it to manage security credentials on clients. Specifically, you use Oracle Wallet Manager to do the following:

23.4.2.5 Hardware Security Modules

The hardware security modules for SSL include devices to handle various functions and hardware devices to store cryptographic information.

Oracle Database uses these devices for the following functions:

Cryptographic information can be stored on two types of hardware devices:

An Oracle environment supports hardware devices using APIs that conform to the RSA Security, Inc., Public-Key Cryptography Standards (PKCS) #11 specification.

Note:

Currently, SafeNET, nCipher, and Utimaco devices are certified with Oracle Database

23.5 Transport Layer Security Combined with Other Authentication Methods

You can configure Oracle Database to use TLS concurrently with database user names and passwords, RADIUS, and Kerberos.

23.5.1 Architecture: Oracle Database and Transport Layer Security

It is important to understand the architecture of how Oracle Database works with TLS.

Figure 20-4 , which displays the Oracle Database implementation of Transport Layer Security architecture, shows that Oracle Databases operates at the session layer on top of TLS and uses TCP/IP at the transport layer. The session layer is a network layer that provides the services needed by the presentation layer entities that enable them to organize and synchronize their dialogue and manage their data exchange. This layer establishes, manages, and terminates network sessions between the client and server. The transport layer is a networking layer that maintains end-to-end reliability through data flow control and error recovery methods. Oracle Net Services uses Oracle protocol supports for the transport layer.

This separation of functionality lets you employ TLS concurrently with other supported protocols.

23.5.2 How Transport Layer Security Works with Other Authentication Methods

Transport Layer Security can be used with other authentication methods that Oracle Database supports.

Figure 23-1 illustrates a configuration in which Transport Layer Security is used in combination with another authentication method.

In this example, Transport Layer Security is used to establish the initial handshake (server authentication), and an alternative authentication method is used to authenticate the client. The process is as follows:

  1. The client seeks to connect to the Oracle database server.
  2. Transport Layer Security performs a handshake during which the server authenticates itself to the client and both the client and server establish which cipher suite to use.
  3. Once the Transport Layer Security handshake is successfully completed, the user seeks access to the database.
  4. The Oracle database server authenticates the user with the authentication server using a non-TLS authentication method such as Kerberos or RADIUS.
  5. Upon validation by the authentication server, the Oracle database server grants access and authorization to the user, and then the user can access the database securely by using TLS.

23.6 Transport Layer Security and Firewalls

Oracle Database supports two application proxy-based and stateful packet inspection of firewalls.

These firewalls are as follows:

When you enable TLS, stateful inspection firewalls behave like application proxy firewalls because they do not decrypt encrypted packets.

Firewalls do not inspect encrypted traffic. When a firewall encounters data addressed to a TLS port on an intranet server, it checks the target IP address against its access rules and lets the TLS packet pass through to permitted TLS ports, rejecting all others.

23.7 Transport Layer Security Usage Issues

You should be aware of TLS usage issues, such as communication with other Oracle products and types of supported authentication and encryption methods.

Consider the following issues when using TLS:

Note:

If you configure TLS encryption, you must disable non-TLS encryption.

23.8 Transport Layer Security Connection without a Client Wallet

A Transport Layer Security (TLS) connection that uses a common root certificate for the database server does not require a client wallet.

23.8.1 About Transport Layer Security Connections without a Client Wallet

You can configure a Transport Layer Security (TLS) connection without a client wallet if your environment meets certain requirements.

Consider using a TLS connection without a client wallet if your environment meets these requirements:

This is the most common type of configuration as long as the root certificate for the database server already exists in the local system certificate store. This configuration can be used for both cloud and on-premises databases. This configuration enables the client to verify server certificates without having to configure its own wallet.

Note the following:

23.8.2 Configuring a Transport Layer Security Connection without a Client Wallet

Before you can configure Transport Layer Security (TLS) without using client wallets, you must ensure that the database does not require client authentication.

For the C and Instant Client database drivers (and therefore, SQL*Plus), the walletless feature is only available on Microsoft Windows and Linux x64. For the JDBC-thin driver, the walletless feature is available on all platforms.

  1. Log in to the server where the Oracle database resides.
  2. Check the sqlnet.ora file for the following settings:
    • AUTHENTICATION_SERVICES=(tcps), which will require TLS for database connections.
    • SSL_CLIENT_AUTHENTICATION=FALSE, whose default is TRUE, which will require mTLS (mutual TLS requiring a client certificate in a client wallet). Setting this parameter to FALSE enables both TLS and mTLS connections from the client. If it is set to TRUE, then it is always mTLS.
      By default, the sqlnet.ora file is located in the $ORACLE_HOME/dbs directory or in the location set by the TNS_ADMIN environment variable.
  3. Ensure that the server wallet exists in the default location, defined by the WALLET_ROOT system parameter, or in the WALLET_LOCATION sqlnet.ora parameter.
  4. Check the listener.ora file to ensure TLS is specified.
LISTENER = (ADDRESS=(PROTOCOL=tcps)(HOST=)(PORT=1234))
  1. Ensure that the listener wallet also exists the default location, set by the WALLET_ROOT system parameter, or in the WALLET_LOCATION sqlnet.ora parameter.
    If you are creating a new client connection, then edit the listener.ora file to have the following setting:
ADDRESS=(PROTOCOL=tcps)

By default, listener.ora is located in the $ORACLE_HOME/network/admin directory. 6. Log in to the client for the Oracle database. 7. Modify the client sqlnet.ora and tnsnames.ora files.
* Edit the SQLNET.SSL_CLIENT_AUTHENTICATION setting in the sqlnet.ora file.
Set the SQLNET.SSL_CLIENT_AUTHENTICATION=FALSE, because the default is TRUE. FALSE enables the client to create the connection using either TLS or mTLS. A setting of FALSE, will not send information about the client side private certificate. Because this applies to every connection, you can change the SSL_CLIENT_AUTHENTICATION parameter in the tnsnames.ora connection string using the same parameter setting. If SSL_CLIENT_AUTHENTICATION=TRUE, then it can only configure mTLS. This setting is optional.
* If you connect to multiple databases and some require mTLS with a client wallet, then you can have two options for setting different connections with and without a client wallet, as follows:
* Option 1: Set WALLET_LOCATION in sqlnet.ora for a common wallet. Then use WALLET_LOCATION in your connect string (in tnsnames.ora or directly on the command line) to override the setting in sqlnet.ora. You can specify a different wallet location for a connection or tell the connection to use the system default keystore instead. Use the following parameter to change wallet location to the system default keystore:
net_service_name = (DESCRIPTION=(ADDRESS = (PROTOCOL=tcps) (HOST=host_name)(PORT=port)) (SECURITY=(WALLET_LOCATION=SYSTEM)) (CONNECT_DATA=(SERVICE_NAME=service_name)))
The default certificate store is located in /etc/pki/tls/cert.pem for Linux or in the Microsoft Certificate Store for Microsoft Windows. You cannot change the default location of the certificate store. By default, tnsnames.ora is located in the $ORACLE_HOME/network/admin directory.
* Option 2: Only specify WALLET_LOCATION as part of the connections that need to use a client wallet. Do not specify WALLET_LOCATION in sqlnet.ora. Connections that do not need to use a client wallet will automatically use the local default system keystore if WALLET_LOCATION is not specified in the sqlnet.ora file. For example:
net_service_name = (DESCRIPTION=(ADDRESS = (PROTOCOL=tcps) (HOST=host_name)(PORT=port)) (SECURITY=(WALLET_LOCATION=wallet_file_directory)) (CONNECT_DATA=(SERVICE_NAME=service_name))) 8. In SQL*Plus, to determine if the database connections are using TLS, check the connections by performing the following query.
SELECT SYS_CONTEXT ('USERENV', 'NETWORK_PROTOCOL') FROM DUAL;
Output similar to the following should appear:
```
SYS_CONTEXT('USERENV','NETWORK_PROTOCOL')

tcps 


### 23.9 Transport Layer Security Connection with a Client Wallet

You must configure Transport Layer Security on the server, and then the client.

* [Step 1: Configure Transport Layer Security on the Server](configuring-secure-sockets-layer-authentication.html#GUID-3C8BEC40-FAF2-4443-9C5B-AC67951092E1)  
During installation, Oracle sets defaults on the Oracle database server and the Oracle client for TLS parameters, except the Oracle wallet location.
* [Step 2: Configure Transport Layer Security on the Client](configuring-secure-sockets-layer-authentication.html#GUID-3071C8B9-F3FD-4053-8EB2-713EEDF774E3)  
When you configure SSL on the client, you configure the server DNs and use TCP/IP with TLS on the client.
* [Step 3: Log in to the Database Instance](configuring-secure-sockets-layer-authentication.html#GUID-831ECB95-B091-41C9-89AF-BDED3EB9310F)  
After you have completed the configuration, you are ready to log in to the database.

#### 23.9.1 Step 1: Configure Transport Layer Security on the Server

During installation, Oracle sets defaults on the Oracle database server and the Oracle client for TLS parameters, except the Oracle wallet location. 

* [Step 1A: Confirm Wallet Creation on the Server](configuring-secure-sockets-layer-authentication.html#GUID-4B22625B-45D9-4862-BA4E-10AB7961D8F2)  
Before proceeding to the next step, confirm that a wallet has been created and that it has a certificate.
* [Step 1B: Specify the Database Wallet Location on the Server](configuring-secure-sockets-layer-authentication.html#GUID-D5492EE8-2211-4E04-A360-EB7DE0D2B210)  
Next, you are ready to specify a location on the server for the wallet.
* [Step 1C: Set the Transport Layer Security Cipher Suites on the Server (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-D496F6A9-BD28-4B4D-BD77-991F49F036A7)  
Optionally, you can set the Transport Layer Security cipher suites.
* [Step 1D: Set the Required Transport Layer Security Version on the Server (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-67543956-00E0-40CD-BA89-EF51A4BB8C21)  
The `SSL_VERSION` parameter defines the version of TLS that must run on the systems with which the server communicates.
* [Step 1E: Set Transport Layer Security Client Authentication on the Server (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-FDF1798F-D602-412A-857C-0A983522E407)  
The `SSL_CLIENT_AUTHENTICATION` parameter controls whether the client is authenticated using TLS.
* [Step 1F: Set Transport Layer Security as an Authentication Service on the Server (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-1A32E05A-EE76-418E-872F-7BA9F624AAA0)  
The `SQLNET.AUTHENTICATION_SERVICES` parameter in the `sqlnet.ora` file sets the TLS authentication service.
* [Step 1G: Disable SSLv3 on the Server and Client (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-6AC06C21-CE34-410A-8B68-3346350F33CB)  
SSLv3 refers to Secure Sockets Layer version 3\.
* [Step 1H: Create a Listening Endpoint that Uses TCP/IP with Transport Layer Security on the Server](configuring-secure-sockets-layer-authentication.html#GUID-AED62BBE-AF87-474B-86C4-E99902C885C6)  
You can configure a listening endpoint to use TCP/IP with TLS on the server.
* [Step 1H: Restart the Database](configuring-secure-sockets-layer-authentication.html#GUID-84BDABFB-3555-4ED8-9FAB-8A68E2D422AE)  
To complete the configuration of Transport Layer Security on the server, you must restart the database.

##### 23.9.1.1 Step 1A: Confirm Wallet Creation on the Server

Before proceeding to the next step, confirm that a wallet has been created and that it has a certificate.

1. Start Oracle Wallet Manager.  
   * (UNIX) From `$ORACLE_HOME` `/bin`, enter the following command:  
   owm  
   * (Windows) Select Start, Programs, Oracle-HOME\_NAME, Integrated Management Tools, Wallet Manager  
Oracle Wallet Manager is deprecated with Oracle Database 21c. Instead of using Oracle Wallet Manager, Oracle recommends that you use the command line tools `orapki` and `mkstore`.
2. From the Wallet menu, select Open.  
The wallet should contain a certificate with a status of `Ready` and auto-login turned on. If auto-login is not on, then select it from the Wallet menu and save the wallet again. This turns auto-login on.

##### 23.9.1.2 Step 1B: Specify the Database Wallet Location on the Server

Next, you are ready to specify a location on the server for the wallet.

1. Start Oracle Net Manager.  
   * (UNIX) From `$ORACLE_HOME` `/bin`, enter the following command at the command line:  
   netmgr  
   * (Windows) Select Start, Programs, Oracle - HOME\_NAME, Configuration and Migration Tools, then Net Manager.
2. Expand Oracle Net Configuration, and from Local, select Profile.
3. From the Naming list, select Network Security.  
The Network Security tabbed window appears.
4. Select the SSL tab (which works for TLS) and then select Configure SSL for: Server.
5. In the Wallet Directory box, enter the directory in which the Oracle wallet is located or click Browse to find it by searching the file system.  
Note that if you are configuring the database-to-directory TLS connection for Enterprise User Security, then Database Configuration Assistant automatically creates a database wallet while registering the database with the directory. You must use that wallet to store the database PKI credentials for TLS-authenticated Enterprise User Security.  
Important:  
   * Use Oracle Wallet Manager to create the wallet. See [Oracle Database Enterprise User Security Administrator's Guide](/pls/topic/lookup?ctx=en/database/oracle/oracle-database/19/dbseg&id=DBIMI9731) for information about creating a new Oracle wallet.  
   * Use Oracle Net Manager to set the wallet location in the `sqlnet.ora` file. Be aware that in a multitenant environment, the settings in the `sqlnet.ora` file apply to all pluggable databases (PDBs).  
Ensure that you enter the same wallet location when you create it and when you set the location in the `sqlnet.ora` file.
6. From the File menu, select Save Network Configuration.  
The `sqlnet.ora` and `listener.ora` files are updated with the following entries:  
wallet_location =  
 (SOURCE=  
  (METHOD=File)  
  (METHOD_DATA=  
   (DIRECTORY=wallet_location)))

Note:

The listener uses the wallet defined in the `listener.ora` file. It can use any database wallet. When SSL is configured for a server using Net Manager, the wallet location is entered into the `listener.ora` and the `sqlnet.ora` files. The `listener.ora` file is not relevant to the Oracle client. 

To change the listener wallet location so that the listener has its own wallet, you can edit `listener.ora` to enter the new location.

##### 23.9.1.3 Step 1C: Set the Transport Layer Security Cipher Suites on the Server (Optional)

Optionally, you can set the Transport Layer Security cipher suites.

* [About the Transport Layer Security Cipher Suites](configuring-secure-sockets-layer-authentication.html#GUID-A08C63FB-5A47-4D98-A5C1-A2753D94BAD8)  
A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities.
* [TLS Cipher Suite Authentication, Encryption, Integrity, and TLS Versions](configuring-secure-sockets-layer-authentication.html#GUID-EFF4B2C9-2D25-473D-B718-A42754252347)  
Oracle Database supports a set of cipher suites that are set by default when you install Oracle Database.
* [Specifying Transport Layer Security Cipher Suites for the Database Server](configuring-secure-sockets-layer-authentication.html#GUID-46E5E0F6-2E5E-4FE0-9D1F-F289EEE35371)  
First, you must specify the Transport Layer Security cipher suites for the database server.

###### 23.9.1.3.1 About the Transport Layer Security Cipher Suites

A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities. 

During a Transport Layer Security handshake, two entities negotiate to see which cipher suite they will use when transmitting messages back and forth.

When you install Oracle Database, the Transport Layer Security cipher suites are set for you by default and negotiated in the order they are listed. You can override the default order by setting the `SSL_CIPHER_SUITES` parameter. Ensure that you enclose the `SSL_CIPHER_SUITES` parameter setting in parentheses (for example, `SSL_CIPHER_SUITES=(tls_rsa_with_aes_128_cbc_sha256)`). Otherwise, the cipher suite setting will not parse correctly. 

You can prioritize the cipher suites. When the client negotiates with servers regarding which cipher suite to use, it follows the prioritization you set. When you prioritize the cipher suites, consider the following:

* Compatibility. Server and client must be configured to use compatible cipher suites for a successful connection.
* Cipher priority and strength. Prioritize cipher suites starting with the strongest and moving to the weakest to ensure the highest level of security possible.
* The level of security you want to use.
* The impact on performance.  
Note:  
Regarding Diffie-Hellman anonymous authentication:  
   * If you set the server to employ this cipher suite, then you must also set the same cipher suite on the client. Otherwise, the connection fails.  
   * If you use a cipher suite employing Diffie-Hellman anonymous, then you must configure the TLS client authentication on the server by setting the `SSL_CLIENT_AUTHENTICATION` parameter to `FALSE`.  
   * There is a known bug in which an OCI client requires a wallet even when using a cipher suite with DH\_ANON, which does not authenticate the client.

**Related Topics**

* [TLS Cipher Suite Authentication, Encryption, Integrity, and TLS Versions](configuring-secure-sockets-layer-authentication.html#GUID-EFF4B2C9-2D25-473D-B718-A42754252347 "Oracle Database supports a set of cipher suites that are set by default when you install Oracle Database.")
* [Step 1E: Set Transport Layer Security Client Authentication on the Server (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-FDF1798F-D602-412A-857C-0A983522E407 "The SSL_CLIENT_AUTHENTICATION parameter controls whether the client is authenticated using TLS.")

###### 23.9.1.3.2 TLS Cipher Suite Authentication, Encryption, Integrity, and TLS Versions

Oracle Database supports a set of cipher suites that are set by default when you install Oracle Database.

[Table 23-1](configuring-secure-sockets-layer-authentication.html#GUID-EFF4B2C9-2D25-473D-B718-A42754252347%5F%5FCIHFADDD "Lists the available cipher suites and their respective authentication, encryption, integrity algorithms, and TLS compatibility") lists the authentication, encryption, and data integrity types each cipher suite uses.

Table 23-1 Transport Layer Security Cipher Suites

| Cipher Suites                                  | Authentication | Encryption  | Data Integrity | TLS Compatibility |
| ---------------------------------------------- | -------------- | ----------- | -------------- | ----------------- |
| TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256 | ECDHE\_ECDSA   | AES 128 GCM | SHA256 (SHA-2) | TLS 1.2 only      |
| TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA    | ECDHE\_ECDSA   | AES 128 CBC | SHA-1          | TLS 1.0 and later |
| TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256 | ECDHE\_ECDSA   | AES 128 CBC | SHA256 (SHA-2) | TLS 1.2 only      |
| TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA    | ECDHE\_ECDSA   | AES 256 CBC | SHA-1          | TLS 1.0 and later |
| TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384 | ECDHE\_ECDSA   | AES 256 CBC | SHA384 (SHA-2) | TLS 1.2 only      |
| TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384 | ECDHE\_ECDSA   | AES 256 GCM | SHA384 (SHA-2) | TLS 1.2 only      |
| TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256          | RSA            | AES 128 CBC | SHA256 (SHA-2) | TLS 1.2 only      |
| TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256          | RSA            | AES 128 GCM | SHA256 (SHA-2) | TLS 1.2 only      |
| TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA             | RSA            | AES 128 CBC | SHA-1          | TLS 1.0 only      |
| TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA             | RSA            | AES 256 CBC | SHA-1          | TLS 1.0 and later |
| TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256          | RSA            | AES 256 CBC | SHA256 (SHA-2) | TLS 1.2 only      |
| TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384          | RSA            | AES 256 GCM | SHA384 (SHA-2) | TLS 1.2 only      |

[Table 23-2](configuring-secure-sockets-layer-authentication.html#GUID-EFF4B2C9-2D25-473D-B718-A42754252347%5F%5FCBHCAIGE "SSL_DH cipher suites") lists cipher suites that you can use, but be aware that they do not the provide authentication of the communicating parties, and hence can be vulnerable to third-party attacks. Oracle recommends that you do not use these cipher suites to protect sensitive data. However, they are useful if the communicating parties want to remain anonymous or simply do not want the overhead caused by mutual authentication.

Table 23-2 SSL\_DH Transport Layer Security Cipher Suites

| Cipher Suites                            | Authentication | Encryption   | Data Integrity | TLS Compatibility |
| ---------------------------------------- | -------------- | ------------ | -------------- | ----------------- |
| SSL\_DH\_anon\_WITH\_3DES\_EDE\_CBC\_SHA | DH anon        | 3DES EDE CBC | SHA-1          | TLS 3.0 and later |

###### 23.9.1.3.3 Specifying Transport Layer Security Cipher Suites for the Database Server

First, you must specify the Transport Layer Security cipher suites for the database server.

1. Start Oracle Net Manager.  
   * (UNIX) From `$ORACLE_HOME` `/bin`, enter the following command at the command line:  
   netmgr  
   * (Windows) Select Start, Programs, Oracle - HOME\_NAME, Configuration and Migration Tools, then Net Manager.
2. Expand Oracle Net Configuration, and from Local, select Profile.
3. From the Naming list, select Network Security.  
The Network Security tabbed window appears.
4. Select the SSL tab and then select Configure SSL for: Server.
5. In the Cipher Suite Configuration area, click Add.  
A dialog box displays available cipher suites. To see the US domestic cipher suites, click the Show US Domestic Cipher Suits check box.
6. Select a suite and click OK.  
The Cipher Suite Configuration list is updated:
7. Use the up and down arrows to prioritize the cipher suites.
8. From the File menu, select Save Network Configuration.  
The `sqlnet.ora` file is updated with the following entry:  
SSL_CIPHER_SUITES= (SSL_cipher_suite1 [,SSL_cipher_suite2])

##### 23.9.1.4 Step 1D: Set the Required Transport Layer Security Version on the Server (Optional)

The `SSL_VERSION` parameter defines the version of TLS that must run on the systems with which the server communicates. 

Optionally, you can set the `SSL_VERSION` parameter in the `sqlnet.ora` or the `listener.ora` file. 

You can require these systems to use any valid version. The default setting for this parameter in `sqlnet.ora` is `undetermined`, which is set by selecting Any from the list in the SSL tab of the Network Security window.

1. In the Require SSL Version list, the default is Any.  
Accept this default or select the SSL version you want to use.
2. From the File menu, select Save Network Configuration.  
If you chose Any, then the `sqlnet.ora` file is updated with the following entry:  
SSL_VERSION=UNDETERMINED

Note:

SSL 2.0 is not supported on the server side.

##### 23.9.1.5 Step 1E: Set Transport Layer Security Client Authentication on the Server (Optional)

The `SSL_CLIENT_AUTHENTICATION` parameter controls whether the client is authenticated using TLS. 

You must set this parameter in the `sqlnet.ora` file on the server. The default value of `SSL_CLIENT_AUTHENTICATION` parameter is `TRUE`.

You can set the `SSL_CLIENT_AUTHENTICATION` to `FALSE` if you are using a cipher suite that contains Diffie-Hellman anonymous authentication (`DH_anon`).

Also, you can set this parameter to `FALSE` for the client to authenticate itself to the server by using any of the non-SSL authentication methods supported by Oracle Database, such as Kerberos or RADIUS.

Note:

There is a known bug in which an OCI client requires a wallet even when using a cipher suite with DH\_ANON, which does not authenticate the client.

To set `SSL_CLIENT_AUTHENTICATION` to `FALSE` on the server:

1. In the SSL page Oracle Net Manager, deselect Require Client Authentication.
2. From the File menu, select Save Network Configuration.  
The `sqlnet.ora` file is updated with the following entry:  
SSL_CLIENT_AUTHENTICATION=FALSE

##### 23.9.1.6 Step 1F: Set Transport Layer Security as an Authentication Service on the Server (Optional)

The `SQLNET.AUTHENTICATION_SERVICES` parameter in the `sqlnet.ora` file sets the TLS authentication service.

Set this parameter if you want to use TLS authentication in conjunction with another authentication method supported by Oracle Database. For example, use this parameter if you want the server to authenticate itself to the client by using TLS and the client to authenticate itself to the server by using Kerberos.

* To set the `SQLNET.AUTHENTICATION_SERVICES` parameter on the server, add TCP/IP with TLS (TCPS) to this parameter in the `sqlnet.ora` file by using a text editor. For example, if you want to use SSL authentication in conjunction with RADIUS authentication, set this parameter as follows:  
 SQLNET.AUTHENTICATION_SERVICES = (TCPS, radius)

If you do not want to use TLS authentication in conjunction with another authentication method, then do not set this parameter.

##### 23.9.1.7 Step 1G: Disable SSLv3 on the Server and Client (Optional)

SSLv3 refers to Secure Sockets Layer version 3\. 

Applications that support Secure Sockets Layer version 3 (SSLv3) are vulnerable to Padding Oracle On Downgraded Legacy Encryption (POODLE) attacks, even if they use the most recent version of Transport Layer Security (TLS). To prevent POODLE attacks, you should set the `ADD_SSLV3_TO_DEFAULT` `sqlnet.ora` parameter to `FALSE` on both the server and the client. `ADD_SSLV3_TO_DEFAULT` only applies if the `SSL_VERSION` parameter is not set. (which means that you are using the default list of SSL versions). 

1. Log in to the database server or the client server.
2. Edit the `sqlnet.ora` parameter file, which by default is located in the `$ORACLE_HOME/network/admin` directory, to include the `ADD_SSLV3_TO_DEFAULT` parameter, as follows:  
ADD_SSLV3_TO_DEFAULT=false  
`ADD_SSLV3_TO_DEFAULT` defaults to `FALSE`, and has no effect if `SSL_VERSION` is explicitly set. So, by default, without `SSL_VERSION` explicitly set, SSLv3 connections will not be allowed. Setting `ADD_SSLV3_TO_DEFAULT` to `TRUE` would allow SSLv3 connections to continue working by default.

##### 23.9.1.8 Step 1H: Create a Listening Endpoint that Uses TCP/IP with Transport Layer Security on the Server

You can configure a listening endpoint to use TCP/IP with TLS on the server.

1. Configure the listener in the `listener.ora` file. Oracle recommends using port number 2484 for typical Oracle Net clients.
2. Restart the database.

##### 23.9.1.9 Step 1H: Restart the Database

To complete the configuration of Transport Layer Security on the server, you must restart the database. 

* For example:

SHUTDOWN IMMEDIATE
STARTUP 


#### 23.9.2 Step 2: Configure Transport Layer Security on the Client

When you configure SSL on the client, you configure the server DNs and use TCP/IP with TLS on the client. 

* [Step 2A: Confirm Client Wallet Creation](configuring-secure-sockets-layer-authentication.html#GUID-608E8F87-60E7-4CD8-8FAF-64897A482B97)  
You must confirm that a wallet has been created on the client and that the client has a valid certificate.
* [Step 2B: Configure Server DN Matching and Use TCP/IP with TLS on the Client](configuring-secure-sockets-layer-authentication.html#GUID-2DD5282C-216D-4282-92D3-04CB1E9B6CA7)  
Next, you are ready to configure server DN matching and use TCP/IP with Transport Layer Security (TLS) on the client.
* [Step 2C: Specify Required Client TLS Configuration (Wallet Location)](configuring-secure-sockets-layer-authentication.html#GUID-5CF201BA-EF47-47FC-B927-544129F2C753)  
You can use Oracle Net Manager to specify the required client TLS configuration.
* [Step 2D: Set the Client Transport Layer Security Cipher Suites (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-8D691AC5-78FF-43CF-87CE-581AF67DFC09)  
Optionally, you can set the Transport Layer Security cipher suites. Oracle Database provides default cipher suite settings.
* [Step 2E: Set the Required TLS Version on the Client (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-8E6CF3EC-B070-460F-9345-14E7BEC67EB2)  
The `SSL_VERSION` parameter defines the version of TLS that must run on the systems with which the client communicates.
* [Step 2F: Set TLS as an Authentication Service on the Client (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-2AF332D3-2B3D-476C-B9C7-36C59A96DDCB)  
The `SQLNET.AUTHENTICATION_SERVICES` parameter in the `sqlnet.ora` file sets the TLS authentication service.
* [Step 2G: Specify the Certificate to Use for Authentication on the Client (Optional)](configuring-secure-sockets-layer-authentication.html#GUID-D7DFD3DB-6FB7-4C78-8253-66ABF746DDEB)  
If you have multiple certificates, then you can set the `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter in the `sqlnet.ora` file to specify the correct certificate.
* [Step 2H: Check That the Connections Are Using Transport Layer Security](configuring-secure-sockets-layer-authentication.html#GUID-9BA91632-B698-4120-9720-681364C5C618)  
You can query the `V$SESSION` and `V$SESSION_CONNECT_INFO` dynamic views to ensure that the client connections are using Transport Layer Security (TLS).
* [Step 2I: Restart the Database](configuring-secure-sockets-layer-authentication.html#GUID-9BA45085-AD74-48E7-9D18-0ED46BB2A6DE)  
To complete the configuration of Transport Layer Security on the client, you must restart the database.

##### 23.9.2.1 Step 2A: Confirm Client Wallet Creation

You must confirm that a wallet has been created on the client and that the client has a valid certificate. 

* Use Oracle Wallet Manager to check that the wallet has been created by selecting the Wallet menu, then Open.  
Oracle recommends that you use Oracle Wallet Manager to remove the trusted certificate in your Oracle wallet that is associated with each certificate authority that you do not use.

##### 23.9.2.2 Step 2B: Configure Server DN Matching and Use TCP/IP with TLS on the Client

Next, you are ready to configure server DN matching and use TCP/IP with Transport Layer Security (TLS) on the client.

* [About Configuring the Server DN Matching and Using TCP/IP with TLS on the Client](configuring-secure-sockets-layer-authentication.html#GUID-3A8DF64A-B7D4-4C4A-9EE8-DCB9B8853076)  
In addition to validating the server certificate's certificate chain, you can perform an extra check through server DN matching.
* [Configuring the Server DN Matching and Using TCP/IP with TLS on the Client](configuring-secure-sockets-layer-authentication.html#GUID-B32F206F-C880-43F8-A286-64D58F8A0A1F)  
You must edit the `tnsnames.ora` and `listener.ora` files to configure the server DN matching and user TCP/IP with TLS on the client.
* [Use of the SSL\_ALLOW\_WEAK\_DN\_MATCH Parameter to Control SSL\_SERVER\_DN\_MATCH](configuring-secure-sockets-layer-authentication.html#GUID-151B3249-22FC-4648-B57B-69D4B12E1E6B)  
The `SSL_ALLOW_WEAK_DN_MATCH` parameter controls how the `SSL_SERVER_DN_MATCH` parameter allows the service name for partial distinguished name matching and check the database server certificate.

###### 23.9.2.2.1 About Configuring the Server DN Matching and Using TCP/IP with TLS on the Client

In addition to validating the server certificate's certificate chain, you can perform an extra check through server DN matching. 

You can configure the Oracle Net Service name to include server DN matching and to use TCP/IP with TLS on the client. To accomplish this, you must specify the server's distinguished name (DN) and `TCPS` as the protocol in the client network configuration files to enable server DN matching and TCP/IP with TLS connections. Server DN matching is optional, but Oracle recommends it because it adds a layer of security to the client: the client can then perform this check against the server. 

Due to changes in the CA certificate format where the Organization Unit (`OU`) field will be removed starting in 2022, you may need to update your server certificate DN if you have set `SSL_SERVER_DN_MATCH` to `TRUE`. After you receive the new server certificate with the OU removed from the DN, you must update the client `SSL_SERVER_CERT_DN` parameter to match the new DN.

You can configure either partial DN matching or full DN matching. After you set the`SSL_SERVER_DN_MATCH` parameter to `TRUE`, then partial DN matching is performed automatically. The client will then check the server certificate for the DN information. Full DN matching enables the client to match against the complete DN of the server. If you want to perform a full DN match, then you must specify the server's DN in the `SSL_SERVER_CERT_DN` parameter. To enable either of these methods, you must set the `SSL_SERVER_DN_MATCH` parameter to `TRUE`.

The ability to use either partial or full DN matching enables more flexibility based on how you create and manage host certificates. For example, suppose the client tries to connect to a server with `hostname=finance.us.example.com`. With partial DN matching, the client checks the server's certificate to verify that`CN=finance.us.example.com` is part of the server's DN.

You must manually edit the `tnsnames.ora` client network configuration file to specify the server's DN and the TCP/IP with SSL protocol. The `tnsnames.ora` file can be located on the client or in the LDAP directory. If it is located on the server, then it typically resides in the same directory as the `listener.ora` file. The `tnsnames.ora` file is typically located in the setting specified by the `TNS_ADMIN` environment variable. If `TNS_ADMIN` is not set, then `tnsnames.ora` resides in the following directory locations:

* (UNIX) `$ORACLE_HOME` `/network/admin/`
* (Windows) `ORACLE_BASE` `\` `ORACLE_HOME` `\network\admin\`

###### 23.9.2.2.2 Configuring the Server DN Matching and Using TCP/IP with TLS on the Client

You must edit the `tnsnames.ora` and `listener.ora` files to configure the server DN matching and user TCP/IP with TLS on the client.

1. In the client `tnsnames.ora` file, search for the `SSL_SERVER_CERT_DN` parameter and do the following:  
   * If you want to use full DN matching, then set `SSL_SERVER_CERT_DN` to the complete DN, similar to the following:  
   (SECURITY=  
   (SSL_SERVER_CERT_DN="finance,cn=OracleContext,c=us,o=example"))  
   The client uses this information to obtain the list of DNs it expects for each of the servers, enforcing the server's DN to match its service name. The following example shows an entry for the `finance` database in the `tnsnames.ora` file.  
   finance=  
   (DESCRIPTION=  
   (ADDRESS_LIST=  
   (ADDRESS= (PROTOCOL = tcps) (HOST = finance) (PORT = 1575)))  
   (CONNECT_DATA=  
   (SERVICE_NAME= finance.us.example.com))  
   (SECURITY=  
   (SSL_SERVER_CERT_DN="cn=finance,cn=OracleContext,c=us,o=example"))  
   By default, the `tnsnames.ora` and `listener.ora` files are in the `$ORACLE_HOME/network/admin` directory on UNIX systems and in `ORACLE_HOME` `\network\admin` on Windows.  
   * If you plan to use partial DN matching, then do not include the `SSL_SERVER_CERT_DN` parameter in `tnsnames.ora`.
2. In the client `tnsnames.ora` file, enter `tcps` as the `PROTOCOL` in the `ADDRESS` parameter.  
This specifies that the client will use TCP/IP with TLS to connect to the database that is identified in the `SERVICE_NAME` parameter. The following also shows an entry that specifies TCP/IP with TLS as the connecting protocol in the `tnsnames.ora` file.  
LISTENER=  
(DESCRIPTION_LIST=  
(DESCRIPTION=  
(ADDRESS= (PROTOCOL = tcps) (HOST = finance) (PORT = 1575))))
3. In the `listener.ora` file, enter `tcps` as the `PROTOCOL` in the `ADDRESS` parameter.

###### 23.9.2.2.3 Use of the SSL\_ALLOW\_WEAK\_DN\_MATCH Parameter to Control SSL\_SERVER\_DN\_MATCH

The `SSL_ALLOW_WEAK_DN_MATCH` parameter controls how the `SSL_SERVER_DN_MATCH` parameter allows the service name for partial distinguished name matching and check the database server certificate.

Starting in Oracle Database 23c, the behavior of the `SSL_SERVER_DN_MATCH` parameter has changed. Previously, only the database server certificate was checked for DN matching. With Oracle Database 23c, the listener and server certificates are both checked. Also, the `SERVICE_NAME` setting is not used to check during partial DN match anymore. The `HOST` setting can still be used for partial DN matching with the certificate DN and subject alternative name (SAN), on both the listener and server certificates.

You can set `SSL_ALLOW_WEAK_DN_MATCH` as follows: 

* `TRUE` enables `SSL_SERVER_DN_MATCH` to check the database server certificate (but not the listener) and enable the service name to be used for partial DN matching. The search order on the client side is as follows: first, the host name, then the subject alternative name (SAN), and then the service name.
* `FALSE` (the default) disables `SSL_SERVER_DN_MATCH` from checking service name matching. Instead, matching on the client side is based on a search for the `HOST` setting in the certificate DN, and if that is not available, then in the subject alternative name (SAN) field (but not the service name). The DN check is performed on the listener and the server.

If you used the service name for partial DN matching previously, then you must either get a new certificate or set `SSL_ALLOW_WEAK_DN_MATCH` to `TRUE` to revert to the pre-release 23c behavior. You are most likely using the same certificate for both the database server and listener, but if you are not, then you will either need to do one of the following:

* Get a new certificate (use the `orapki cert create` command for self-signed certificates).
* Change or remove the DN matching strategy.
* Set the `SSL_ALLOW_WEAK_DN_MATCH` parameter to `TRUE` to revert `SSL_SERVER_DN_MATCH` to its older behavior.

When you set `SSL_ALLOW_WEAK_DN_MATCH` to `TRUE`, note the following: 

* When the client performs a full DN match (`SSL_SERVER_MATCH=TRUE`, `SSL_SERVER_CERT_DN="certificate_DN"`), then only the database server certificate DN will need to match the `SSL_SERVER_CERT_DN` value.
* When the client performs a partial DN match (`SSL_SERVER_MATCH=TRUE`, `SSL_SERVER_CERT_DN` is not set), then Oracle Database will compare the connect string parameter `HOST` to the common name (CN) of the database server certificate DN and the certificate subject alternate names field (SAN). If there is no partial match, then Oracle Database will continue and check the `SERVICE_NAME` parameter with the CN.

##### 23.9.2.3 Step 2C: Specify Required Client TLS Configuration (Wallet Location)

You can use Oracle Net Manager to specify the required client TLS configuration. 

1. Start Oracle Net Manager.  
   * (UNIX) From `$ORACLE_HOME` `/bin`, enter the following command at the command line:  
   netmgr  
   * (Windows) Select Start, Programs, Oracle - HOME\_NAME, Configuration and Migration Tools, then Net Manager.
2. Expand Oracle Net Configuration, and from Local, select Profile.
3. From the Naming list, select Network Security.  
The Network Security tabbed window appears.
4. Select the SSL tab.
5. Select Configure SSL for: Client.
6. In the Wallet Directory box, enter the directory in which the Oracle wallet is located, or click Browse to find it by searching the file system.
7. From the Match server X.509 name list, select one of the following options:  
   * Yes: Requires that the server's distinguished name (DN) match its service name. TLS ensures that the certificate is from the server and connections succeed only if there is a match.  
   This check can be made only when RSA ciphers are selected, which is the default setting.  
   * No (default): TLS checks for a match between the DN and the service name, but does not enforce it. Connections succeed regardless of the outcome but an error is logged if the match fails.  
   * Let Client Decide: Enables the default.  
   The following alert is displayed when you select No:  
   Security Alert  
   Not enforcing the server X.509 name match allows a server to potentially fake its identity. Oracle recommends selecting YES for this option so that connections are refused when there is a mismatch.
8. From the File menu, select Save Network Configuration.  
The `sqlnet.ora` file on the client is updated with the following entries:  
SSL_CLIENT_AUTHENTICATION =TRUE  
wallet_location =  
 (SOURCE=  
  (METHOD=File)  
  (METHOD_DATA=  
   (DIRECTORY=wallet_location)))  
SSL_SERVER_DN_MATCH=(ON/OFF)

##### 23.9.2.4 Step 2D: Set the Client Transport Layer Security Cipher Suites (Optional)

Optionally, you can set the Transport Layer Security cipher suites. Oracle Database provides default cipher suite settings.

* [About Setting the Client Transport Layer Security Cipher Suites](configuring-secure-sockets-layer-authentication.html#GUID-DFF5051D-B1E0-4A12-BE4F-10C54937800A)  
A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities.
* [Setting the Client Transport Layer Security Cipher Suites](configuring-secure-sockets-layer-authentication.html#GUID-C111996F-FABE-4109-BCD1-345F32465528)  
You can use Oracle Net Manager to set the client TLS cipher suites.

###### 23.9.2.4.1 About Setting the Client Transport Layer Security Cipher Suites

A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities. 

During an SSL handshake, two entities negotiate to see which cipher suite they will use when transmitting messages back and forth.

When you install Oracle Database, the TLS cipher suites are set for you by default. This table lists them in the order they are tried when two entities are negotiating a connection. You can override the default by setting the `SSL_CIPHER_SUITES` parameter. For example, if you use Oracle Net Manager to add the cipher suite `SSL_RSA_WITH_RC4_128_SHA`, all other cipher suites in the default setting are ignored.

You can prioritize the cipher suites. When the client negotiates with servers regarding which cipher suite to use, it follows the prioritization you set. When you prioritize the cipher suites, consider the following:

* The level of security you want to use. For example, AES encryption is stronger than DES.
* The impact on performance. For example, triple-DES encryption is slower than DES.
* Administrative requirements. The cipher suites selected for a client must be compatible with those required by the server. For example, in the case of an Oracle Call Interface (OCI) user, the server requires the client to authenticate itself. You cannot, in this case, use a cipher suite employing Diffie-Hellman anonymous authentication, which disallows the exchange of certificates.

You typically prioritize cipher suites starting with the strongest and moving to the weakest.

The currently supported Transport Layer Security cipher suites are set by default when you install Oracle Database. The table also lists the authentication, encryption, and data integrity types each cipher suite uses.

Note:

If the `SSL_CLIENT_AUTHENTICATION` parameter is set to `true` in the `sqlnet.ora` file, then disable all cipher suites that use Diffie-Hellman anonymous authentication. Otherwise, the connection fails.

###### 23.9.2.4.2 Setting the Client Transport Layer Security Cipher Suites

You can use Oracle Net Manager to set the client TLS cipher suites.

1. Start Oracle Net Manager.  
   * (UNIX) From `$ORACLE_HOME` `/bin`, enter the following command at the command line:  
   netmgr  
   * (Windows) Select Start, Programs, Oracle - HOME\_NAME, Configuration and Migration Tools, then Net Manager.
2. Expand Oracle Net Configuration, and from Local, select Profile.
3. From the Naming list, select Network Security.  
The Network Security tabbed window appears.
4. Select the SSL tab.
5. In the Cipher Suite Configuration region, click Add.  
A dialog box displays available cipher suites.
6. Select a suite and click OK.  
The Cipher Suite Configuration list is updated as shown as follows:
7. Use the up and down arrows to prioritize the cipher suites.
8. From the File menu, select Save Network Configuration.  
The `sqlnet.ora` file is updated with the following entry:  
SSL_CIPHER_SUITES= (SSL_cipher_suite1 [,SSL_cipher_suite2])

##### 23.9.2.5 Step 2E: Set the Required TLS Version on the Client (Optional)

The `SSL_VERSION` parameter defines the version of TLS that must run on the systems with which the client communicates. 

You must set the `SSL_VERSION` parameter in the `sqlnet.ora` file. You can require these systems to use any valid version. 

The default setting for this parameter in `sqlnet.ora` is `undetermined`, which is set by selecting Any from the list in the SSL tab of the Network Security window. When Any is selected, TLS 1.0 is tried first, then TLS 3.0, and TLS 2.0 are tried in that order. Ensure that the client TLS version is compatible with the version the server uses.

1. In the Require SSL Version list, select the SSL version that you want to configure.  
The default setting is Any.
2. From the File menu, select, Save Network Configuration.  
The `sqlnet.ora` file is updated. If you selected Any, then it is updated with the following entry:  
SSL_VERSION=UNDETERMINED

##### 23.9.2.6 Step 2F: Set TLS as an Authentication Service on the Client (Optional)

The `SQLNET.AUTHENTICATION_SERVICES` parameter in the `sqlnet.ora` file sets the TLS authentication service. 

* [About the SQLNET.AUTHENTICATION\_SERVICES Parameter](configuring-secure-sockets-layer-authentication.html#GUID-1B9C9EBC-D4A3-4ABC-BD5C-E0B01A0BE1FB)  
The `SQLNET.AUTHENTICATION_SERVICES` parameter enables TLS authentication in conjunction with another authentication method supported by Oracle Database.
* [Setting the SQLNET.AUTHENTICATION\_SERVICES Parameter](configuring-secure-sockets-layer-authentication.html#GUID-159348DD-19F9-4E15-8758-0AC7170EC511)  
You can set the `SQLNET.AUTHENTICATION_SERVICES` parameter in the `sqlnet.ora` file.

###### 23.9.2.6.1 About the SQLNET.AUTHENTICATION\_SERVICES Parameter

The `SQLNET.AUTHENTICATION_SERVICES` parameter enables TLS authentication in conjunction with another authentication method supported by Oracle Database. 

For example, use this parameter if you want the server to authenticate itself to the client by using TLS and the client to authenticate itself to the server by using RADIUS.

To set the `SQLNET.AUTHENTICATION_SERVICES` parameter, you must edit the `sqlnet.ora` file, which is located in the same directory as the other network configuration files. 

Depending on the platform, the `sqlnet.ora` file is in the following directory location:

* (UNIX) `$ORACLE_HOME` `/network/admin`
* (Windows) `ORACLE_BASE` `\` `ORACLE_HOME` `\network\admin\`

###### 23.9.2.6.2 Setting the SQLNET.AUTHENTICATION\_SERVICES Parameter

You can set the `SQLNET.AUTHENTICATION_SERVICES` parameter in the `sqlnet.ora` file.

* To set the client `SQLNET.AUTHENTICATION_SERVICES` parameter, add TCP/IP with TLS (`TCPS`) to this parameter in the `sqlnet.ora` file by using a text editor.  
For example, if you want to use TLS authentication in conjunction with RADIUS authentication, then set this parameter as follows:  
 SQLNET.AUTHENTICATION_SERVICES = (TCPS, radius)

If you do not want to use TLS authentication in conjunction with another authentication method, then do not set this parameter.

##### 23.9.2.7 Step 2G: Specify the Certificate to Use for Authentication on the Client (Optional)

If you have multiple certificates, then you can set the `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter in the `sqlnet.ora` file to specify the correct certificate.

* [About the SQLNET.SSL\_EXTENDED\_KEY\_USAGE Parameter](configuring-secure-sockets-layer-authentication.html#GUID-1DA97BE9-2849-40EE-849D-1165A04EAAF1)  
The `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter in the sqlnet.ora file specifies which certificate to use in authenticating to the database server
* [Setting the SQLNET.SSL\_EXTENDED\_KEY\_USAGE Parameter](configuring-secure-sockets-layer-authentication.html#GUID-BDB6F42E-4612-428D-A5CD-852D2E3F4918)  
You can set the `SQLNET.SSL_EXTENDED_KEY_USAGE` to set the client authentication.

###### 23.9.2.7.1 About the SQLNET.SSL\_EXTENDED\_KEY\_USAGE Parameter

The `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter in the sqlnet.ora file specifies which certificate to use in authenticating to the database server

You should set the `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter if you have multiple certificates in the security module, but there is only one certificate with extended key usage field of `client authentication`, and this certificate is exactly the one you want to use to authenticate to the database. 

For example, use this parameter if you have multiple certificates in a smart card, only one of which has an extended key usage field of `client authentication`, and you want to use this certificate `C` to authenticate to the database. By setting this parameter on a Windows client to `client authentication`, the MSCAPI certificate selection box will not appear, and the certificate `C` is automatically used for the Transport Layer Security authentication of the client to the server.

###### 23.9.2.7.2 Setting the SQLNET.SSL\_EXTENDED\_KEY\_USAGE Parameter

You can set the `SQLNET.SSL_EXTENDED_KEY_USAGE` to set the client authentication.

* To set the client `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter, edit the `sqlnet.ora` file to have the following line:  
SQLNET.SSL_EXTENDED_KEY_USAGE = "client authentication"

If you do not want to use the certificate filtering, then remove the `SQLNET.SSL_EXTENDED_KEY_USAGE` parameter setting from the `sqlnet.ora` file.

##### 23.9.2.8 Step 2H: Check That the Connections Are Using Transport Layer Security

You can query the `V$SESSION` and `V$SESSION_CONNECT_INFO` dynamic views to ensure that the client connections are using Transport Layer Security (TLS). 

* In SQL\*Plus, perform the following query.

SELECT SYS_CONTEXT ('USERENV', 'NETWORK_PROTOCOL') FROM DUAL;
Output similar to the following should appear:
SYS_CONTEXT('USERENV','NETWORK_PROTOCOL')

tcps 


##### 23.9.2.9 Step 2I: Restart the Database

To complete the configuration of Transport Layer Security on the client, you must restart the database. 

* For example:

SHUTDOWN IMMEDIATE
STARTUP 


#### 23.9.3 Step 3: Log in to the Database Instance

After you have completed the configuration, you are ready to log in to the database.

* Start SQL\*Plus and then enter one of the following connection commands:  
   * If you are using Transport Layer Security authentication for the client (`SSL_CLIENT_AUTHENTICATION=true` in the `sqlnet.ora` file):  
   CONNECT/@net_service_name  
   * If you are not using Transport Layer Security authentication (`SSL_CLIENT_AUTHENTICATION=false` in the `sqlnet.ora` file):  
   CONNECT username@net_service_name  
   Enter password: password

### 23.10 Transport Layer Security Oracle Wallet Search Order

Oracle Database provides several routes for finding the wallet on a server in a Transport Layer Security (TLS) environment. 

The Oracle Database server retrieves the wallet by searching in these locations, in the following order:

1. `WALLET_ROOT` in the `init.ora` file
2. `WALLET_LOCATION` in the `sqlnet.ora` file
3. Default wallet location:  
   * Linux: `/etc/ORACLE/WALLETS/user_name`  
   * Windows: `C:\Users\user_name\\ORACLE\WALLETS`

The TNS listener retrieves the wallet location by searching in these locations, in the following order:

1. `WALLET_LOCATION` in the `listener.ora` file
2. Default wallet location:  
   * Linux: `/etc/ORACLE/WALLETS/user_name`  
   * Windows: `C:\Users\user_name\\ORACLE\WALLETS`

Oracle Database Client retrieves the wallet by searching in these locations, in the following order:

1. Connect string
2. `WALLET_LOCATION` in the `sqlnet.ora` file
3. Default wallet location:  
   * Linux: `/etc/ORACLE/WALLETS/user_name`  
   * Windows: `C:\Users\user_name\\ORACLE\WALLETS`
4. System wallets located in the certificate store location. The default certificate store location depends on the platform, as follows:  
   * Linux: RHEL/Oracle Linux: `/etc/pki/tls/cert.pem`  
   * Microsoft Windows: Microsoft Certificate Store

### 23.11 Transport Layer Security Connections in an Oracle Real Application Clusters Environment

You can configure Transport Layer Security (TLS) connections in an Oracle Real Application Clusters (Oracle RAC) environment by using Oracle RAC tools and modifying Oracle Database configuration files.

* [Step 1: Configure TCPS Protocol Endpoints](configuring-secure-sockets-layer-authentication.html#GUID-9C98BFAE-429E-485D-A452-0FFF6CCEF22E)  
In Oracle Real Application Clusters (Oracle RAC), clients access one of three scan listeners and are then routed to database listeners. To support Transport Layer Security (TLS), all of these listeners must have TCPS protocol endpoints.
* [Step 2: Ensure That the LOCAL\_LISTENER Parameter Is Correctly Set on Each Node](configuring-secure-sockets-layer-authentication.html#GUID-85E82732-F147-4C67-92E7-45C5416D5271)  
The Oracle Agent automatically sets the `LOCAL_LISTENER` parameter on each node, but you should double-check to ensure that it is correct.
* [Step 3: Create Transport Layer Security Wallets and Certificates](configuring-secure-sockets-layer-authentication.html#GUID-6223B9DF-0CA5-4DB2-A15E-348B49AFA7B8)  
You must create Transport Layer Security (TLS) wallets and certificates for the cluster and also for clients that will connect to the cluster over TLS.
* [Step 4: Create a Wallet in Each Node of the Oracle RAC Cluster](configuring-secure-sockets-layer-authentication.html#GUID-17C00E86-780B-4B4C-91D7-76BC8BC7CE4F)  
After you have created the cluster wallet, you can copy it to each node of the Oracle Real Applications (Oracle RAC) cluster.
* [Step 5: Define Wallet Locations in the listener.ora and sqlnet.ora Files](configuring-secure-sockets-layer-authentication.html#GUID-2E743A3A-2508-4BD8-82C6-410CDDC87F31)  
To enable the database server and listeners to access the wallets, you must define the wallet locations in the `listener.ora` and `sqlnet.ora` files.
* [Step 6: Restart the Database Instances and Listeners](configuring-secure-sockets-layer-authentication.html#GUID-87E4EEF7-35DB-48BB-8FBA-81D23398F1A9)  
With the wallets in place and the `*.ora` files edited, you must restart the database server and listener processes so that they pick up the new settings.
* [Step 7: Test the Cluster Node Configuration](configuring-secure-sockets-layer-authentication.html#GUID-E93FFDD9-BDC3-45AA-8FF4-62FEE52BBDBD)  
To test the cluster node configuration, you can create a connect descriptor for the node and then try to connect to this node.
* [Step 8: Test the Remote Client Configuration](configuring-secure-sockets-layer-authentication.html#GUID-723B9C91-147A-4873-B83F-7147D7D125EC)  
After you have tested the wallet on the Oracle Real Applications (Oracle RAC) cluster nodes, you area ready to test the remote client configuration.

#### 23.11.1 Step 1: Configure TCPS Protocol Endpoints

In Oracle Real Application Clusters (Oracle RAC), clients access one of three scan listeners and are then routed to database listeners. To support Transport Layer Security (TLS), all of these listeners must have TCPS protocol endpoints.

1. Log in to the cluster that hosts the Oracle RAC database.
2. Check the listener resources to find if they support TCP endpoints.  
For example:

$ srvctl config listener -h 

Output similar to the following appears:

Name: LISTENER
Subnet: 192.0.2.195
Type: type
Owner: pfitch
Home: Grid_home
End points: TCP:1521 

The following command displays information about the scan listener:

$ srvctl config scan_listener -h 

Output similar to the following appears:

SCAN Listener LISTENER_SCAN1 exists. Port: TCP:1529
Registration invited nodes:
Registration invited subnets:
SCAN Listener is enabled.
SCAN Listener is individually enabled on nodes:
SCAN Listener is individually disabled on nodes: 

3. Add TCPS endpoints to the database listeners.  
For example:

$ srvctl modify listener -endpoints "TCP:port_1/TCPS:port_2" 

4. Check the listener configuration.  
For example:

$ srvctl config listener
Name: LISTENER
Network: 1, Owner: oracle
Home: CRS_home
End points: TCP:port_1/TCPS:port_2
$ lsnrctl status
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=LISTENER)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=IP_address)(PORT=port_2)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=IP_address)(PORT=port_1))) 

5. Add TCPS endpoints to the scan listeners.  
For example:

$ srvctl modify scan_listener -endpoints "TCP:port_1/TCPS:port_2" 

6. Check the scan listener configuration.  
For example:

$ srvctl config scan_listener
SCAN Listener LISTENER_SCAN1 exists. Port: TCP:port_1/TCPS:port_2
SCAN Listener LISTENER_SCAN2 exists. Port: TCP:port_1/TCPS:port_2
SCAN Listener LISTENER_SCAN3 exists. Port: TCP:port_1/TCPS:port_2
$ lsnrctl status listener_scan3
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=LISTENER_SCAN3)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=IP_address)(PORT=port_1)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=IP_address)(PORT=port_2))) 


#### 23.11.2 Step 2: Ensure That the LOCAL\_LISTENER Parameter Is Correctly Set on Each Node

The Oracle Agent automatically sets the `LOCAL_LISTENER` parameter on each node, but you should double-check to ensure that it is correct.

1. Log in any Oracle Real Application Clusters (Oracle RAC) node.
2. In SQL\*Plus, as a user with the `SYSDBA` administrative privilege, check the `LOCAL_LISTENER` parameter.

show parameter local_listener; 

Output similar to the following appears:

NAME TYPE VALUE

local_listener string (DESCRIPTION=(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=TCPS)(HOST=IP_address)
(PORT=port_2)))) 

3. If the output is not what you want, then restart each Oracle RAC instance.

#### 23.11.3 Step 3: Create Transport Layer Security Wallets and Certificates

You must create Transport Layer Security (TLS) wallets and certificates for the cluster and also for clients that will connect to the cluster over TLS. 

* [Oracle Real Application Clusters Components That Need Certificates](configuring-secure-sockets-layer-authentication.html#GUID-87F90FA8-BB4C-4698-96B6-918D1ED41CF1)  
Specific components in Oracle Real Application Clusters (Oracle RAC) need certificates when you configure Transport Layer Security (TLS) connections.
* [Creating Transport Layer Security Wallets and Certificates](configuring-secure-sockets-layer-authentication.html#GUID-A75BDDF5-2F72-4534-AE0E-CA4FBC3447F0)  
To create the Transport Layer Security wallets and certificates, you first create the root CA certificate, followed by the cluster and client wallets.

##### 23.11.3.1 Oracle Real Application Clusters Components That Need Certificates

Specific components in Oracle Real Application Clusters (Oracle RAC) need certificates when you configure Transport Layer Security (TLS) connections.

* Each cluster node (server) and listener must have a wallet with the user certificate and CA certificates.
* The client only needs CA certificates of the listeners and servers (either in wallet or system’s certificate store) if one-way TLS is configured.
* The client needs a wallet with its user certificate and CA certificates of the listeners and servers if mTLS is configured.

##### 23.11.3.2 Creating Transport Layer Security Wallets and Certificates

To create the Transport Layer Security wallets and certificates, you first create the root CA certificate, followed by the cluster and client wallets. 

1. Create the root CA certificate.  
   1. Log in to any Oracle Real Application Clusters (Oracle RAC) cluster node.  
   2. Use the `orapki` utility to create the CA wallet in a directory for the CA.

$ orapki wallet create -wallet CA_home_wallet_file_directory 

3. Create a self-signed root certificate for the CA wallet.  
For example:

$ orapki wallet add -wallet CA_home_wallet_file_directory -self_signed -dn "CN=test CA,O=test,C=c" -keysize 2048 -validity 3650 -sign_alg sha256
Enter wallet password: password 

4. Extract the root CA certificate from the wallet.  
This root certificate will be used as the trusted CA certificate in cluster and client wallets and can be distributed or published for users who are building PKCS#12 wallets. For example:

$ orapki wallet export -wallet CA_home_wallet_file_directory -dn "CN=test CA,O=test,C=c" -cert testCAroot.cer
Enter wallet password: password 

At this stage, the `CA_home_wallet_file_directory` directory will contain the new wallet (`ewallet.p12`) and certificate (`testCAroot.cer`).  
To check the configuration:  
$ orapki wallet display -wallet CA_home_wallet_file_directory -summary  
Output similar to the following appears:

Requested Certificates:
User Certificates:
Subject: CN=test CA,O=test,C=c
Trusted Certificates:
Subject: CN=test CA,O=test,C=c 

2. Create the cluster wallet.  
Next, you are ready follow the remaining steps in this procedure to sign the user certificate requests and provide authorized digital user certificates for different entities and processes in your environments. Repeat this process for each entity in the test environment that participates in the public key infrastructure functionality. A valid wallet consists of a root CA certificate and the signed user certificate.  
1. Create a wallet that is in a different location from the from the CA home directory.  
For example:

$ orapki wallet create -wallet cluster_wallet_file_directory
Enter password: password
Enter password again: password 

2. Create a user identity (user `dn`) and then a certificate request.  
For example:

$ orapki wallet add -wallet cluster_wallet_file_directory -dn "CN=testuser" -keysize 2048
Enter wallet password: password
$ orapki wallet export -wallet cluster_wallet_file_directory -dn "CN=testuser" -request cluster_wallet_file_directory/testuser.req
Enter wallet password: password 

At this stage, the `cluster_wallet_file_directory` directory will contain the SSO wallet (`cwallet.sso`), the wallet (`ewallet.p12`) and the certificate request (`testuser.req`). The certificate request can be signed by the CA generated above.  
For example:

$ orapki cert create -wallet cluster_wallet_file_directory -request cluster_wallet_file_directory/testuser.req -cert user_wallet_file_directory/testuser.cer -validity 3650 -sign_alg sha256
Enter wallet password: password 

The `cluster_wallet_file_directory` directory now has the `testuser.req` certificate request file.  
3. Import the root certificate (`testCAroot.cer`) and the signed user certificate (`testuser.cer`) into the user wallet.  
For example:

$ orapki wallet add -wallet cluster_wallet_file_directory -trusted_cert -cert CA_home_wallet_file_directory/testCAroot.cer -pwd
Enter wallet password: user_password
$ orapki wallet add -wallet cluster_wallet_file_directory -user_cert -cert cluster_wallet_file_directory/testuser.cer
Enter wallet password: user_password 

4. Check the finished cluster wallet.  
For example:

$ orapki wallet display -wallet cluster_wallet_file_directory -summary
Requested Certificates:
User Certificates:
Subject: CN=testuser
Trusted Certificates:
Subject: CN=test CA,O=test,C=c 

At this point, you are ready to copy the finished cluster wallet to each node of the cluster.
3. Create the client wallet.  
1. Create a client wallet with the root certificate (`testCAroot.cer`).  
To make a successful TLS connection, the client only requires the CA certificates of the server's certificate.  
For example:

$ orapki wallet create -wallet client_wallet_file_directory -auto_login
$ orapki wallet add -wallet client_wallet_file_directory -trusted_cert -cert CA_home_wallet_file_directory/testCAroot.cer 

2. Check the finished client wallet.  
For example:

$ orapki wallet display -wallet client_wallet_file_directory -summary
Requested Certificates:
User Certificates:
Trusted Certificates:
Subject: CN=test CA,O=test,C=c 


#### 23.11.4 Step 4: Create a Wallet in Each Node of the Oracle RAC Cluster

After you have created the cluster wallet, you can copy it to each node of the Oracle Real Applications (Oracle RAC) cluster. 

Ensure that each node is accessible by both the Oracle Real Application Clusters (Oracle RAC) database server (process monitor) and by the scan and local listeners that normally run from the GI home. 

1. Copy the PKCS#12 wallet (`ewallet.p12`) file that you created in the previous section to each node in the cluster.
2. In each node, create an auto-login wallet (`cwallet.sso`).  
The `cwallet.sso` file is an obfuscated mirror copy of the `ewallet.p12` and is the file that the database server and its listeners accesses. If you create the `cwallet.sso` on the Oracle RAC cluster, then you can copy it along with the `ewallet.p12` file to the wallet directory on each node. You can also create the `cwallet.sso` file on each node separately if `ewallet.p12` file is already in place. Run the following command in the same location as the `ewallet.p12` file:

$ orapki wallet create -wallet wallet_file_location -auto_login
Enter wallet password: ewallet_password 


#### 23.11.5 Step 5: Define Wallet Locations in the listener.ora and sqlnet.ora Files

To enable the database server and listeners to access the wallets, you must define the wallet locations in the `listener.ora` and `sqlnet.ora` files. 

1. Modify the `listener.ora` file in the Grid home of every node.

SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = wallet_file_location) 

2. In the `sqlnet.ora` file in the Oracle Database home, and the Grid home, of each cluster node, add the following information:

SQLNET.AUTHENTICATION_SERVICES = (BEQ, TCP, TCPS)
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = wallet_file_location)
)
) 


#### 23.11.6 Step 6: Restart the Database Instances and Listeners

With the wallets in place and the `*.ora` files edited, you must restart the database server and listener processes so that they pick up the new settings. 

The restart process will also enable the Oracle Real Application Clusters (Oracle RAC) instances where you set the `LOCAL_LISTENER` parameter earlier. 

* In any cluster node, use the `srvctl` utility to restart the database server and listener processes.  
For example:

$ srvctl stop listener
$ srvctl start listener
$ srvctl stop scan_listener
$ srvctl start scan_listener
$ srvctl stop database -d db_name
$ srvctl start database -d db_name 


#### 23.11.7 Step 7: Test the Cluster Node Configuration

To test the cluster node configuration, you can create a connect descriptor for the node and then try to connect to this node. 

1. In any cluster node, create a connect descriptor in the `tnsnames.ora` file that uses the scan listener TCPS endpoint.  
For example, for a TCPS endpoint called `dbssl`:

DBSSL =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = scan_name)(PORT = port_2))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = service_name)
)
) 

2. Use SQL\*Plus to try to connect to this TCPS endpoint.  
For example:

sqlplus user_name/@dbssl
Enter password: password 


#### 23.11.8 Step 8: Test the Remote Client Configuration

After you have tested the wallet on the Oracle Real Applications (Oracle RAC) cluster nodes, you area ready to test the remote client configuration. 

1. In every remote client `sqlnet.ora` file on the cluster node, define a wallet directory.

WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = wallet_file_location)
)
) 

2. Move the client wallet that you created earlier, when you created the SSL wallets and certificates, to the client wallet directory.

$ wallet create -wallet wallet_file_location -auto_login
Enter wallet password: password 

The `wallet_file_location` should have an `ewallet.p12` file and a `cwallet.sso` file.
3. In the `tnsnames.ora` file, create a connect descriptor that uses the scan listener TCPS endpoint.  
For example:

DBSSL =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = scan_name)(PORT = port_2))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = service_name)
)
) 

4. Use SQL\*Plus to try to connect to this TCPS endpoint.  
For example:

sqlplus user_name/@dbssl
Enter password: password 


### 23.12 Configuring Transport Layer Security for Client Authentication and Encryption Using Microsoft Certificate Store 

To perform this configuration with Microsoft Certificate Store (MCS), you use the `orapki` command-line tool to generate certificates and manipulate the Oracle wallets. 

* [About Configuring Transport Layer Security for Client Authentication and Encryption Using Microsoft Certificate Store](configuring-secure-sockets-layer-authentication.html#GUID-B0FDB36D-BA1A-4217-A634-0154BEA42421)  
This type of configuration is the foundation of the Common Access Cards and PIV cards authentication.
* [Step 1: Create and Configure the Server Wallet](configuring-secure-sockets-layer-authentication.html#GUID-F759FDE2-0BE3-4E4D-880E-35AE162A9DF5)  
You must use `orapki` to create a server wallet and the server's self-signed certificate.
* [Step 2: Create and Configure the Client Wallet](configuring-secure-sockets-layer-authentication.html#GUID-D001E758-ADF4-4E04-86BF-9C4CE69F0A73)  
You must use `orapki` to create a client wallet and a certificate request.
* [Step 3: Create an External User in the Oracle Database](configuring-secure-sockets-layer-authentication.html#GUID-9FD39673-6380-4BFF-831E-976068BFB47B)  
You must create an external user to be used with the client and server connection.
* [Step 4: Configure the Server listener.ora File](configuring-secure-sockets-layer-authentication.html#GUID-D625F598-BBFD-4A12-90A9-FB26602B078B)  
Next, you must check and then restart the server `listener.ora` file.
* [Step 5: Configure the Server sqlnet.ora File](configuring-secure-sockets-layer-authentication.html#GUID-5C29F762-D07B-4497-B36F-9D828B8C3FF6)  
You must ensure that the `sqlnet.ora` file points to the server wallet that you created earlier.
* [Step 6: Import the Client Wallet into the Microsoft Certificate Store](configuring-secure-sockets-layer-authentication.html#GUID-4C59E8EE-689B-4B46-8A94-CF5584162087)  
You must use the Microsoft Management Console (MMC) to perform this import operation.
* [Step 7: Configure the Client sqlnet.ora File](configuring-secure-sockets-layer-authentication.html#GUID-31C3D221-7A2B-47E3-BF02-5536C6D1FD3D)  
You must configure the client `sqlnet.ora` file to use Microsoft Certificate Store for the client wallet.
* [Step 8: Configure the Oracle Database](configuring-secure-sockets-layer-authentication.html#GUID-72E726E1-5C44-494D-BD31-2982229D97E6)  
In the Oracle database, configure the `OS_AUTHENT_PRE` and `REMOTE_OS_AUTH` parameters.
* [Step 9: Test the Client and Server Connection](configuring-secure-sockets-layer-authentication.html#GUID-EEC0ADA5-E0BB-43A0-8A86-D87781EEF901)  
After you complete the Microsoft Certificate Store configuration, you should test the and server connection.

#### 23.12.1 About Configuring Transport Layer Security for Client Authentication and Encryption Using Microsoft Certificate Store

This type of configuration is the foundation of the Common Access Cards and PIV cards authentication.

As long as the software libraries that are delivered with the Common Access Cards and PIV cards are capable of transparently loading the necessary certificates into the Microsoft Certificate Store, then the Transport Layer Security (TLS) authentication that you configure will be transparently performed. 

It is important to note that all the signing certificates of the user certificate that is loaded to the PIV card must be manually loaded into the server's wallet as part of the TLS configuration at the server level.

#### 23.12.2 Step 1: Create and Configure the Server Wallet

You must use `orapki` to create a server wallet and the server's self-signed certificate. 

1. Log in to the Oracle Database server.
2. Create a directory for the server wallet.  
For example:

mkdir /home/oracle/wallet_tls/server 

3. Go to this directory.

cd /home/oracle/wallet_tls/server 

4. Create the server wallet.

orapki wallet create -wallet . -auto_login -pwd password 

5. Check the directory.  
For example:

ls -la 

Output similar to the following appears:

total 16
drwxr-xr-x. 2 oracle oinstall 4096 Oct 28 07:18 .
drwxr-xr-x. 6 oracle oinstall 4096 Oct 28 07:17 ..
-rw-------. 1 oracle oinstall 120 Oct 28 07:18 cwallet.sso
-rw-rw-rw-. 1 oracle oinstall 0 Oct 28 07:18 cwallet.sso.lck
-rw-------. 1 oracle oinstall 75 Oct 28 07:18 ewallet.p12
-rw-rw-rw-. 1 oracle oinstall 0 Oct 28 07:18 ewallet.p12.lck 

6. Create the server's self-signed certificate.

orapki wallet add -wallet . -dn "cn=server" -self_signed -keysize 2048 -sign_alg sha256 -validity 365 -pwd password 


#### 23.12.3 Step 2: Create and Configure the Client Wallet

You must use `orapki` to create a client wallet and a certificate request. 

1. Log in to the Oracle Database client.
2. Create a directory for the client wallet.  
For example:

mkdir /home/oracle/wallet_tls/client 

3. Go to this directory.

cd /home/oracle/wallet_tls/client 

4. Create the client wallet.

orapki wallet create -wallet . -auto_login -pwd password 

5. Create a request for a user certificate and export the request.

orapki wallet add -wallet . -dn "cn=client" -keysize 2048 -sign_alg sha256 -pwd password
orapki wallet export -wallet . -dn "cn=client" -request req.txt -pwd password 

6. Copy the certificate request from the client directory to the server directory.  
For example:

cp req.txt ../server/
cd ../server/ 

7. Sign the certificate of the client and also export server's CA certificate.  
For example:

orapki cert create -wallet . -request req.txt -cert sign.txt -validity 1000 -pwd password
orapki wallet export -wallet . -dn "cn=server" -cert server.txt
cp server.txt ../client
cp sign.txt ../client
orapki wallet add -wallet . -trusted_cert -cert server.txt -pwd password
orapki wallet add -wallet . -user_cert -cert sign.txt -pwd password
cp sign.txt server.txt ../client/
cd ../client 


#### 23.12.4 Step 3: Create an External User in the Oracle Database

You must create an external user to be used with the client and server connection. 

1. As a user who can create users and grant them privileges, log in to the PDB that will use this external user account.
2. Create the external user.  
For example:

CREATE USER tlsuser IDENTIFIED EXTERNALLY AS 'cn=client'; 

3. Grant this account the `CONNECT` privilege.

GRANT CONNECT TO tlsuser; 


#### 23.12.5 Step 4: Configure the Server listener.ora File

Next, you must check and then restart the server `listener.ora` file.

1. Log in to the Oracle Database server.
2. Check the server `listener.ora` file to ensure that it is correctly configured.  
For example:

cat /u01/app/oracle/product/release/dbhome_1/network/admin/listener.or 

Output similar to the following appears:

LISTENERBOS =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = domain.com)(PORT = 1529))
)
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = domain.com)(PORT = 1530))
)
)
WALLET_LOCATION =
(SOURCE =
(METHOD = File)
(METHOD_DATA =
(DIRECTORY = /home/oracle/wallet_tls/server)) 

3. Restart the listener and check if the database is registered to this listener.

su - oracle
./lsnrctl start 

Output similar to the following appears:

Listener Parameter File /u01/app/oracle/product/release/dbhome_1/network/admin/listener.ora
Listener Log File /u01/app/oracle/diag/tnslsnr/service/instance/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=domain.com)(PORT=1523)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=domain.com)(PORT=1525)))
Services Summary...
Service "service" has 1 instance(s).
Instance "instance", status READY, has 1 handler(s) for this service...
Service "serviceDB" has 1 instance(s).
Instance "instance", status READY, has 1 handler(s) for this service...
The command completed successful 


#### 23.12.6 Step 5: Configure the Server sqlnet.ora File

You must ensure that the `sqlnet.ora` file points to the server wallet that you created earlier. 

1. Log in to the Oracle Database server.
2. Check the `sqlnet.ora` file to ensure that it points to the server wallet.  
For example:

NAMES.DIRECTORY_PATH=(TNSNAMES)
SQLNET.AUTHENTICATION_SERVICES=(BEQ,TCPS)
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = /home/oracle/wallet_tls/server)
)
) 


#### 23.12.7 Step 6: Import the Client Wallet into the Microsoft Certificate Store

You must use the Microsoft Management Console (MMC) to perform this import operation. 

1. Start the MMC (`mmc.exe`).
2. Select File, then add/remove snap-in.
3. Select Certificates, then Add.
4. Select My user account, then Finish, and then OK.
5. Go to the Console Root, then Certificates Current User, then Personal, then Certificates.
6. Right-click All Tasks, then select Import, then Next, then Browse.
7. Select the certificate file that contains the certificate needed for the connection (for example, `ewallet.p12`).
8. Select Open, then Next.
9. Enter the wallet password.
10. Select the Mark this as exportable checkbox.
11. Select the Include all extended properties checkbox.
12. Select Place all certificates in the following store: Personal.
13. Select Next, then Finish.
14. Ensure that the client's certificate was added to the MY store, by going to Console Root, and then selecting Certificates Current User, then Personal, then Certificates.
15. Ensure that the CA certificates were added to the ROOT store by going to Console Root, and then selecting Certificates Current User, then Trusted Root Certification Authorities, then Certificates.

#### 23.12.8 Step 7: Configure the Client sqlnet.ora File

You must configure the client `sqlnet.ora` file to use Microsoft Certificate Store for the client wallet. 

1. Log in to the Oracle Database client.
2. Check the client side `sqlnet.ora` file.  
For example:

WALLET_LOCATION = (SOURCE = (METHOD=MCS)) 


#### 23.12.9 Step 8: Configure the Oracle Database

In the Oracle database, configure the `OS_AUTHENT_PRE` and `REMOTE_OS_AUTH` parameters.

1. Log in SQL\*Plus on the Oracle Database server as a user who has the `ALTER SYSTEM` system privilege.
2. Set the `OS_AUTHENT_PRE` and `REMOTE_OS_AUTH` parameters.

ALTER SYSTEM SET REMOTE_OS_AUTHENT=FALSE SCOPE=SPFILE;
ALTER SYSTEM SET OS_AUTHENT_PREFIX='' SCOPE=SPFILE; 

3. Restart the database instance.

#### 23.12.10 Step 9: Test the Client and Server Connection

After you complete the Microsoft Certificate Store configuration, you should test the and server connection.

1. To verify that the MCS is used for the TLS connection, enable the client trace by adding the following lines in the client's `sqlnet.ora` file.

trace_level_client=16
trace_directory_client=trace_directory
DIAG_ADR_ENABLED=OFF 

2. Make a connection to the server using SQL\*Plus and then ensure that the certificates are loaded successfully from MCS.

nztwOpenWallet: [enter]
nztwOpenWallet: WRL mcs:, type = 24
nztwOpenWallet: Loading the EXTKS provider for MCS type wallet
nztwOpenWallet: [exit] OK

```

23.13 Troubleshooting the Transport Layer Security Configuration

Common errors may occur while you use the Oracle Database SSL adapter.

It may be necessary to enable Oracle Net tracing to determine the cause of an error. For information about setting tracing parameters to enable Oracle Net tracing, refer to Oracle Database Net Services Administrator's Guide.

ORA-28759: Failure to Open File

Cause: The system could not open the specified file. Typically, this error occurs because the wallet cannot be found.

Action: Check the following:

ORA-28786: Decryption of Encrypted Private Key Failure

Cause: An incorrect password was used to decrypt an encrypted private key. Frequently, this happens because an auto-login wallet is not being used.

Action: Use Oracle Wallet Manager to turn the auto-login feature on for the wallet. Then save the wallet again. See Oracle Database Enterprise User Security Administrator's Guide

If the auto-login feature is not being used, then enter the correct password.

ORA-28858: SSL Protocol Error

Cause: This is a generic error that can occur during TLS handshake negotiation between two processes.

Action: Enable Oracle Net tracing and attempt the connection again to produce trace output. Then contact Oracle customer support with the trace output.

ORA-28859 SSL Negotiation Failure

Cause: An error occurred during the negotiation between two processes as part of the TLS protocol. This error can occur when two sides of the connection do not support a common cipher suite.

Action: Check the following:

ORA-28862: SSL Connection Failed

Cause: This error occurred because the peer closed the connection.

Action: Check the following:

ORA-28865: SSL Connection Closed

Cause: The TLS connection closed because of an error in the underlying transport layer, or because the peer process quit unexpectedly.

Action: Check the following:

ORA-28868: Peer Certificate Chain Check Failed

Cause: When the peer presented the certificate chain, it was checked and that check failed. This failure can be caused by a number of problems, including:

Action: See Oracle Database Enterprise User Security Administrator's Guide to use Oracle Wallet Manager to open your wallet and check the following:

ORA-28885: No certificate with the required key usage found.

Cause: Your certificate was not created with the appropriate X.509 version 3 key usage extension.

Action: Use Oracle Wallet Manager to check the certificate's key usage. See Oracle Database Enterprise User Security Administrator's Guide for information about key usage values.

ORA-29024: Certificate Validation Failure

Cause: The certificate sent by the other side could not be validated. This may occur if the certificate has expired, has been revoked, or is invalid for any other reason.

Action: Check the following:

ORA-29223: Cannot Create Certificate Chain

Cause: A certificate chain cannot be created with the existing trust points for the certificate being installed. Typically, this error is returned when the peer does not give the complete chain and you do not have the appropriate trust points to complete it.

Action: Use Oracle Wallet Manager to install the trust points that are required to complete the chain. See Oracle Database Enterprise User Security Administrator's Guide for details about importing a trusted certificate.

23.14 Certificate Validation with Certificate Revocation Lists

Oracle provides tools that enable you to validate certificates using certificate revocation lists.

23.14.1 About Certificate Validation with Certificate Revocation Lists

The process of determining whether a given certificate can be used in a given context is referred to as certificate validation.

Certificate validation includes determining that the following takes place:

The Transport Layer Security network layer automatically performs the first three validation checks, but you must configure certificate revocation list (CRL) checking to ensure that certificates have not been revoked. CRLs are signed data structures that contain a list of revoked certificates. They are usually issued and signed by the same entity who issued the original certificate.

23.14.2 What CRLs Should You Use?

You should have CRLs for all of the trust points that you honor.

The trust points are the trusted certificates from a third party identity that is qualified with a level of trust.

Typically, the certificate authorities you trust are called trust points.

23.14.3 How CRL Checking Works

Oracle Database checks the certificate revocation status against CRLs.

These CRLs are located in file system directories, Oracle Internet Directory, or downloaded from the location specified in the CRL Distribution Point (CRL DP) extension on the certificate.

Typically, CRL definitions are valid for a few days. If you store your CRLs on the local file system or in the directory, then you must update them regularly. If you use a CRL Distribution Point (CRL DP), then CRLs are downloaded each time a certificate is used, so there is no need to regularly refresh the CRLs.

The server searches for CRLs in the following locations in the order listed. When the system finds a CRL that matches the certificate CA's DN, it stops searching.

  1. Local file system
    The system checks the sqlnet.ora file for the SSL_CRL_FILE parameter first, followed by the SSL_CRL_PATH parameter. If these two parameters are not specified, then the system checks the wallet location for any CRLs.
    Note: if you store CRLs on your local file system, then you must use the orapki utility to periodically update them (for example, renaming CRLs with a hash value for certificate validation).
  2. Oracle Internet Directory
    If the server cannot locate the CRL on the local file system and directory connection information has been configured in an ldap.ora file, then the server searches in the directory. It searches the CRL subtree by using the CA's distinguished name (DN) and the DN of the CRL subtree.
    The server must have a properly configured ldap.ora file to search for CRLs in the directory. It cannot use the Domain Name System (DNS) discovery feature of Oracle Internet Directory. Also note that if you store CRLs in the directory, then you must use the orapki utility to periodically update them.
  3. CRL DP
    If the CA specifies a location in the CRL DP X.509, version 3, certificate extension when the certificate is issued, then the appropriate CRL that contains revocation information for that certificate is downloaded. Currently, Oracle Database supports downloading CRLs over LDAP.
    Note the following:
    • For performance reasons, only user certificates are checked.
    • Oracle recommends that you store CRLs in the directory rather than the local file system.

23.14.4 Configuring Certificate Validation with Certificate Revocation Lists

You can edit the sqlnet.ora file to configure certificate validation with certificate revocation lists.

23.14.4.1 About Configuring Certificate Validation with Certificate Revocation Lists

The SSL_CERT_REVOCATION parameter must be set to REQUIRED or REQUESTED in the sqlnet.ora file to enable certificate revocation status checking.

The SSL_CERT_REVOCATION parameter must be set to REQUIRED or REQUESTED in the sqlnet.ora file to enable certificate revocation status checking.

By default this parameter is set to NONE indicating that certificate revocation status checking is turned off.

Note:

If you want to store CRLs on your local file system or in Oracle Internet Directory, then you must use the command line utility, orapki, to rename CRLs in your file system or upload them to the directory.

23.14.4.2 Enabling Certificate Revocation Status Checking for the Client or Server

You can enable certificate the revocation status checking for a client or a server.

  1. Start Oracle Net Manager.
    • (UNIX) From $ORACLE_HOME /bin, enter the following command at the command line:
      netmgr
    • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.
  2. Expand Oracle Net Configuration, and from Local, select Profile.
  3. From the Naming list, select Network Security.
    The Network Security tabbed window appears.
  4. Select the SSL tab.
  5. Select one of the following options from the Revocation Check list:
    • Required: Requires certificate revocation status checking. The TLS connection is rejected if a certificate is revoked or no CRL is found. TLS connections are accepted only if it can be verified that the certificate has not been revoked.
    • Requested: Performs certificate revocation status checking if a CRL is available. The TLS connection is rejected if a certificate is revoked. TLS connections are accepted if no CRL is found or if the certificate has not been revoked.
      For performance reasons, only user certificates are checked for revocation.
  6. (Optional) If CRLs are stored on your local file system, then set one or both of the following fields that specify where they are stored. These fields are available only when Revocation Check is set to Required or REQUESTED.
    • Certificate Revocation Lists Path: Enter the path to the directory where CRLs are stored or click Browse to find it by searching the file system. Specifying this path sets the SSL_CRL_PATH parameter in the sqlnet.ora file. If a path is not specified for this parameter, then the default is the wallet directory. Both DER-encoded (binary format) and PEM-encoded (BASE64) CRLs are supported.
    • Certificate Revocation Lists File: Enter the path to a comprehensive CRL file (where PEM-encoded (BASE64) CRLs are concatenated in order of preference in one file) or click Browse to find it by searching the file system. Specifying this file sets the SSL_CRL_FILE parameter in the sqlnet.ora file. If this parameter is set, then the file must be present in the specified location, or else the application will error out during startup.
      If you want to store CRLs in a local file system directory by setting the Certificate Revocation Lists Path, then you must use the orapki utility to rename them so the system can locate them.
  7. (Optional) If CRLs are fetched from Oracle Internet Directory, then directory server and port information must be specified in an ldap.ora file.
    When configuring your ldap.ora file, you should specify only a non-TLS port for the directory. CRL download is done as part of the TLS protocol, and making a TLS connection within a TLS connection is not supported.
    Oracle Database CRL functionality will not work if the Oracle Internet Directory non-TLS port is disabled.
  8. Select File, Save Network Configuration. The sqlnet.ora file is updated.
23.14.4.3 Disabling Certificate Revocation Status Checking

You can disable certificate revocation status checking.

  1. Start Oracle Net Manager.
    • (UNIX) From $ORACLE_HOME /bin, enter the following command at the command line:
      netmgr
    • (Windows) Select Start, Programs, Oracle - HOME_NAME, Configuration and Migration Tools, then Net Manager.
  2. Expand Oracle Net Configuration, and from Local, select Profile.
  3. From the Naming list, select Network Security.
    The Network Security tabbed window appears.
  4. Select the SSL tab.
  5. Select NONE from the Revocation Check list.
  6. From the File menu, select Save Network Configuration.
    The sqlnet.ora file is updated with the following entry:
    SSL_CERT_REVOCATION=NONE

23.14.5 Certificate Revocation List Management

Certificate revocation list management entails ensuring that the CRLs are the correct format before you enable certificate revocation checking.

23.14.5.1 About Certificate Revocation List Management

Oracle Database provides a command-line utility, orapki, that you can use to manage certificates.

Before you can enable certificate revocation status checking, you must ensure that the CRLs you receive from the CAs you use are in a form (renamed with a hash value) or in a location (uploaded to the directory) where your computer can use them.

You can also use LDAP command-line tools to manage CRLs in Oracle Internet Directory.

Note:

CRLs must be updated at regular intervals (before they expire) for successful validation. You can automate this task by using orapki commands in a script

23.14.5.2 Displaying orapki Help for Commands That Manage CRLs

You can display all the orapki commands that are available for managing CRLs.

Note:

Using the -summary, -complete, or -wallet command options is always optional. A command will still run if these command options are not specified.

23.14.5.3 Renaming CRLs with a Hash Value for Certificate Validation

When the system validates a certificate, it must locate the CRL issued by the CA who created the certificate.

The system locates the appropriate CRL by matching the issuer name in the certificate with the issuer name in the CRL.

When you specify a CRL storage location for the Certificate Revocation Lists Path field in Oracle Net Manager, which sets the SSL_CRL_PATH parameter in the sqlnet.ora file, use the orapki utility to rename CRLs with a hash value that represents the issuer's name. Creating the hash value enables the server to load the CRLs.

On UNIX operating systems, orapki creates a symbolic link to the CRL. On Windows operating systems, it creates a copy of the CRL file. In either case, the symbolic link or the copy created by orapki are named with a hash value of the issuer's name. Then when the system validates a certificate, the same hash function is used to calculate the link (or copy) name so the appropriate CRL can be loaded.

In this specification, crl_filename is the name of the CRL file, wallet_location is the location of a wallet that contains the certificate of the CA that issued the CRL, and crl_directory is the directory where the CRL is located.

Using -wallet and -summary are optional. Specifying -wallet causes the tool to verify the validity of the CRL against the CA's certificate prior to renaming the CRL. Specifying the -summary option causes the tool to display the CRL issuer's name.

23.14.5.4 Uploading CRLs to Oracle Internet Directory

Publishing CRLs in the directory enables CRL validation throughout your enterprise, eliminating the need for individual applications to configure their own CRLs.

All applications can use the CRLs stored in the directory where they can be centrally managed, greatly reducing the administrative overhead of CRL management and use. The user who uploads CRLs to the directory by using orapki must be a member of the directory group CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%). This is a privileged operation because these CRLs are accessible to the entire enterprise. Contact your directory administrator to get added to this administrative directory group.

Using -wallet and -summary are optional. Specifying -wallet causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory. Specifying the -summary option causes the tool to print the CRL issuer's name and the LDAP entry where the CRL is stored in the directory.

The following example illustrates uploading a CRL with the orapki utility:

orapki crl upload -crl /home/user1/wallet/crldir/crl.txt -ldap host1.example.com:3533 -user cn=orcladmin

Note:

23.14.5.5 Listing CRLs Stored in Oracle Internet Directory

You can display a list of all CRLs stored in the directory with orapki, which is useful for browsing to locate a particular CRL to view or download to your local computer.

This command displays the CA who issued the CRL (Issuer) and its location (DN) in the CRL subtree of your directory.

23.14.5.6 Viewing CRLs in Oracle Internet Directory

Oracle Internet Directory CRLS are available in a summarized format; you also can request a listing of revoked certificates for a CRL.

You can view CRLs stored in Oracle Internet Directory in a summarized format or you can request a complete listing of revoked certificates for a CRL. A summary listing provides the CRL issuer's name and its validity period. A complete listing provides a list of all revoked certificates contained in the CRL.

23.14.5.7 Deleting CRLs from Oracle Internet Directory

The user who deletes CRLs from the directory by using orapki must be a member of the directory group CRLAdmins.

23.14.6 Troubleshooting CRL Certificate Validation

To determine whether certificates are being validated against CRLs, you can enable Oracle Net tracing.

When a revoked certificate is validated by using CRLs, then you will see the following entries in the Oracle Net tracing file without error messages logged between entry and exit:

nzcrlVCS_VerifyCRLSignature: entry nzcrlVCS_VerifyCRLSignature: exit

nzcrlVCD_VerifyCRLDate: entry nzcrlVCD_VerifyCRLDate: exit

nzcrlCCS_CheckCertStatus: entry nzcrlCCS_CheckCertStatus: Certificate is listed in CRL nzcrlCCS_CheckCertStatus: exit

Note:

Note that when certificate validation fails, the peer in the SSL handshake sees an ORA-29024: Certificate Validation Failure.

23.14.7 Oracle Net Tracing File Error Messages Associated with Certificate Validation

Oracle generates trace messages that are relevant to certificate validation.

These trace messages may be logged between the entry and exit entries in the Oracle Net tracing file. Oracle SSL looks for CRLs in multiple locations, so there may be multiple errors in the trace.

You can check the following list of possible error messages for information about how to resolve them.

CRL signature verification failed with RSA status

Cause: The CRL signature cannot be verified.

Action: Ensure that the downloaded CRL is issued by the peer's CA and that the CRL was not corrupted when it was downloaded. Note that the orapki utility verifies the CRL before renaming it with a hash value or before uploading it to the directory.

See Certificate Revocation List Management for information about using orapki for CRL management.

CRL date verification failed with RSA status

Cause: The current time is later than the time listed in the next update field. You should not see this error if CRL DP is used. The systems searches for the CRL in the following order:

  1. File system
  2. Oracle Internet Directory
  3. CRL DP

The first CRL found in this search may not be the latest.

Action: Update the CRL with the most recent copy.

CRL could not be found

Cause: The CRL could not be found at the configured locations. This will return error ORA-29024 if the configuration specifies that certificate validation is require.

Action: Ensure that the CRL locations specified in the configuration are correct by performing the following steps:

  1. Use Oracle Net Manager to check if the correct CRL location is configured. Refer to Configuring Certificate Validation with Certificate Revocation Lists
  2. If necessary, use the orapki utility to configure CRLs for system use as follows:

Oracle Internet Directory host name or port number not set

Cause: Oracle Internet Directory connection information is not set. Note that this is not a fatal error. The search continues with CRL DP.

Action: If you want to store the CRLs in Oracle Internet Directory, then use Oracle Net Configuration Assistant to create and configure an ldap.ora file for your Oracle home.

Fetch CRL from CRL DP: No CRLs found

Cause: The CRL could not be fetched by using the CRL Distribution Point (CRL DP). This happens if the certificate does not have a location specified in its CRL DP extension, or if the URL specified in the CRL DP extension is incorrect.

Action: Ensure that your certificate authority publishes the CRL to the URL that is specified in the certificate's CRL DP extension.

Manually download the CRL. Then depending on whether you want to store it on your local file system or in Oracle Internet Directory, perform the following steps:

If you want to store the CRL on your local file system:

  1. Use Oracle Net Manager to specify the path to the CRL directory or file. Refer to Configuring Certificate Validation with Certificate Revocation Lists
  2. Use the orapki utility to configure the CRL for system use. Refer to Renaming CRLs with a Hash Value for Certificate Validation

If you want to store the CRL in Oracle Internet Directory:

  1. Use Oracle Net Configuration Assistant to create and configure an ldap.ora file with directory connection information.
  2. Use the orapki utility to upload the CRL to the directory. Refer to Uploading CRLs to Oracle Internet Directory

23.15 Configuring Your System to Use Hardware Security Modules

Oracle Database supports hardware security modules that use APIs that conform to the RSA Security, Inc., PKCS #11 specification.

Typically, these hardware devices are used to securely store and manage private keys in tokens or smart cards, or to accelerate cryptographic processing.

23.15.1 General Guidelines for Using Hardware Security Modules for TLS

Oracle provides a set of guidelines to follow if you are using a hardware security module with Oracle Database.

  1. Contact your hardware device vendor to obtain the necessary hardware, software, and PKCS #11 libraries.
  2. Install the hardware, software, and libraries where appropriate for the hardware security module you are using.
  3. Test your hardware security module installation to ensure that it is operating correctly. Refer to your device documentation for instructions.
  4. Create a wallet of the type PKCS11 by using Oracle Wallet Manager and specify the absolute path to the PKCS #11 library (including the library name) if you wish to store the private key in the token. Oracle PKCS11 wallets contain information that points to the token for private key access.

You can use the wallet containing PKCS #11 information just as you would use any Oracle wallet, except the private keys are stored on the hardware device and the cryptographic operations are performed on the device as well.

23.15.2 Configuring Your System to Use nCipher Hardware Security Modules

You can configure your system to use nCipher hardware security modules for cryptographic processing.

23.15.2.1 About Configuring Your System to Use nCipher Hardware Security Modules

Hardware security modules made by nCipher Corporation are certified to operate with Oracle Database.

These modules provide a secure way to store keys and off-load cryptographic processing. Primarily, these devices provide the following benefits:

Note:

You must contact your nCipher representative to obtain certified hardware and software to use with Oracle Database.

23.15.2.2 Oracle Components Required To Use an nCipher Hardware Security Module

To use an nCipher hardware security module, you must have a special set of components.

These components are as follows:

Note:

You must contact your nCipher representative to have the hardware security module or the secure accelerator installed, and to acquire the necessary library.

These tasks must be performed before you can use an nCipher hardware security module with Oracle Database.

23.15.2.3 Directory Path Requirements for Installing an nCipher Hardware Security Module

The nCipher hardware security module uses the nCipher PKCS #11 library.

To use the secure accelerator, you must provide the absolute path to the directory that contains the nCipher PKCS #11 library (including the library name) when you create the wallet by using Oracle Wallet Manager. This enables the library to be loaded at runtime.

Typically, the nCipher card is installed at the following locations:

The nCipher PKCS #11 library is located at the following location for typical installations:

Note:

Use the 32-bit library version when using the 32-bit release of Oracle Database and use the 64-bit library version when using the 64-bit release of Oracle Database. For example, use the 64-bit nCipher PKCS #11 library for the Oracle Database for Solaris Operating System (SPARC 64-bit).

23.15.3 Configuring Your System to Use SafeNET Hardware Security Modules

You can configure your system to use SafeNET hardware security modules for cryptographic processing.

23.15.3.1 About Configuring Your System to Use SafeNET Hardware Security Modules

Hardware security modules made by SafeNET Incorporated are certified to operate with Oracle Database.

These modules provide a secure way to store keys and off-load cryptographic processing. Primarily, these devices provide the following benefits:

Note:

You must contact your SafeNET representative to obtain certified hardware and software to use with Oracle Database.

23.15.3.2 Oracle Components Required for SafeNET Luna SA Hardware Security Modules

To use a SafeNET Luna SA hardware security module, you must have a special set of components.

These components are as follows:

Note:

You must contact your SafeNET representative to have the hardware security module or the secure accelerator installed, and to acquire the necessary library.

These tasks must be performed before you can use a SafeNET hardware security module with Oracle Database.

23.15.3.3 Directory Path Requirements for Installing a SafeNET Hardware Security Module

The SafeNET hardware security module uses the SafeNET PKCS #11 library.

To use the secure accelerator, you must provide the absolute path to the directory that contains the SafeNET PKCS #11 library (including the library name) when you create the wallet using Oracle Wallet Manager. This enables the library to be loaded at runtime.

Typically, the SafeNET Luna SA client is installed at the following location:

The SafeNET Luna SA PKCS #11 library is located at the following location for typical installations:

23.15.4 Troubleshooting Using Hardware Security Modules

Oracle provides troubleshooting advice for hardware security modules.

23.15.4.1 Errors in the Oracle Net Trace Files

To detect whether the module is being used, you can turn on Oracle Net tracing.

If the wallet contains PKCS #11 information and the private key on the module is being used, then you will see the following entries in the Oracle Net tracing file without error messages logged between entry and exit:

nzpkcs11_Init: entry nzpkcs11CP_ChangeProviders: entry nzpkcs11CP_ChangeProviders: exit nzpkcs11GPK_GetPrivateKey: entry nzpkcs11GPK_GetPrivateKey: exit nzpkcs11_Init: exit ... nzpkcs11_Decrypt: entry nzpkcs11_Decrypt: exit

nzpkcs11_Sign: entry nzpkcs11_Sign: exit

23.15.4.2 Error Messages Associated with Using Hardware Security Modules

Errors that are associated with using PKCS #11 hardware security modules can appear.

ORA-43000: PKCS11: library not found

Cause: The system cannot locate the PKCS #11 library at the location specified when the wallet was created. This happens only when the library is moved after the wallet is created.

Action: Copy the PKCS #11 library back to its original location where it was when the wallet was created.

ORA-43001: PKCS11: token not found

Cause: The smart card that was used to create the wallet is not present in the hardware security module slot.

Action: Ensure that the smart card that was used when the wallet was created is present in the hardware security module slot.

ORA-43002: PKCS11: passphrase is wrong

Cause: This can occur when an incorrect password is specified at wallet creation, or the PKCS #11 device password is changed after the wallet is created and not updated in the wallet by using Oracle Wallet Manager.

Action: Depending on the cause, take one of the following actions:

If you see this error during wallet creation, then check to ensure that you have the correct password and reenter it.

If the password changed after wallet creation, then use Oracle Wallet Manager to open the wallet and enter a new password.

Note:

The nCipher log file is in the directory where the module is installed at the following location:

/log/logfile

See Also:

nCipher and SafeNET documentation for more information about troubleshooting nCipher and SafeNET devices