Resolving HFM SSL/TLS Connection Failures on Oracle Linux 9

Issue:

Whenever using SSL/TLS-enabled Database server for Oracle Hyperion Financial Management (HFM) schema/connections on Oracle Linux 9 (OEL 9).

Problem Summary:

OEL9 is being shipped with openssl3 version of libcrypto (libcrypto.so.3) usually located under /lib64/libcrypto.so.3.ODBC drivers shipped with HFM are using a different version of libssl.so library. This is a mismatched pair and would throw a SQL exception while connecting to a SSL/TLS-enabled database server.

Workaround:

To setup the HFM Linux SSL deployment, perform the following steps:

  1. Log in to the HFM server as the EPM installation user.

  2. Edit the HFM startup script:<EPM_ORACLE_HOME>/products/FinancialManagement/Server/startHsxServer.sh

  3. Add these environment variables before the command that starts the HFM server process:

    • export INSTHOME=$EPM_ORACLE_HOME/products/FinancialManagement
    • export ODBCSYSINI=$INSTHOME/Server/ODBC
    • export ODBCINI=$ODBCSYSINI/odbc.ini
    • export ODBCINSTINI=$ODBCSYSINI/odbcinst.ini
    • export TNS_ADMIN=<path_to_SSL_database_wallet>
    • export LD_LIBRARY_PATH=$INSTHOME/Server:$ODBCSYSINI/lib
    • export LD_PRELOAD=$ODBCSYSINI/lib/libcrypto.so:$ODBCSYSINI/lib/libssl.soexport LD_BIND_NOW=1

  4. Replace <path_to_SSL_database_wallet> with the directory that contains the SSL database wallet and tnsnames.ora.

  5. Save the script and restart the HFM services.

  6. Verify that an HFM application can be created and opened from Consolidation Administration.