Certificates

Learn about different certificates in Oracle DBSecCentral.

Platform Certificates

Learn all about Oracle DBSecCentral platform certificates.

Oracle DBSecCentral uses platform certificates for internal communication by various services.

Oracle DBSecCentral provides the ability to renew platform certificates for Audit Vault Server and Database Firewall appliances before they expire. If the expiry period is less than 90 days, a warning message (ODF 10729) is displayed in the /var/log/messages file. See the action column against ODF 10729 in the section Database Firewall Messages for detailed procedure for renewing the certificates manually.

If the certificates are not renewed manually and if they are about to expire in less than 30 days, then the platform certificates are automatically renewed and all the relevant services are restarted.

Rotating Audit Vault Agent Certificates

Learn how to rotate Audit Vault Agent certificates.

Audit Vault Agent uses certificates for internal communication with various components and services. The duration of the Audit Vault Agent Certificate Validity is 10 years for Oracle DBSecCentral.

Follow these steps to rotate the Audit Vault Agent certificates.

Tip: If you have received a system alert that the certificate of your Audit Vault Agent is about to expire, you can skip to Step 4: Rotate the Audit Vault Agent Certificates.

About Audit Vault Agent Certificates

Learn about Audit Vault Agent certificates.

Audit Vault Agent certificates are used for communication between the Agent and Audit Vault Server. These Audit Vault Agent certificates have to be rotated or renewed for uninterrupted Oracle DBSecCentral services.

Certificates in Oracle DBSecCentral can be renewed manually.

After the Audit Vault Agent certificates are rotated or renewed, they are valid for a period of 27 months across all releases.

Note: The certificate rotation or renewal is applicable to Audit Vault Agent and Host Monitor Agent.

Rotate the Audit Vault Agent Certificates

If the agent certificates are already expired or will expire within the next 30 days, then you need to rotate the agent certificates. You need to follow these steps to rotate the Audit Vault Agent Certificates:

Ensure that all components of your Oracle DBSecCentral system, Audit Vault Server(s), Audit Vault Agent(s), and Database Firewall(s), are up prior to performing certificate rotation. If certificates are rotated while a component is down, the component may not work the next time it is brought back up.

Log in to Oracle Database Security Central Console as a super administrator.
Select Settings.
In the Security section, select Certificates.
Select Rotate Certificates.
Select either Rotate CA Certificates to rotate all certificate authorities (CA) and service certificates or Rotate Service Certificates to only rotate the service certificates on the following:
- The primary Audit Vault Server, including the UI certificate if it is not externally signed.
  
  The SSO certificate will not be rotated as this must be done manually. See Rotating the Audit Vault Server SSO Certificate for more information.
- The secondary Audit Vault Server, if set up in a high availability environment
- Any registered Audit Vault Agents
- Any registered Database Firewalls
Note: If the certificate authority is rotated, it will invalidate the certificates that have been signed by the Database Firewall certificate authority. Therefore, TLS proxy certificates should be signed externally by an appropriate certificate authority. See Creating TLS Proxy Certificates for Database Firewall for more information.
Select OK to confirm certificate rotation.

While the certificates are being rotated the UI may be unavailable for some time.

Rotating Audit Vault Server Certificates

Learn how to rotate Audit Vault Server certificates.

Audit Vault Server uses certificates for internal communication with various components and services. Oracle DBSecCentral enables you to rotate Audit Vault Server certificates before they expire.

If certificates have expired, you will have to manually rotate certificates through the steps for Oracle DBSecCentral.

Log in to Oracle Database Security Central Console as a super administrator.
Select Settings.
In the Security section, select Certificates.
Select Rotate Certificates.
Select either Rotate CA Certificates to rotate all certificate authorities (CA) and service certificates or Rotate Service Certificates to only rotate the service certificates on the following:
- The primary Audit Vault Server, including the UI certificate if it is not externally signed.
  
  The SSO certificate will not be rotated as this must be done manually. See Rotating the Audit Vault Server SSO Certificate for more information.
- The secondary Audit Vault Server, if set up in a high availability environment
- Any registered Audit Vault Agents
- Any registered Database Firewalls
Note: If the certificate authority is rotated, it will invalidate the certificates that have been signed by the Database Firewall certificate authority. Therefore, TLS proxy certificates should be signed externally by an appropriate certificate authority. See Creating TLS Proxy Certificates for Database Firewall for more information.
Select OK to confirm certificate rotation.

While the certificates are being rotated the UI may be unavailable for some time.

Rotating Database Firewall Certificates

Learn how to rotate Database Firewall certificates.

Database Firewall uses certificates for internal communication with various components and services. Oracle DBSecCentral enables you to rotate Database Firewall certificates before they expire.

Note: Rotate certificates for each Database Firewall instance including those paired for high availability.

If certificates have expired, you will have to manually rotate certificates through the steps for Oracle DBSecCentral.

Log in to Oracle Database Security Central Console as a super administrator.
Select Settings.
In the Security section, select Certificates.
Select Rotate Certificates.
Select either Rotate CA Certificates to rotate all certificate authorities (CA) and service certificates or Rotate Service Certificates to only rotate the service certificates on the following:
- The primary Audit Vault Server, including the UI certificate if it is not externally signed.
  
  The SSO certificate will not be rotated as this must be done manually. See Rotating the Audit Vault Server SSO Certificate for more information.
- The secondary Audit Vault Server, if set up in a high availability environment
- Any registered Audit Vault Agents
- Any registered Database Firewalls
Note: If the certificate authority is rotated, it will invalidate the certificates that have been signed by the Database Firewall certificate authority. Therefore, TLS proxy certificates should be signed externally by an appropriate certificate authority. See Creating TLS Proxy Certificates for Database Firewall for more information.
Select OK to confirm certificate rotation.

While the certificates are being rotated the UI may be unavailable for some time.

Rotating the Audit Vault Server SSO Certificate

You can configure single sign-on (SSO) for Oracle Database Security Central console users. Learn how to rotate the SSO key and certificate.

Rotation of the SSO certificate must be done manually as it does not rotate through the functionality available in the Rotate Certificates of the Audit Vault Server.

Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Go to the /usr/local/dbfw/etc directory:
```
cd /usr/local/dbfw/etc
```

Create a backup directory and move the current Apex SAML key and certificate files there.

mkdir apexsaml_backup
mv apexsaml.key ./apexsaml_backup
mv apexsaml.crt ./apexsaml_backup

Generate the Apex SAML key and certificate:

/usr/local/dbfw/etc/privileged-migrations/gen_saml_apex_cert.sh

/usr/local/dbfw/etc/privileged-migrations/register_apex_key_cert.py

Test the SSO configuration by logging in to the Oracle Database Security Central console.

See Logging In to Oracle DBSecCentral Appliances Through SSO for more information.
Remove the backup directory for Apex SAML key and certificate if the SSO connection testing is working fine:
```
rm -r /usr/local/dbfw/etc/apexsmal_backup
```
If your identity provider requires the Audit Vault Server SSO certificate, update the identity provider configuration with the new SSO certificate.
If configured in high availability, copy the /usr/local/dbfw/etc/apexsaml.key and /usr/local/dbfw/etc/apexsaml.crt to the standby Audit Vault Server.

Related Topics

Configuring Single Sign-On (SSO) for Oracle Database Security Central console Users

Creating TLS Proxy Certificates for Database Firewall

Learn how to create and upload TLS proxy certificates for Database Firewall.

Oracle Database Security Central (Oracle DBSecCentral) supports managing TLS proxy certificates for Database Firewall from the Oracle Database Security Central console.

Database Firewall uses certificates for inbound (database client to Database Firewall) and outbound (Database Firewall to target database) TLS connections. You can create and manage certificates for both inbound and outbound TLS connections through the Oracle Database Security Central console.

Note:

This functionality is available to Oracle Database versions that are supported by Oracle DBSecCentral.
This functionality is applicable to Database Firewall instances that are deployed in Monitoring / Blocking (Proxy) mode only.
When using Database Firewall as a TLS proxy, password-based user authorization with the database is supported. Certificate-based authorization and third-party user authorization (RADIUS, Kerberos, LDAP, and so on) with the database are not supported.

The following types of certificate signing methods are supported:

Certificates that are signed by the Database Firewall certificate authority (CA)

You can use out-of-the-box certificates that are signed by the Database Firewall CA for inbound and outbound TLS connections. Oracle strongly recommends that you use third-party, externally signed certificates for production deployments.

You can choose this option when configuring monitoring points for a target database.
Certificates that are signed by an external CA

To use a certificate that is signed by an external CA, create a certificate signing request (CSR) with the relevant information, download it, get the certificate signed, and upload it using the Oracle Database Security Central console.

After you upload the certificate, you can use it when configuring monitoring points for a target database.

Follow these steps to generate a CSR, download the CSR, and upload the duly signed certificate to the Database Firewall:

Log in to the Oracle Database Security Central console as a super administrator.
Select Settings.
Select Security in the left navigation menu.

Only super administrators can see the subtabs and settings on the main page of the Security.
Select Certificate on the main page.
Select Database Firewall.
Select Generate CSR .

The Generate Certificate Signing Request (CSR) dialog box appears.
Select the specific Database Firewall instance from the drop-down list.
Enter a common name.
Enter the organization name for the certificate.
Select the country or region.
(Optional) Complete the following fields:
- Organizational Unit
- State/Province
- City
- Email
Select Create to submit the CSR.
Select Download CSR and save the certificate to the local machine.
Get the certificate duly signed by a CA.
After the CA approves the certificate, select Upload Certificate.

The Upload Certificate dialog box appears.
Select the file from the local machine.
Select Upload.
Use the newly uploaded certificate when configuring monitoring points for a target database.

See Modifying a Database Firewall Monitoring Point for complete instructions.

Viewing Certificate Details

In the Oracle Database Security Central console, you can view the details for each TLS proxy certificate, including the status, start and end dates, expiry time, common name, and so on.

Log in to the Oracle Database Security Central console as a super administrator.
Select Settings.
Select Security in the left navigation menu.
Select Certificate on the main page.
Select Database Firewall.

Rotating Certificates

You can also rotate the TLS proxy certificates for Database Firewall.

For Database Firewall CA signed certificates, rotating creates new certificates and assigns them to the same monitoring points.

For externally signed CA certificates, rotating creates a new CSR using the previously configured values. You need to download the certificate and follow the same procedure that you followed to create it, get it signed, and upload it.