Enabling Distinguished Name (DN) Matching

DN matching allows a connection to the Oracle Database server when the server certificate name or DN matches what the client expects.

Tip: Oracle strongly recommends using either partial or full DN matching so the client connects to the correct host.

When DN matching is enabled, the database server certificate will be checked against the certificate expected by the client. Without using DN matching, any server certificate signed by the same or valid public CA will be accepted by the client to establish the TLS session.

The search order on the client side is as follows: first, the client sqlnet.ora or connect string host name value is compared against the certificate CN, then the list of names in the subject alternative name (SAN) field. Then the client sqlnet.ora or connect string service_name value is compared against the CN and the list of names in the SAN.

It is recommended to first successfully configure TLS in a test environment prior to setting up DN matching. See Configuring TLS Using a Public Certificate Authority Root of Trust for the Database Server Certificate.

To enable DN Matching:

Set the SSL_SERVER_DN_MATCH parameter to TRUE in the sqlnet.ora file:

SSL_SERVER_DN_MATCH = TRUE

The sqlnet.ora file will look similar to:

SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
    (SOURCE=
    (METHOD=File)
    (METHOD_DATA=
        (DIRECTORY=wallet_location)))
SSL_SERVER_DN_MATCH = TRUE

Note: Only completing this step will result in partial DN matching. Perform step three to establish full DN matching.

Partial DN matching will check the host parameter value in the connect string against the certificate’s common name (CN). If a match isn’t found, the client will then compare the host parameter value against the entries in the certificate’s Subject Alternate Name (SAN) field. If there are no matches, the connection will be refused.

Check the host name parameter in the connect string in tnsnames.ora against the common name (CN) of the certificate DN string and the hostnames listed in the Subject Alternate Name (SAN) field. The connect string host name needs to match for partial DN match to succeed.

The tnsnames.ora file can be located on the client or in the LDAP directory. The tnsnames.ora file is typically located in the setting specified by the TNS_ADMIN environment variable. If TNS_ADMIN is not set, then tnsnames.ora resides in the following directory locations:
- Linux:
```
$ORACLE_HOME/network/admin/
```
- Windows:
```
ORACLE_BASE\ORACLE_HOME\network\admin\
```
If you can’t use partial DN matching, then configure full DN matching by setting the SSL_SERVER_CERT_DN parameter connection string in the tnsnames.ora file:

Note: If you can’t set the host value in tnsnames.ora or sqlnet.ora to the value of the certificate common name (CN) or one of the entries in the SAN field, then consider using full DN matching.

Both the listener and server certificate will be checked with both partial and full DN matching. When using full DN matching, while the server and listener certificate can be different, their DN must be the same for the connection to succeed.

The tnsnames.ora file will look similar to:
```
finance=
(DESCRIPTION=
    (ADDRESS_LIST=
        (ADDRESS=(PROTOCOL = tcps)(HOST = finance)
        (PORT = 1575)))
    (CONNECT_DATA=
        (SERVICE_NAME= finance.us.example.com))
    (SECURITY=
        (SSL_SERVER_DN_MATCH = TRUE)
        (SSL_SERVER_CERT_DN="cn=finance,cn=OracleContext,c=us,o=example")))
```