Configuring TCPS Connections for DBCS Instances

Learn how to configure TCPS connections for DBCS instances.

Step 1: Creating Server Wallet and Certificate

This configuration step shows you how to create server wallets and certificates.

  1. Ensure that port 1522 is open on the DBCS instance for TCPS connection. .

    See Opening Ports on Oracle Database Cloud Service for detailed information. Later some standard tools such as SQLPlus and SQLDeveloper can be used

  2. Create a new auto-login wallet by executing the orapki utility.

    mkdir -p <wallet path>

    orapki wallet create -wallet <wallet path> -auto_login

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    orapki wallet create -wallet /u01/app/example/demowallet -auto_login

  3. Create a self-signed certificate and load it into the wallet, by executing the command:

    orapki wallet add -wallet <wallet path> -dn

    Note: This command will prompt you to enter and re-enter a wallet password.

    CN=hostname -keysize 1024 -self_signed -validity 365

    Example:

    orapki wallet add -wallet /u01/app/example/demowallet -dn

    CN=CloudAB2.abcdXY.example.somedomain -keysize 1024 -self_signed -validity 365

  4. Check the contents of the wallet by executing the following command:

    orapki wallet display -wallet <wallet path>

    Result:

    Displays the self-signed certificate which is both a user and trusted certificate.

    Requested Certificates:
User Certificates:
Subject:          CN=<hostname>
Trusted Certificates:
Subject:          CN=<hostname>

    Example:

    orapki wallet display -wallet /u01/app/example/demowallet

    Result:

    Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:
User Certificates:
Subject:         CN=CloudAB2.abcdXY.example.somedomain
Trusted Certificates:
Subject:         CN=CloudAB2.abcdXY.example.somedomain

  5. Export the certificate to the client wallet for future use, by executing the command:

    orapki wallet export -wallet <wallet path> -dn CN=hostname

    Note: This command will prompt you to enter and re-enter a wallet password.

    -cert <certificate file name>.crt

    Example:

    orapki wallet export -wallet /u01/app/example/demowallet -dn

    CN=CloudAB2.abcdXY.example.somedomain -cert CloudAB2-certificate.crt

  6. Check that the certificate has been exported as expected, by executing the command:

    cat <certificate file name>.crt

    Example:

    cat CloudAB2-certificate.crt

    Result:

    -----BEGIN CERTIFICATE-----
MIIB0TCCAToCAQAwDQYJKoZIhvcNAQEEBQAwMTEvMC0GA1UEAxMmQ2xvdWRTVDIuZGViZGV2MTku
b3JhY2xlY2xvdWQuaW50ZXJuYWwwHhcNMTYwNTExMTEyMDI2WhcNMjYwNTA5MTEyMDI2WjAxMS8w
LQYDVQQDEyZDbG91ZFNUMi5kZWJkZXYxOS5vcmFjbGVjbG91ZC5pbnRlcm5hbDCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEAr6fhuQly2t3i8gugLVzgP2kFGVXVOzqbggEIC+Qazb15JuKs0ntk
En9ERGvA0fxHkAkCtIPjCzQD5WYRU9C8AQQOWe7UFHae7PsQX8jsmEtecpr5Wkq3818+26qU3Jyi
XxxK/rRydwBO526G5Tn5XPsovaw/PYJxF/fIKMG7fzMCAwEAATANBgkqhkiG9w0BAQQFAAOBgQCu
fBYJj4wQYriZIfjij4eac/jnO85EifF3L3DU8qCHJxOxRgK97GJzD73TiY20xpzQjWKougX73YKV
Tp9yusAx/T/qXbpAD9JKyHlKj16wPeeMcS06pmDDXtJ2CYqOUwMIk53cK7mLaAHCbYGGM6btqP4V
KYIjP48GrsQ5MOqd0w==

-----END CERTIFICATE-----

Step 2: Creating Client (Agent) Wallet and Certificate

This configuration step explains how to create client wallets and certificates.

  1. Run the following command to create a new auto-login wallet:

    c:>mkdir -p <client wallet dir>
    c:>orapki wallet create -wallet "<wallet path>" -auto_login

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    C:\Work\CloudWallet>orapki wallet create -wallet C:\Work\CloudWallet -auto_login

    Result:

        Oracle PKI Tool : Version 12.1.0.1
    Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

  2. Run the following command to create a self-signed certificate and load it into the wallet:

    c:>orapki wallet add -wallet <client wallet path> -dn

    Note: This command will prompt you to enter and re-enter a wallet password.

    CN=%client computer name% -keysize 1024 -self_signed -validity 365

    Example:

    C:\Work\CloudWallet>orapki wallet add -wallet C:\Work\CloudWallet -dn
    CN=machine1.somedomain.com -keysize 1024 -self_signed -validity 365

    Result:

    Oracle PKI Tool : Version 12.1.0.1
Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

  3. Check the contents of the wallet by running the command:

    orapki wallet display -wallet <client wallet path>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    C:\Work\CloudWallet>orapki wallet display -wallet C:\Work\CloudWallet

    Result:

    Oracle PKI Tool : Version 12.1.0.1
Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:
User Certificates:
Subject:       CN=machine1.subdomain.example.com
Trusted Certificates:
Subject:       OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:       CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US
Subject:       OU=Class 2 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:       OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:       CN=machine1.subdomain.example.com

  4. Run the following command to export the certificate and load it onto the server:

    orapki wallet export -wallet <client wallet path> -dn

    Note: This command will prompt you to enter and re-enter a wallet password.

    CN=<client computer name> -cert <clent computer name>-certificate.crt

    Example:

    C:\Work\CloudWallet>orapki wallet export -wallet C:\Work\CloudWallet -dn
    CN=machine1.somedomain.example.com -cert machine1-certificate.crt

    Result:

    Oracle PKI Tool : Version 12.1.0.1
Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

  5. Check the certificate by running the command:

    more c:\%computername%-certificate.crt

    Example:

    C:\Work\CloudWallet>more machine1-certificate.crt

    Result:

    -----BEGIN CERTIFICATE-----
MIIBsTCCARoCAQAwDQYJKoZIhvcNAQEEBQAwITEfMB0GA1UEAxMWZ2JyMzAxMzkudWsub3JhY2xl
LmNvbTAeFw0xNjA1MTExMTQzMzFaFw0yNjA1MDkxMTQzMzFaMCExHzAdBgNVBAMTFmdicjMwMTM5
LnVrLm9yYWNsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKH8G8sFS6l0llu+RMfl
7Yt+Ppw8J0PfDEDbTGP5wtsrs/22dUCipU9l+vif1VgSPLE2UPJbGM8tQzTC6UYbBtWHe4CshmvD
EVlcIMsEFvD7a5Q+P45jqNSEtV9VdbGyxaD6i5Y/Smd+B87FcQQCX54LaI9BJ8SZwmPXgDweADLf
AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAai742jfNYYTKMq2xxRygGJGn1LhpFenHvuHLBvnTup1N
nZOBwBi4VxW3CImvwONYcCEFp3E1SRswS5evlfIfruCZ1xQBoUNei3EJ6O3OdKeRRp2E+muXEtfe
U+jwUE+SzpnzfpI23Okl2vo8Q7VHrSalxE2KEhAzC1UYX7ZYp1U=

-----END CERTIFICATE-----

Step 3: Exchanging Client (Agent) and Server Certificates

This configuration step explains how to exchange client (agent) and server certificates.

  1. Exchange client (agent) and server certificates. Each side of the connection has to trust the other. Hence ensure to load the certificate from the server as a trusted certificate into the client wallet and vice versa. Load the server certificate into the client wallet by executing the command:

    orapki wallet add -wallet <client wallet path> -trusted_cert -cert <server certificate path>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    C:\Work\CloudWallet>orapki wallet add -wallet C:\Work\CloudWallet -trusted_cert -cert C:\Work\CloudWallet\CloudAB2-certificate.crt

    Result:

    Oracle PKI Tool : Version 12.1.0.1

    Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

  2. Check the contents of the client wallet by executing the command:

    orapki wallet display -wallet <client wallet path>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    C:\Work\CloudWallet>orapki wallet display -wallet C:\Work\CloudWallet

    Notice the self-signed certificate is a trusted user certificate.

    Result:

    Oracle PKI Tool : Version 12.1.0.1
Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:
User Certificates:
Subject:       CN=machine1.subdomain.example.com
Trusted Certificates:
Subject:        OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:        CN=machine1.subdomain.example.com
Subject:        CN=GTE CyberTrust Global Root,OU=MNO CyberTrust Solutions\, Inc.,O=MNO Corporation,C=US
Subject:        CN=CloudAB2.abcxy10.example.somedomain
Subject:        OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:        OU=Class 2 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  3. Load the client certificate into server by executing the command:

    orapki wallet add -wallet <server wallet path> -trusted_cert -cert <client certificate file>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    orapki wallet add -wallet /u01/app/example/demowallet -trusted_cert -cert machine1-certificate.crt

    Result:

    Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

  4. Check the contents of the client wallet by executing the command:

    orapki wallet display -wallet <client wallet path>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    C:\Work\CloudWallet>orapki wallet display -wallet C:\Work\CloudWallet

    The server certificate is now included in the list of trusted certificates.

    Result:

    Oracle PKI Tool : Version 12.1.0.1
Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:
User Certificates:
Subject:        CN=machine1.subdomain.example.com
Trusted Certificates:
Subject:        OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:        CN=machine1.subdomain.example.com
Subject:        CN=GTE CyberTrust Global Root,OU=MNO CyberTrust Solutions\, Inc.,O=MNO Corporation,C=US
Subject:        CN=CloudAB2.abcdXY.example.somedomain
Subject:        OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:        OU=Class 2 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  5. Load the client certificate into server by executing the command:

    orapki wallet add -wallet <server wallet path> -trusted_cert -cert <client certificate file>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    orapki wallet add -wallet /u01/app/example/demowallet -trusted_cert -cert machine1-certificate.crt

    Result:

        Oracle PKI Tool : Version 12.1.0.2
    Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

  6. Check the contents of the server wallet by executing the command:

    orapki wallet display -wallet <wallet path>

    Note: This command will prompt you to enter and re-enter a wallet password.

    Example:

    orapki wallet display -wallet /u01/app/example/demowallet

    Result:

    Oracle PKI Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:
User Certificates:
Subject:        CN=CloudAB2.abcdXY.example.somedomain
Trusted Certificates:
Subject:        CN=CloudAB2.abcdXY.example.somedomain
Subject:        CN=machine1.subdomain.example.com

Step 4: Configuring Server Network

This step explains how to configure the server network.

Data security between an Audit Vault Server and an Oracle Database target is achieved by default, through network encryption over TCP connection. Data security can also be achieved by using a TCPS/SSL connection.

  1. Configure the server network. Add the following entries on the server and into the $ORACLE_HOME/network/admin/sqlnet.ora file:

    orapki wallet add -wallet <client wallet path> -trusted_cert -cert <server certificate path>

    Note: This command will prompt you to enter and re-enter a wallet password.

    WALLET_LOCATION =
   (SOURCE =
     (METHOD = FILE)
     (METHOD_DATA =
       (DIRECTORY = /u01/app/oracle/demowallet)
     )
   )

SQLNET.AUTHENTICATION_SERVICES = (TCPS,TCP,NTS,BEQ)
SSL_CLIENT_AUTHENTICATION = TRUE

SQLNET.ENCRYPTION_SERVER = ACCEPTED/REQUESTED/REJECTED
SQLNET.CRYPTO_CHECKSUM_SERVER = ACCEPTED/REQUESTED/REJECTED

    Note: The server encryption is set to `REQUIRED` on the DBCS instance and on-premises by default. Set the server encryption to `ACCEPTED` or `REQUESTED` or `REJECTED`. `REJECTED` is not a recommended option. The following table describes these options in detail.

  2. Configure the listener to accept SSL or TLS encrypted connections. Edit the $ORACLE_HOME/network/admin/listener.ora file. Add the wallet information and the TCPS entry. Set the values as follows, using the directory location that you specified for your environment:

    SSL_CLIENT_AUTHENTICATION = TRUE

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /u01/app/oracle/demowallet)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = <host name>.localdomain)(PORT = 1521))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = <host name>.localdomain)(PORT = 1522))
    )
  )

  3. Restart the listener by executing the following commands:

    $ lsnrctl stop

    Example:

    $ lsnrctl start

Step 5: Connecting to DBCS instances in TCPS mode

To connect Oracle Database Cloud Service instances with TCPS follow these steps:

  1. Enable port 1522 on the cloud service.

  2. Configure TCPS connection for the DBCS instance once port 1522 has been opened.

  3. Create the server wallet and certificate.

  4. Create client (agent) wallet and certificate.

  5. Exchange the client (agent) and server certificates.

  6. Configure the server network.

  7. Connect to the DBCS instance through TCPS using the Audit Vault agent or tools like SQLPlus** or **SQLDeveloper.

    See Also: