SSL-Enable Oracle Database

 SSL-Enable Oracle Database

Take these steps to SSL-enable Oracle database:

1. Create a root CA and a certificate for the DB. Here is an example:
   Note:

   Self-signed certificates are not recommended for production use. For information about obtain production wallets, see Section 8.4.8.3, "Changing a Self-Signed Wallet to a Third-Party Wallet.".

   mkdir root
   mkdir server
    
   # Create root wallet, add self-signed certificate and export
   orapki wallet create -wallet ./root -pwd password
   orapki wallet add -wallet ./root -dn CN=root_test,C=US -keysize 2048 -self_signed -validity 3650 -pwd password
   orapki wallet display -wallet ./root -pwd password
   orapki wallet export -wallet ./root -dn CN=root_test,C=US -cert ./root/b64certificate.txt -pwd password
    
   #Create server wallet, add self-signed certificate and export
   orapki wallet create -wallet ./server -pwd password
   orapki wallet add -wallet ./server -dn CN=server_test,C=US -keysize 2048 -pwd password
   orapki wallet display -wallet ./server -pwd password
   orapki wallet export -wallet ./server -dn CN=server_test,C=US -request ./server/creq.txt -pwd password
    
   # Import trusted certificates
   orapki cert create -wallet ./root -request ./server/creq.txt -cert ./server/cert.txt -validity 3650 -pwd password
   orapki cert display -cert ./server/cert.txt -complete
   orapki wallet add -wallet ./server -trusted_cert -cert ./root/b64certificate.txt -pwd password
   orapki wallet add -wallet ./server -user_cert -cert ./server/cert.txt -pwd password
   orapki wallet create -wallet ./server -auto_login -pwd password}}
   

2. Update listener.ora, sqlnet.ora, and tnsnames.ora for the database.
   1. This example shows the default listener.ora:

      SID_LIST_LISTENER =
      (SID_LIST =(SID_DESC =(SID_NAME = PLSExtProc)(ORACLE_HOME = /path_to_O_H)(PROGRAM = extproc)))
      LISTENER =(DESCRIPTION_LIST =(DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1))
      (ADDRESS = (PROTOCOL = TCP)(HOST = mynode.mycorp.com)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = mynode.mycorp.com)(PORT = 2490))
      ))
       
      WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/wallet_location)))
       
      SSL_CLIENT_AUTHENTICATION=FALSE}}
      

      And here is an updated listener.ora file, illustrating a scenario with no client authentication:

      SID_LIST_LISTENER =
        (SID_LIST =
          (SID_DESC =
            (GLOBAL_DBNAME = dbname)
            (ORACLE_HOME = /path_to_O_H)
            (SID_NAME = sid)
          )
        )
       
      SSL_CLIENT_AUTHENTICATION = FALSE
       
      WALLET_LOCATION =
        (SOURCE =
          (METHOD = FILE)
          (METHOD_DATA =
            (DIRECTORY = /wallet_path)
          )
        )
       
      LISTENER =
        (DESCRIPTION_LIST =
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
          )
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = TCP)(HOST = mynode.mycorp.com)(PORT = 1521))
          )
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = TCPS)(HOST = mycorp.com)(PORT = 2490))
          )
        )
      

      Note that the SSL port has been added.
   2. Likewise, a modified sqlnet.ora file may look like this:

      NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
      SQLNET.AUTHENTICATION_SERVICES=(BEQ,TCPS,NTS)
      WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/directory)))
      SSL_CLIENT_AUTHENTICATION=FALSE
      

   3. A modified tnsnames.ora file may look like this:

      OID =
        (DESCRIPTION =
          (ADDRESS = (PROTOCOL = TCP)(HOST = mynode.mycorp.com)(PORT = 1521))
          (CONNECT_DATA =
            (SERVER = DEDICATED)
            (SERVICE_NAME = mynode.mycorp.com)
          )
        )
         
      SSL =
        (DESCRIPTION =
          (ADDRESS_LIST =
            (ADDRESS = (PROTOCOL = TCPS)(HOST = mynode.mycorp.com)(PORT = 2490))
          )
          (CONNECT_DATA =
            (SERVICE_NAME = mynode.mycorp.com)
          )
          (SECURITY=(SSL_SERVER_CERT_DN=\"CN=server_test,C=US\"))
        )
      

3. Test the connection to the database using the new connect string. For example:

   $ tnsping ssl
   $ sqlplus username/password@ssl