Configuring ezTLS for TCPS Connections

ezTLS over TCPS delivers simplified TLS encryption for TCPS connections without requiring customer-managed wallets or trusted certificate chains.

When ezTLS is enabled and no persistent wallet is configured, the database server automatically provisions an in-memory wallet. Ephemeral certificates are refreshed as necessary and regenerated after database restarts, eliminating manual wallet and certificate administration entirely.

• TCPS Configuration Scenarios for ezTLS
• Wallet Behavior and Identity Verification
• Compatibility Requirements for TCPS Connections
• TCPS Migration Checklist

TCPS Configuration Scenarios for ezTLS

You can enable ezTLS globally for all TCPS connections using sqlnet.ora, or apply it selectively to individual connections using tnsnames.ora.

• Global Configuration: To use ezTLS with Oracle AI Database TCPS connections, set EZTLS to TRUE in sqlnet.ora on both the server and the client. Also, set TLS_CLIENT_AUTHENTICATION to OPTIONAL in the server’s sqlnet.ora to allow clients to connect without client authentication.

  • Server configuration (sqlnet.ora):

    EZTLS = TRUE
    TLS_CLIENT_AUTHENTICATION = OPTIONAL

  • Client configuration (sqlnet.ora):

    EZTLS = TRUE

• Per-Connection Configuration: Enable ezTLS for a specific connection descriptor in tnsnames.ora using the SECURITY clause.

  • Client descriptor (tnsnames.ora):

    db_service =
      (DESCRIPTION =
        (ADDRESS = (PROTOCOL = tcps)(HOST = <host>)(PORT = <port>))
        (SECURITY = (EZTLS = TRUE))
        (CONNECT_DATA = (SERVICE_NAME = <service_name>))
      )

    The client’s per-connection setting does not replace the required server setting in sqlnet.ora.

Wallet Behavior and Identity Verification

• Pre-existing wallets: If a persistent wallet and trusted certificate store are already configured on the server, standard certificate validation continues according to your configured TLS parameters.
• Identity verification requirements: Remember that ezTLS provides encryption without certificate-based identity verification. If your compliance policies require cryptographic proof of the server or client identity, configure standard one-way TLS or mutual TLS (mTLS) instead.

Compatibility Requirements for TCPS Connections

For an ezTLS connection over TCPS to succeed, both the client and server must support ezTLS. Connecting an ezTLS-enabled endpoint to an older or incompatible TCPS peer can cause the connection to fail. To resolve this, upgrade the incompatible peer to a version that supports ezTLS over TCPS, or explicitly configure the ezTLS-enabled endpoint to use certificate-authenticated TLS with settings compatible with its peer.

TCPS Migration Checklist

Determine whether any connection strictly requires certificate-based identity verification; if so, deploy standard one-way TLS or mTLS instead of ezTLS.

Before and during your migration to ezTLS over TCPS, ensure you:

• Verify version support: Confirm that both your client drivers and database server releases support ezTLS over TCPS.
• Configure endpoints: Set EZTLS = TRUE in the server’s sqlnet.ora file. On the client, enable it globally in sqlnet.ora or for a specific connection in the SECURITY section of its tnsnames.ora descriptor.
• Test thoroughly: Validate each application client driver, administration tool, and connection descriptor.
• Confirm negotiated mode: Use SQL*Net tracing or network diagnostics to verify that ezTLS was successfully negotiated.
• Validate end-to-end traffic: Confirm that application queries and database user authentication function normally over the encrypted connection.