Configuring Recovery Appliance Replication with TLS Using DBMS_RA
This section describes how to configure Recovery Appliance replication when TLS is in use on one or both Recovery Appliances.
Prerequisites and Assumptions
Your environment must meet the following prerequisites:
-
The upstream and downstream Recovery Appliance can communicate with each other over the network.
-
The downstream Recovery Appliance must be started and configured to receive backups.
The following replication cases are provided.
Case 1: One-Way Replication; TLS disabled on Downstream
The upstream Recovery Appliance (RA1) has one-way replication to the downstream Recovery Appliance (RA2).
-
The upstream Recovery Appliance can be in the mode: TLS enabled, TLS only, or TLS disabled.
-
The downstream Recovery Appliance has TLS disabled.
No action is required.
Case 2: One-Way Replication; TLS enabled on Downstream
The upstream Recovery Appliance (RA1) has one-way replication to the downstream Recovery Appliance (RA2).
-
The upstream Recovery Appliance (RA1) can be in the mode: TLS enabled, TLS only, or TLS disabled.
-
The downstream Recovery Appliance (RA2) has TLS enabled or TLS only.
Perform these steps with RA2 as the downstream.
-
Update
tnsnames.ora
with the new TCPS information.-
On the downstream Recovery Appliance
cat /u01/app/oracle/product/19.0.0.0/dbhome_1/network/admin/tnsnames.ora
-
On the upstream Recovery Appliance, add a new entry or update the existing entry with the TCPS information from the downstream Recovery Appliance. For example:
(ADDRESS = (PROTOCOL = TCPS)(HOST = <FULL_SCAN_NAME>)(PORT = 2484)
-
-
Update the trusted certificate, which has the
pem
extension, like<NAME>.pem
-
Copy the trusted cert from the downstream Recovery Appliance to the upstream Recovery Appliance
tmp
directory.Note:
Use either a different location or a different name if the upstream Recovery Appliance is TLS enabled so that the certificate on the upstream Recovery Appliance is not overwriteen.scp DS_RA:<trusted_cert> US_RA:/tmp/<different_name_trusted_cert>
-
Prepare the password for the RA wallet.
Note:
Use the same password for the RA wallet and the replication wallet.mkstore -wrl /raacfs/raadmin/config/awallet/wallet/ -viewEntry oracle.security.client.password<NUMBER>
-
If the upstream Recovery Appliance is also TLS enabled, then the RA wallet already supports the certificates.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
If the replication is bi-directional, perform the same operation but treat the local Recovery Appliance as a downstream Recovery Appliance.
-
If the upstream Recovery Appliance is not TLS enabled, then the RA wallet needs to be migrated to support the certificates.
-
List all of the current credentials.
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet –listCredential
-
Back up the wallet.
mv /raacfs/raadmin/config/ra_wallet/wallet /raacfs/raadmin/config/ra_wallet/wallet_old
-
Create a new RA wallet.
orapki wallet create -wallet /raacfs/raadmin/config/ra_wallet/wallet
-
Import copied trusted certificate into the wallet.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
Update wallet to auto login.
orapki wallet create –wallet /raacfs/raadmin/config/ra_wallet/wallet -auto_login
-
Recover all credentials into the new RA wallet. For each credential in the old wallet, perform:
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet -createCredential <alias> <user> <pw>
-
-
-
Check to see that the replication wallet supports certificates.
ls -lart /raacfs/raadmin/replication/orapki
This is the replication wallet standard that RACLI recommends and supports certificates.
-
If the replication wallet exists, perform:
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
If the replication wallet does not exist, perform:
-
List credentials in current replication wallet.
mkstore –wrl /raacfs/raadmin/replication –listCredential
-
Create a new replication wallet.
orapki wallet create -wallet /raacfs/raadmin/replication/orapki
-
Import copied trusted certificate into new replication wallet.
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert --cert /tmp/<different_name_trusted_cert>
-
Update wallet with auto login.
orapki wallet create –wallet /raacfs/raadmin/replication/orapki -auto_login
-
Recover all credentials into new replication wallet
mkstore –wrl /raacfs/raadmin/replication/orapki -createCredential <tns_alias> <repl_user> <repl_user_pw>
-
-
-
-
Update the replication server parameters.
-
Pause the replication server.
dbms_ra.pause_replication_server()
-
Update the replication parameters.
-
wallet_path
should be the new replication wallet location. -
wallet_alias
should be the alias updated intnsnames.ora
in step 1
dbms_ra.update_replication_server() wallet_path => 'file:/raacfs/raadmin/replication/orapki/’ wallet_alias => ‘TNS_ALIAS’
-
-
Resume the replication server
dbms_ra.resume_replication_server()
-
Case 3: Two-Way Replication; TLS disabled on Downstream
The upstream Recovery Appliance (RA1) has two-way replication with the downstream Recovery Appliance (RA2).
-
The upstream Recovery Appliance can be in the mode: TLS enabled or TLS only.
-
The downstream Recovery Appliance has TLS disabled.
Perform this step but with RA1 as the downstream. on the downstream Recovery Appliance.
-
Update
tnsnames.ora
with the new TCPS information.-
On the downstream Recovery Appliance
cat /u01/app/oracle/product/19.0.0.0/dbhome_1/network/admin/tnsnames.ora
-
On the upstream Recovery Appliance, add a new entry or update the existing entry with the TCPS information from the downstream Recovery Appliance. For example:
(ADDRESS = (PROTOCOL = TCPS)(HOST = <FULL_SCAN_NAME>)(PORT = 2484)
-
-
Update the trusted certificate, which has the
pem
extension, like<NAME>.pem
-
Copy the trusted cert from the downstream Recovery Appliance to the upstream Recovery Appliance
tmp
directory.Note:
Use either a different location or a different name if the upstream Recovery Appliance is TLS enabled so that the certificate on the upstream Recovery Appliance is not overwriteen.scp DS_RA:<trusted_cert> US_RA:/tmp/<different_name_trusted_cert>
-
Prepare the password for the RA wallet.
Note:
Use the same password for the RA wallet and the replication wallet.mkstore -wrl /raacfs/raadmin/config/awallet/wallet/ -viewEntry oracle.security.client.password<NUMBER>
-
If the upstream Recovery Appliance is also TLS enabled, then the RA wallet already supports the certificates.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
If the replication is bi-directional, perform the same operation but treat the local Recovery Appliance as a downstream Recovery Appliance.
-
If the upstream Recovery Appliance is not TLS enabled, then the RA wallet needs to be migrated to support the certificates.
-
List all of the current credentials.
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet –listCredential
-
Back up the wallet.
mv /raacfs/raadmin/config/ra_wallet/wallet /raacfs/raadmin/config/ra_wallet/wallet_old
-
Create a new RA wallet.
orapki wallet create -wallet /raacfs/raadmin/config/ra_wallet/wallet
-
Import copied trusted certificate into the wallet.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
Update wallet to auto login.
orapki wallet create –wallet /raacfs/raadmin/config/ra_wallet/wallet -auto_login
-
Recover all credentials into the new RA wallet. For each credential in the old wallet, perform:
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet -createCredential <alias> <user> <pw>
-
-
-
Check to see that the replication wallet supports certificates.
ls -lart /raacfs/raadmin/replication/orapki
This is the replication wallet standard that RACLI recommends and supports certificates.
-
If the replication wallet exists, perform:
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
If the replication wallet does not exist, perform:
-
List credentials in current replication wallet.
mkstore –wrl /raacfs/raadmin/replication –listCredential
-
Create a new replication wallet.
orapki wallet create -wallet /raacfs/raadmin/replication/orapki
-
Import copied trusted certificate into new replication wallet.
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert --cert /tmp/<different_name_trusted_cert>
-
Update wallet with auto login.
orapki wallet create –wallet /raacfs/raadmin/replication/orapki -auto_login
-
Recover all credentials into new replication wallet
mkstore –wrl /raacfs/raadmin/replication/orapki -createCredential <tns_alias> <repl_user> <repl_user_pw>
-
-
-
-
Update the replication server parameters.
-
Pause the replication server.
dbms_ra.pause_replication_server()
-
Update the replication parameters.
-
wallet_path
should be the new replication wallet location. -
wallet_alias
should be the alias updated intnsnames.ora
in step 1
dbms_ra.update_replication_server() wallet_path => 'file:/raacfs/raadmin/replication/orapki/’ wallet_alias => ‘TNS_ALIAS’
-
-
Resume the replication server
dbms_ra.resume_replication_server()
-
Case 4: Two-Way Replication; TLS enabled on Downstream
The upstream Recovery Appliance (RA1) has two-way replication with the downstream Recovery Appliance (RA2).
-
The upstream Recovery Appliance can be in the mode: TLS enabled or TLS only.
-
The downstream Recovery Appliance has TLS enabled or TLS only.
Perform this step twice: once with RA1 as the downstream, and once with RA2 as the downstream.
-
Update
tnsnames.ora
with the new TCPS information.-
On the downstream Recovery Appliance
cat /u01/app/oracle/product/19.0.0.0/dbhome_1/network/admin/tnsnames.ora
-
On the upstream Recovery Appliance, add a new entry or update the existing entry with the TCPS information from the downstream Recovery Appliance. For example:
(ADDRESS = (PROTOCOL = TCPS)(HOST = <FULL_SCAN_NAME>)(PORT = 2484)
-
-
Update the trusted certificate, which has the
pem
extension, like<NAME>.pem
-
Copy the trusted cert from the downstream Recovery Appliance to the upstream Recovery Appliance
tmp
directory.Note:
Use either a different location or a different name if the upstream Recovery Appliance is TLS enabled so that the certificate on the upstream Recovery Appliance is not overwriteen.scp DS_RA:<trusted_cert> US_RA:/tmp/<different_name_trusted_cert>
-
Prepare the password for the RA wallet.
Note:
Use the same password for the RA wallet and the replication wallet.mkstore -wrl /raacfs/raadmin/config/awallet/wallet/ -viewEntry oracle.security.client.password<NUMBER>
-
If the upstream Recovery Appliance is also TLS enabled, then the RA wallet already supports the certificates.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
If the replication is bi-directional, perform the same operation but treat the local Recovery Appliance as a downstream Recovery Appliance.
-
If the upstream Recovery Appliance is not TLS enabled, then the RA wallet needs to be migrated to support the certificates.
-
List all of the current credentials.
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet –listCredential
-
Back up the wallet.
mv /raacfs/raadmin/config/ra_wallet/wallet /raacfs/raadmin/config/ra_wallet/wallet_old
-
Create a new RA wallet.
orapki wallet create -wallet /raacfs/raadmin/config/ra_wallet/wallet
-
Import copied trusted certificate into the wallet.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
Update wallet to auto login.
orapki wallet create –wallet /raacfs/raadmin/config/ra_wallet/wallet -auto_login
-
Recover all credentials into the new RA wallet. For each credential in the old wallet, perform:
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet -createCredential <alias> <user> <pw>
-
-
-
Check to see that the replication wallet supports certificates.
ls -lart /raacfs/raadmin/replication/orapki
This is the replication wallet standard that RACLI recommends and supports certificates.
-
If the replication wallet exists, perform:
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
If the replication wallet does not exist, perform:
-
List credentials in current replication wallet.
mkstore –wrl /raacfs/raadmin/replication –listCredential
-
Create a new replication wallet.
orapki wallet create -wallet /raacfs/raadmin/replication/orapki
-
Import copied trusted certificate into new replication wallet.
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert --cert /tmp/<different_name_trusted_cert>
-
Update wallet with auto login.
orapki wallet create –wallet /raacfs/raadmin/replication/orapki -auto_login
-
Recover all credentials into new replication wallet
mkstore –wrl /raacfs/raadmin/replication/orapki -createCredential <tns_alias> <repl_user> <repl_user_pw>
-
-
-
-
Update the replication server parameters.
-
Pause the replication server.
dbms_ra.pause_replication_server()
-
Update the replication parameters.
-
wallet_path
should be the new replication wallet location. -
wallet_alias
should be the alias updated intnsnames.ora
in step 1
dbms_ra.update_replication_server() wallet_path => 'file:/raacfs/raadmin/replication/orapki/’ wallet_alias => ‘TNS_ALIAS’
-
-
Resume the replication server
dbms_ra.resume_replication_server()
-
Case 5: Two-Way Replication; TLS disabled on Upstream
The upstream Recovery Appliance (RA1) has two-way replication with the downstream Recovery Appliance (RA2).
-
The upstream Recovery Appliance has TLS disabled.
-
The downstream Recovery Appliance has TLS enabled or TLS only.
Perform this step with RA2 as the downstream.
-
Update
tnsnames.ora
with the new TCPS information.-
On the downstream Recovery Appliance
cat /u01/app/oracle/product/19.0.0.0/dbhome_1/network/admin/tnsnames.ora
-
On the upstream Recovery Appliance, add a new entry or update the existing entry with the TCPS information from the downstream Recovery Appliance. For example:
(ADDRESS = (PROTOCOL = TCPS)(HOST = <FULL_SCAN_NAME>)(PORT = 2484)
-
-
Update the trusted certificate, which has the
pem
extension, like<NAME>.pem
-
Copy the trusted cert from the downstream Recovery Appliance to the upstream Recovery Appliance
tmp
directory.Note:
Use either a different location or a different name if the upstream Recovery Appliance is TLS enabled so that the certificate on the upstream Recovery Appliance is not overwriteen.scp DS_RA:<trusted_cert> US_RA:/tmp/<different_name_trusted_cert>
-
Prepare the password for the RA wallet.
Note:
Use the same password for the RA wallet and the replication wallet.mkstore -wrl /raacfs/raadmin/config/awallet/wallet/ -viewEntry oracle.security.client.password<NUMBER>
-
If the upstream Recovery Appliance is also TLS enabled, then the RA wallet already supports the certificates.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
If the replication is bi-directional, perform the same operation but treat the local Recovery Appliance as a downstream Recovery Appliance.
-
If the upstream Recovery Appliance is not TLS enabled, then the RA wallet needs to be migrated to support the certificates.
-
List all of the current credentials.
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet –listCredential
-
Back up the wallet.
mv /raacfs/raadmin/config/ra_wallet/wallet /raacfs/raadmin/config/ra_wallet/wallet_old
-
Create a new RA wallet.
orapki wallet create -wallet /raacfs/raadmin/config/ra_wallet/wallet
-
Import copied trusted certificate into the wallet.
orapki wallet add -wallet /raacfs/raadmin/config/ra_wallet/wallet -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
Update wallet to auto login.
orapki wallet create –wallet /raacfs/raadmin/config/ra_wallet/wallet -auto_login
-
Recover all credentials into the new RA wallet. For each credential in the old wallet, perform:
mkstore –wrl /raacfs/raadmin/config/ra_wallet/wallet -createCredential <alias> <user> <pw>
-
-
-
Check to see that the replication wallet supports certificates.
ls -lart /raacfs/raadmin/replication/orapki
This is the replication wallet standard that RACLI recommends and supports certificates.
-
If the replication wallet exists, perform:
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert -cert /tmp/<different_name_trusted_cert>
-
If the replication wallet does not exist, perform:
-
List credentials in current replication wallet.
mkstore –wrl /raacfs/raadmin/replication –listCredential
-
Create a new replication wallet.
orapki wallet create -wallet /raacfs/raadmin/replication/orapki
-
Import copied trusted certificate into new replication wallet.
orapki wallet add -wallet /raacfs/raadmin/replication/orapki -trusted_cert --cert /tmp/<different_name_trusted_cert>
-
Update wallet with auto login.
orapki wallet create –wallet /raacfs/raadmin/replication/orapki -auto_login
-
Recover all credentials into new replication wallet
mkstore –wrl /raacfs/raadmin/replication/orapki -createCredential <tns_alias> <repl_user> <repl_user_pw>
-
-
-
-
Update the replication server parameters.
-
Pause the replication server.
dbms_ra.pause_replication_server()
-
Update the replication parameters.
-
wallet_path
should be the new replication wallet location. -
wallet_alias
should be the alias updated intnsnames.ora
in step 1
dbms_ra.update_replication_server() wallet_path => 'file:/raacfs/raadmin/replication/orapki/’ wallet_alias => ‘TNS_ALIAS’
-
-
Resume the replication server
dbms_ra.resume_replication_server()
-
Case 6: Two-Way Replication; TLS disabled on Upstream and Downstream
The upstream Recovery Appliance (RA1) has two-way replication with the downstream Recovery Appliance (RA2).
-
The upstream Recovery Appliance has TLS disabled.
-
The downstream Recovery Appliance has TLS disabled.
No action is required.