Changes in this Release

This preface lists changes in the Oracle Autonomous Health Framework Checks and Diagnostics User's Guide 26.8.

AHF Certificate Migration from JKS to PKCS12

Oracle Autonomous Health Framework (AHF) has transitioned its certificate architecture from Java KeyStore (JKS) to the industry-standard PKCS12 (P12) format.

The migration was introduced incrementally across AHF releases:

  • AHF 26.3.1: SQL Agent connections use non-root certificates.
  • AHF 26.5.0: Non-root requests use non-root certificates.
  • AHF 26.8.0: Root requests continue to use root certificates.

With AHF 26.8.0, all AHF certificate operations use the PKCS12 format, completing the migration from JKS.

Parent topic: Changes in this Release

Network Connectivity for AHF Certificate Synchronization

Oracle Autonomous Health Framework (AHF) introduces a certificate synchronization mechanism that requires bidirectional network connectivity between cluster nodes on TCP ports 5000–5005.

AHF uses TCP port 5000 by default for TFA daemon communication. If port 5000 is unavailable, AHF can use an available port in the range 5001–5005. These ports are also used during certificate synchronization, particularly during a fresh AHF installation or when adding a node to an existing cluster.

Ensure that each cluster node can establish connections to the other nodes on TCP ports 5000–5005.

Configure AHF Communication Ports on OCI

For systems running on Oracle Cloud Infrastructure (OCI), configure ingress rules on the Network Security Group (NSG) or Security List associated with each node to allow inbound TCP traffic on ports 5000–5005 from the peer nodes or cluster subnet.

Configure the rules using the following values:

  • Stateless: No (leave unchecked)
  • Source Type: CIDR
  • Source CIDR: IP address or CIDR of the peer node (recommended)
  • IP Protocol: TCP
  • Source Port Range: All
  • Destination Port Range: 5000–5005
  • Description: Optional

Note:

If the default port 5000 is unavailable, AHF might use another port in the range 5001–5005 for node-to-node communication. Therefore, ensure bidirectional connectivity between cluster nodes across the entire TCP port range 5000–5005.

Parent topic: Changes in this Release

Configure Customer-Provided CA-Signed Certificates for AHF

Oracle Autonomous Health Framework (AHF) introduces the ahf security add-certificates command to configure customer-provided Certificate Authority (CA)-signed certificates.

AHF uses separate certificates for root and non-root requests. The certificate used for privileged root connections is dedicated to the root user and cannot be shared. TFA uses certificate pinning to ensure that the appropriate certificate is used based on the connection type.

To support certificate synchronization across cluster nodes, the same intermediate CA and root CA must sign the root and non-root certificates on every node in the cluster.

After creating the CA-signed certificates, run the ahf security add-certificates command as the root user on each cluster node to configure the certificates.

Related Topics

Parent topic: Changes in this Release

Certificate Validation for Upload Servers Using Self-Signed Certificates

Oracle Autonomous Health Framework (AHF) now requires the public certificate of an upload server that uses a self-signed certificate. This enables AHF to verify the identity of the upload endpoint during registration, health checks, deregistration, and upload operations.

Use the ahf security add-certificates command to import the server certificate into the AHF trust store. AHF distributes the certificate across cluster nodes and uses it to establish trusted connections to the upload endpoint.

You can import multiple certificates by assigning each certificate a unique alias. To replace an existing certificate, import the updated certificate using the appropriate alias.

Before configuring an upload endpoint that uses a self-signed certificate, import its public certificate into AHF.

Related Topics

Parent topic: Changes in this Release

SSH Host Key Handling in AHF 26.8

AHF 26.8 does not enforce the stricter SSH host key validation introduced in AHF 26.5. Instead, when AHF 26.8 establishes an SSH connection to a host for the first time, it automatically captures the host's SSH key fingerprint and adds it to the known_hosts file.

After the fingerprint is stored, subsequent SSH connections validate the host against the saved entry and proceed without prompting for confirmation. This behavior enables AHF 26.8 to recognize previously connected hosts without enforcing the stricter SSH host key validation introduced in AHF 26.5.

For information about the behavior in AHF 26.5, see Enhanced SSH Host Key Validation for Exachk with AHF 26.5.

Parent topic: Changes in this Release

AHF Support for Oracle Base Database Cloud@Customer

AHF supports Oracle Base Database Cloud@Customer (BaseDB-C@C), providing diagnostic collection and monitoring capabilities for BaseDB-C@C environments.

AHF support for BaseDB-C@C includes:

  • Diagnostic collection: Collects logs and other diagnostic data to help identify and troubleshoot database and cluster issues.
  • OCI Monitoring integration: Collects database and cluster health metrics and makes them available in the OCI Console for monitoring and visibility.

Parent topic: Changes in this Release

AHF 26.8.0 Reliability, Performance, and Security Updates

AHF 26.8.0 includes reliability, performance, and security improvements across the framework.

This release includes:

  • More than 50 minor enhancements and bug fixes across AHF components, improving reliability, accuracy, and overall system performance.
  • Critical security updates that strengthen the security of AHF components. For information about these updates, see Oracle Autonomous Health Framework Risk Matrix.

These improvements enhance AHF stability and reliability while optimizing resource utilization.

Parent topic: Changes in this Release