Configuring TLS Connection With a Client Wallet

A client wallet is sometimes required when configuring TLS with a public or self-signed CA trust certificate.

A client wallet for a TLS connection includes the trust certificate for the certificate authority that signed the database server certificate. Only the root of trust certificate is required. Intermediate certificates are not required.

Using a client wallet is required if you cannot use the system’s default certificate store.

Create the client wallet.

orapki wallet create -wallet <wallet_location> -pwd <wallet_password> -auto_login

Get the CA trusted certificate. This may already be available in a file or you may need to export it from the root certificate wallet or a database server wallet.
```
orapki wallet export -wallet <wallet_location> -dn <certificate_dn> -cert <certificate_filename>
```
For more information see orapki Utility Commands Summary.

Add the CA trusted certificate into the client wallet.

orapki wallet add -wallet <wallet_location> -trusted_cert -cert <certificate_filename>

Move or copy the client wallet to the desired location.
Update sqlnet.ora to add WALLET_LOCATION for the client wallet.

This will be used by all client connections unless this is overridden by the connect string parameter WALLET_LOCATION. When WALLET_LOCATION is not set in sqlnet.ora or the connect string, then the client will check the system’s default certificate store.
```
WALLET_LOCATION=
    (SOURCE=
        (METHOD=file)
        (METHOD_DATA=
            (DIRECTORY=/etc/oracle/wallets/databases)))
```
See WALLET_LOCATION in the Oracle Database Net Services Reference guide for more information.

(Optional) Set SSL_CLIENT_AUTHENTICATON for the Client

If you have a client-side user certificate, but don’t want to use it for mTLS, then you must complete this step.
If you don’t have a client-side user certificate, you can skip this step as the client will go ahead and make a one-way TLS connection regardless of this parameter setting.

Log in to the client for the Oracle database.
Set SSL_CLIENT_AUTHENTICATION in the sqlnet.ora file to FALSE.
```
SSL_CLIENT_AUTHENTICATION=FALSE
```
Setting this parameter in sqlnet.ora to FALSE, will block sending a client side user certificate for all the connections. You can override this for a particular connection by setting SSL_CLIENT_AUTHENTICATION=TRUE in the connection string in tnsnames.ora so that connection will use the client-side user certificate.

The connection string parameter will take precedence over the sqlnet.ora parameter setting. This setting is optional and only required if you have a client-side user certificate and you don’t want to use it for an mTLS connection.
In order to preserve existing mTLS connections that use the client-side wallet and user certificate and also to establish one-way TLS connection without using the user certificate, set SSL_CLIENT_AUTHENTICATION=TRUE, which is the default setting, in sqlnet.ora. Then for every connection that you want to use without a client-side user wallet, add SSL_CLIENT_AUTHENTICATION=FALSE in the connect string.

Connect to the database

Connect to the database using the connection name with the tcps protocol.

sqlplus <user_name>@<PDB_name>

Verify the connection

Run the following command:
```
select sys_context ('userenv','NETWORK_PROTOCOL') from dual;
```
This will show ‘tcps’ if TLS is enabled and ‘tcp’ if TLS is not enabled.
Run the following command:
```
select sys_context ('userenv','TLS_VERSION') from dual;
```
This will show the TLS protocol for the connection ending at the database server.
Run the following command:
```
select sys_context ('userenv','TLS_CIPHERSUITE') from dual;
```
This will show the TLS ciphersuite for the connection ending at the database server.