Patching, Upgrading, and Downgrading Oracle Grid Infrastructure with FIPS 140.3

Use this guidance when patching or upgrading Oracle Grid Infrastructure to a release that contains the FIPS 140.3 supporting fixes, and when rolling back to an earlier release.

Note:

For the requirements and rolling procedure to enable FIPS 140.3 on a new or existing cluster, see Enabling FIPS 140.3 for Oracle Grid Infrastructure.

Patching and Upgrading Before Enabling FIPS 140.3

The required FIPS 140.3 supporting fixes must be installed on every cluster node before FIPS 140.3 is enabled on any node.

Check the patch README or release-specific support guidance for the Oracle Grid Infrastructure 26ai Release Update you are running (for example, Oracle Grid Infrastructure 26ai Release Update 23.26.2) to identify the FIPS 140.3 supporting fixes for your platform.
Patch or upgrade the cluster to a version that contains the fixes. You can perform a rolling patch or upgrade if the applicable procedure supports it.
Complete the patch or upgrade on every cluster node before you enable FIPS 140.3.
After every node is running a version that contains the fixes, enable FIPS 140.3 as described in Enabling FIPS 140.3 for Oracle Grid Infrastructure.

If FIPS 140.3 is enabled on any node before the required fixes are installed on every node, the cluster configuration is not supported. Contact Oracle Support for recovery guidance.

Rollback Restrictions

Rollback to an older version that does not contain the required fixes for FIPS 140.3 is not supported when all of the following conditions are true:

The active Grid home contains the FIPS 140.3 support changes.
FIPS 140.3 is enabled.
The GPnP profile was signed on a node where FIPS 140.3 is enabled.

In this situation, the profile is signed using RSA-SHA512, which an older version without supporting fixes cannot handle.

Preparing for Rollback

When the rollback conditions above apply, disable FIPS 140.3 on every cluster node in a rolling manner before you start the rollback:

Stop the Oracle Grid Infrastructure stack on one node.
Disable FIPS 140.3 on that node by using the configuration procedure for your platform and release.
Restart the Oracle Grid Infrastructure stack on that node.
Repeat these steps for each remaining node.

After you disable FIPS 140.3 on all nodes, update and re-sign the GPnP profile by using one of the methods in Re-signing the GPnP Profile. Verify that the profile was successfully updated and is signed using RSA-SHA1. After you complete this verification, proceed with the rollback.

Re-signing the GPnP Profile

The gpnp_wallet_upgrade.sh -resign_only option is supported starting with Oracle Grid Infrastructure 26ai Release Update 23.26.3. For a patched Grid home running Oracle Grid Infrastructure 26ai Release Update 23.26.2 or earlier, use gpnptool to update and re-sign the profile.

If the Grid home is patched to Oracle Grid Infrastructure 26ai Release Update 23.26.3 or later, run the GPnP wallet upgrade script in re-sign-only mode:
```
# gpnp_wallet_upgrade.sh -resign_only
```

If the Grid home is patched to Oracle Grid Infrastructure 26ai Release Update 23.26.2 or earlier, use gpnptool to read the current profile sequence number, increment it, edit the profile, sign it with SHA1, and publish the re-signed profile:

# gpnptool getpval -prf_sq -p=<profile_location> -o-
# gpnptool edit -prf_sq=<new_profile_sequence_number> -p=<profile_location> -o=<edited_profile_location>
# gpnptool sign -a=sha1 -p=<edited_profile_location> -o=<resigned_profile_location>
# gpnptool put -p=<resigned_profile_location>

After you update the profile, verify that it is signed using RSA-SHA1. Do not start the rollback while the profile is signed using RSA-SHA512.