Selecting ezTLS, One-Way TLS, or Mutual TLS

Select a TLS configuration based on your requirements for encryption and certificate-based identity verification.

Capability	ezTLS	One-way TLS	Mutual TLS (mTLS)
Encrypts data in transit	Yes	Yes	Yes
Uses the TLS protocol	Yes	Yes	Yes
Customer-managed certificate requirements	None	Server certificate	Client and server certificates
Authenticates the database server with certificates	No	Yes	Yes
Authenticates the client with certificates	No	No	Yes
Administrative overhead	Low	Medium	High
Primary use case	TLS encryption with zero certificate overhead	Encryption with server identity verification	Encryption with strict mutual identity verification

Choose ezTLS when:

• You need encrypted SQL*Net communication but do not require certificate-based identity verification.
• You want to implement TLS protection without the operational burden of deploying wallets across a large client estate.
• You are replacing a legacy native network encryption (NNE) deployment with standard TLS-based encryption.
• You require a phased migration path to support older clients or servers still active in your environment.

Choose one-way TLS when:

• The client must explicitly validate the identity of the database server.
• Your internal security policies, network-trust models, or compliance mandates specifically require certificate-based identity verification.

Choose mutual TLS (mTLS) when:

• Both the client and the server must cryptographically validate each other’s identities.
• Your strict security policies or Zero Trust network models require end-to-end, dual-sided certificate verification.

Note that network encryption and identity verification are completely separate from database user authentication. Regardless of which TLS model you deploy, users must still authenticate to the database using configured authentication methods.