1. Oracle Autonomous Health Framework User's Guide
  2. Configuring SSL and SSL Certificates

Configuring SSL and SSL Certificates

View and restrict SSL/TLS protocols. Configure Oracle Trace File Analyzer to use self-signed or CA-signed certificates.

Configuring SSL/TLS Protocols

The Oracle Trace File Analyzer (TFA) daemons in a cluster communicate securely using SSL/TLS protocols.

The SSL/TLS protocols available for use by Oracle Trace File Analyzer are:

  • TLSv1.2
  • TLSv1.1
  • TLSv1

Oracle Trace File Analyzer always restricts the older SSLv3 and SSLv2Hello protocols.

To view and restrict protocols:

  1. View the available and restricted protocols:

    tfactl print protocols

    Example output:

    .---------------------------------------.
|                 node1                 |
+---------------------------------------+
| Protocols                             |
+---------------------------------------+
| Available : [TLSv1, TLSv1.2, TLSv1.1] |
| Restricted : [SSLv3, SSLv2Hello]      |
'---------------------------------------'

  2. Restrict the use of a specific protocol:

    tfactl restrictprotocol [-force] <protocol>

    For example:

    tfactl restrictprotocol TLSv1

Configuring Self-Signed Certificates

Use the Java keytool utility to replace the default self-signed SSL certificates with your own self-signed certificates.

Note:

The default self-signed certificates shipped with Oracle Trace File Analyzer use a 2048-bit key.

Note:

When multiple certificates are stored in an Oracle wallet, you cannot specify which certificate Oracle Trace File Analyzer uses. Expired certificates are not bypassed and can cause the SSL handshake to fail. If two or more valid, unexpired user certificates are present, Oracle Trace File Analyzer does not guarantee which certificate is selected.

To configure Oracle Trace File Analyzer to use self-signed certificates:

  1. Create a private key and keystore containing the server self-signed certificate:

    keytool -genkey \
  -alias server_full \
  -keyalg RSA \
  -keysize 2048 \
  -validity 365 \
  -keystore myserver.jks

  2. Create a private key and keystore containing the client self-signed certificate:

    keytool -genkey \
  -alias client_full \
  -keyalg RSA \
  -keysize 2048 \
  -validity 365 \
  -keystore myclient.jks

  3. Export the server public key certificate from the server keystore:

    keytool -export \
  -alias server_full \
  -file myserver_pub.crt \
  -keystore myserver.jks \
  -storepass <password>

  4. Export the client public key certificate from the client keystore:

    keytool -export \
  -alias client_full \
  -file myclient_pub.crt \
  -keystore myclient.jks \
  -storepass <password>

  5. Import the server public key certificate into the client keystore:

    keytool -import \
  -alias server_pub \
  -file myserver_pub.crt \
  -keystore myclient.jks \
  -storepass <password>

  6. Import the client public key certificate into the server keystore:

    keytool -import \
  -alias client_pub \
  -file myclient_pub.crt \
  -keystore myserver.jks \
  -storepass <password>

  7. Restrict keystore permissions to read-only access for root:

    chmod 400 myclient.jks myserver.jks

  8. Configure Oracle Trace File Analyzer to use the new certificates:

    tfactl set sslconfig

    Example interaction:

    tfactl set sslconfig
Please Enter server certificate path : /u01/oracle.ahf/data/host/tfa/myserver.jks
Please Enter Password for server keystore keypass :
Please Confirm Password for server keystore keypass :
Please Enter Password for server keystore storepass :
Please Confirm Password for server keystore storepass :
Please Enter client certificate path? : /u01/oracle.ahf/data/host/tfa/myclient.jks
Please Enter Password for client keystore keypass :
Please Confirm Password for client keystore keypass :
Please Enter Password for client keystore storepass :
Please Confirm Password for client keystore storepass :
SSL certificate details successfully set
The certificates are restricted to root read only

  9. Restart Oracle Trace File Analyzer so that it uses the new certificates:

    tfactl restart

Configuring CA-Signed Certificates

Use the Java keytool utility and openssl to replace self-signed SSL certificates with certificates signed by a Certificate Authority (CA).

To configure Oracle Trace File Analyzer to use CA-signed certificates:

  1. Create a private key for the server certificate request:

    openssl genrsa -aes256 -out myserver.key 2048

  2. Create a private key for the client certificate request:

    openssl genrsa -aes256 -out myclient.key 2048

  3. Create a Certificate Signing Request (CSR) for the server:

    openssl req -key myserver.key -new -sha256 -out myserver.csr

  4. Create a CSR for the client:

    openssl req -key myclient.key -new -sha256 -out myclient.csr

  5. Submit the client and server CSRs to the appropriate certificate signing authority.

    The signing authority returns the following certificates:

    • myserver.cert
    • myclient.cert
    • CA root certificate
    • Intermediate certificate

  6. Convert the server certificate and private key to PKCS#12 format and then to JKS:

    openssl pkcs12 -export \
  -out serverCert.pkcs12 \
  -in myserver.cert \
  -inkey myserver.key
    keytool -v -importkeystore \
  -srckeystore serverCert.pkcs12 \
  -srcstoretype PKCS12 \
  -destkeystore myserver.jks \
  -deststoretype JKS

    Convert the client certificate and private key:

    openssl pkcs12 -export \
  -out clientCert.pkcs12 \
  -in myclient.cert \
  -inkey myclient.key
    keytool -v -importkeystore \
  -srckeystore clientCert.pkcs12 \
  -srcstoretype PKCS12 \
  -destkeystore myclient.jks \
  -deststoretype JKS

  7. Import the server public key into the client JKS keystore:

    keytool -import -v \
  -alias server-ca \
  -file myserver.cert \
  -keystore myclient.jks

  8. Import the client public key into the server JKS keystore:

    keytool -import -v \
  -alias client-ca \
  -file myclient.cert \
  -keystore myserver.jks

  9. Import the CA root certificate into the Oracle Trace File Analyzer server keystore:

    keytool -importcert -trustcacerts \
  -alias root \
  -file caroot.cert \
  -keystore myserver.jks

  10. Import the intermediate certificate into the Oracle Trace File Analyzer server keystore:

    keytool -importcert -trustcacerts \
  -alias inter \
  -file intermediate.cert \
  -keystore myserver.jks

  11. Import the intermediate certificate into the Oracle Trace File Analyzer client keystore:

    keytool -importcert -trustcacerts \
  -alias inter \
  -file intermediate.cert \
  -keystore myclient.jks

  12. Validate the keystore aliases.

    List the contents of the server keystore:

    keytool -list \
  -keystore myserver.jks \
  -storepass <password>

    The output should contain the following aliases:

    1
client-ca
root
inter

    List the contents of the client keystore:

    keytool -list \
  -keystore myclient.jks \
  -storepass <password>

    The output should contain the following aliases:

    1
server-ca
inter

    Note:

    If alias 1 (PrivateKeyEntry) is missing from myserver.jks, change the alias of the existing PrivateKeyEntry to 1:

    keytool -changealias \
  -alias "<alias_of_PrivateKeyEntry>" \
  -destalias "1" \
  -keystore myserver.jks \
  -storepass <password>

    Note:

    If alias 1 (PrivateKeyEntry) is missing from myclient.jks, change the alias of the existing PrivateKeyEntry to 1:

    keytool -changealias \
  -alias "<alias_of_PrivateKeyEntry>" \
  -destalias "1" \
  -keystore myclient.jks \
  -storepass <password>

  13. Restrict keystore permissions to read-only access for root:

    chmod 400 myclient.jks myserver.jks

  14. Configure Oracle Trace File Analyzer to use the new certificates:

    tfactl set sslconfig

    Example interaction:

    tfactl set sslconfig
Please Enter server certificate path : /u01/oracle.ahf/data/host/tfa/myserver.jks
Please Enter Password for server keystore keypass :
Please Confirm Password for server keystore keypass :
Please Enter Password for server keystore storepass :
Please Confirm Password for server keystore storepass :
Please Enter client certificate path? : /u01/oracle.ahf/data/host/tfa/myclient.jks
Please Enter Password for client keystore keypass :
Please Confirm Password for client keystore keypass :
Please Enter Password for client keystore storepass :
Please Confirm Password for client keystore storepass :
SSL certificate details successfully set
The certificates are restricted to root read only

  15. Restart Oracle Trace File Analyzer so that it uses the new certificates:

    tfactl stop
tfactl start

Configuring an SSL Cipher Suite

A cipher suite is a set of cryptographic algorithms used by TLS/SSL protocols to establish secure connections and encrypt data.

Oracle Trace File Analyzer supports cipher suites provided by JRE 1.8.

The default cipher suite is:

TLS_RSA_WITH_AES_128_CBC_SHA256

To change the cipher suite:

tfactl set ciphersuite=<cipher_suite>

For example:

tfactl set ciphersuite=TLS_RSA_WITH_AES_128_GCM_SHA256

For a list of JRE cipher suites, see the SunJSSE Provider documentation.