By Geetanjali Mehra

About Me

• Over 7 years of IT Industry Experience

• Currently working with Paytm as Senior
Database Administrator
• 9i/10g/11g Oracle Certified Administrator
Professional
• Oracle 11g Security Certified Implementation
Specialist
• Blog: http://oracle.linuxmantra.com
• @geetanjalidba
• E-mail: mailtogeetanjali@gmail.com
Agenda

• What is SSL/TLS and its importance

• What do you require to integrate SSL with
Oracle Database 11g
• Steps to configure SSL with Oracle Database
11g
• Using SSL in Oracle
What is SSL?

• SSL/TLS , a protocol , used for securing network

connections.
• Uses PKI to provide authentication, encryption,
and data integrity.
SSL Handshake

• The server sends its certificate to the client.

This step verifies the identity of the server.
• The client generates a session key and sends
this key to the second party using public key
cryptography
• All subsequent communications between the
client and the server is encrypted and
decrypted by using this session key.
Why to integrate Oracle with SSL

• Only the server authenticates itself to the

client
• Both client and server authenticate themselves
to each other
• Neither the client nor the server authenticates
itself to the other, thus using the SSL
encryption feature by itself
What is required?
• Oracle Advanced Security on the client.
• Oracle Advanced Security on the Server.
• To configure SSL, use Oracle Network Manager
Steps to configure SSL

1. Configure SSL on the Server.

2. Configure SSL on the client.
3. Using SSL
Step 1: Configure SSL on the Server

• Wallet creation on the server.

• Create certificate request
• Send certificate request to the CA
• Import certificate to the wallet.
• Use netmgr to specify the location of wallet
and configuring SSL.
• Configure various network-related files.
Step 2: Configure SSL on the Client

• Wallet creation on the client

• Create certificate request
• Send certificate request to the CA.
• Import certificate to the wallet.
• Use netmgr to specify the location of wallet
and configuring SSL.
• Configure various network-related files.
Step 3: Using SSL

1. Creation of user to be authenticated using SSL

certificate
2. Logon to the database using newly created
user.
Demonstration
• Same machine will be used for client as well as for server.

• Database name is db1.oracle.local running on RHEL 5.4.

• Machine name is host1.oracle.local.

• Database version 11.2.0.1.0.

• Tools used: orapki

• client side configuration files : $ORACLE_HOME/network/user

• server side configuration files: $ORACLE_HOME/network/admin

Demonstration
• Create necessary directories:
for any wallet
mkdir $ORACLE_HOME/owm/wallets
for wallet with self-signed root certificate
mkdir $ORACLE_HOME/owm/wallets/root

for database wallet

mkdir $ORACLE_HOME/owm/wallets/db
for user wallet
mkdir $ORACLE_HOME/owm/wallets/user
Demonstration
• Create wallet that will contain a root certificate (self-signed ) to sign database and users certificates

$ orapki wallet create -wallet $ORACLE_HOME/owm/wallets/root

Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter password:
Add self-signed certificate
orapki wallet add -wallet $ORACLE_HOME/owm/wallets/root -dn 'CN=root' -keysize 2048 -self_signed -
validity 365
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:

Export root certificate
orapki wallet export -wallet $ORACLE_HOME/owm/wallets/root -dn 'CN=root' -cert
$ORACLE_HOME/owm/wallets/root/root.cer
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:

Demonstration
• Create database wallet

Create auto-login (and password) database wallet

orapki wallet create -wallet $ORACLE_HOME/owm/wallets/db -auto_login
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter password:
Import root certificate into database wallet
orapki wallet add -wallet $ORACLE_HOME/owm/wallets/db -trusted_cert -cert
$ORACLE_HOME/owm/wallets/root/root.cer -pwd Welcome1
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Create certificate request for database

orapki wallet add -wallet $ORACLE_HOME/owm/wallets/db -dn
'CN=orcl,DC=oracle,DC=local' -keysize 1024 -pwd Welcome1
Demonstration
Create database wallet continued:
Export certificate request for signing
orapki wallet export -wallet $ORACLE_HOME/owm/wallets/db -dn
'CN=orcl,DC=oracle,DC=local' -request $ORACLE_HOME/owm/wallets/db/dbcert.req
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved

Sign request with root private key

orapki cert create -wallet $ORACLE_HOME/owm/wallets/root -request
$ORACLE_HOME/owm/wallets/db/dbcert.req -cert
$ORACLE_HOME/owm/wallets/db/dbcert.cer -validity 365
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:

• cat $ORACLE_HOME/owm/wallets/db/dbcert.cer
-----BEGIN CERTIFICATE-----
MIICPDCCASQCAQAwDQYJKoZIhvcNAQEEBQAwDzENMAsGA1UEAxMEcm9vdDAeFw0xNTAyMTIwNjQy
NDZaFw0xNjAyMTIwNjQyNDZaMD0xFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEWMBQGCgmSJomT8ixk
ARkWBm9yYWNsZTEMMAoGA1UEAxMDZGIxMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCo1jwB
lBPHsdSXFJPeUEzpyiPXPlA+OUwA3nS3HzFrx/Iu0c8ZYXmAymfZlxtTAmsfRmWqlqHEZfqO16GY
rpFEnr8C5hAI++CjHmxS1d1JWB0OiWzKKCEt0jvT/XAL8+wgwX/SS9ysa9cxy8wpV/U8xLZpVSII
XwydCY3qvZeVawIDAQABMA0GCSqGSIb3DQEBBAUAA4IBAQBSceM9GbjElG/BCencL2s4dNtwZh/n
6XizvrOpCtTmMhr44Tx51Qc10DXeQcWysMXWvtB2EsCBQjbG/lPLLthr0IpwGRRRUtrKcMUd38yI
5Ns41EjAmXmPhXA0eXKT9Ykw4jgydOg8HVHR55PWZh8sPSMHGWbUQzpgQkYC3895A9ksn3jCD6Jt
qv5+LdzUTMHdhzZ0jzvPklz83lNlggXQEKQ3+1V5ePuBihpeJhLV7rQF3MMdj4nP/M1Jx1hOENFn
lkpAgszbLZmWTZptnSZ8DhOV+OfOmqCXtqH1iL4awAjf6FysjXr0zTdp7UBC18fWPoHtjxCX/YPQ
erbtWEhG

-----END CERTIFICATE-
cat $ORACLE_HOME/owm/wallets/db/dbcert.req
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBfDCB5gIBADA9MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFjAUBgoJkiaJk/IsZAEZFgZvcmFj
bGUxDDAKBgNVBAMTA2RiMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqNY8AZQTx7HUlxST
3lBM6coj1z5QPjlMAN50tx8xa8fyLtHPGWF5gMpn2ZcbUwJrH0ZlqpahxGX6jtehmK6RRJ6/AuYQ
CPvgox5sUtXdSVgdDolsyighLdI70/1wC/PsIMF/0kvcrGvXMcvMKVf1PMS2aVUiCF8MnQmN6r2X
lWsCAwEAAaAAMA0GCSqGSIb3DQEBBAUAA4GBACnIa6jIYfO3QLDBAGTJzKAxiNp8PUS/LgznDqq1
ceJ3tYKszHJoouKaY2cz8fOT8opizYk4yTtxVkg3mPS0L5SwwXUQIarnELDBjku1m68wg7VJBAuy
I6UZkezbU0Hvhqm93YFXrcQS/VJnt+tZILzFyX9BMU2IhGxSfWlVaEek
-----END NEW CERTIFICATE REQUEST-----
Demonstration

Create database wallet continued:

• Import database certificate into database wallet

orapki wallet add -wallet
$ORACLE_HOME/owm/wallets/db -user_cert -cert
$ORACLE_HOME/owm/wallets/db/dbcert.cer -pwd
Welcome1
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates.
All rights reserved.
• Create user wallet (have to do for each user)
Create auto-login (and password) user wallet
orapki wallet create -wallet $ORACLE_HOME/owm/wallets/user -auto_login
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter password:

Import root certificate into user wallet

orapki wallet add -wallet $ORACLE_HOME/owm/wallets/user -trusted_cert -cert
$ORACLE_HOME/owm/wallets/root/root.cer -pwd Welcome1
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Create certificate request for user

orapki wallet add -wallet $ORACLE_HOME/owm/wallets/user -dn
'CN=ssluser,DC=oracle,DC=local' -keysize 1024 -pwd Welcome1
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.
Demonstration
Export certificate request for signing
orapki wallet export -wallet $ORACLE_HOME/owm/wallets/user -dn
'CN=ssluser,DC=oracle,DC=local' -request
$ORACLE_HOME/owm/wallets/user/usercert.req
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.
Sign request with root private key
orapki cert create -wallet $ORACLE_HOME/owm/wallets/root -request
$ORACLE_HOME/owm/wallets/user/usercert.req -cert
$ORACLE_HOME/owm/wallets/user/usercert.cer -validity 365
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:

Import user certificate into user wallet
orapki wallet add -wallet $ORACLE_HOME/owm/wallets/user -user_cert -cert
$ORACLE_HOME/owm/wallets/user/usercert.cer -pwd Welcome1
Oracle PKI Tool : Version 11.2.0.1.0 - Production
Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved
Demonstration

• Configure netmgr for server side

Demonstration

• Sqlnet.ora file:
SSL_VERSION = 3.0
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY =
/u01/app/oracle/product/11.2.0/db_1/owm/wallets/db)
)
)
ADR_BASE = /u01/app/oracle
• Listener.ora
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(GLOBAL_DBNAME = ORCL.ORACLE.LOCAL)
(ORACLE_HOME = /u01/app/oracle/product/11.2.0/db_1)
(SID_NAME = orcl)
)
)
SSL_CLIENT_AUTHENTICATION = true
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = /u01/app/oracle/product/11.2.0/db_1/owm/wallets/db)
)
)
LISTENER =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCPS)(HOST = host1.oracle.local)(PORT = 2484))
)
ADR_BASE_LISTENER = /u01/app/oracle
• Configure netmgr for client side
• Sqlnet.ora

SSL_VERSION = 3.0
SSL_CLIENT_AUTHENTICATION =TRUE
SSL_SERVER_DN_MATCH = YES
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY =
/u01/app/oracle/product/11.2.0/db_1/owm/wallets/user)
)
)
ADR_BASE = /u01/app/oracle
• Tnsnames.ora
ORCL =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCPS)(HOST =
host1.oracle.local)(PORT = 2484))
)
(CONNECT_DATA =
(SERVICE_NAME = ORCL.oracle.local)
)
)
• Restart the listener
$lsnrctl stop
$lsnrctl start

• Create a database user

SQL>create user ssluser identified externally as
‘cn=ssluser,dc=oracle,dc=local’;

SQL> grant create session to ssluser;

• Logon into database

$sqlplus /@orcl
SQL*Plus: Release 11.2.0.1.0 Production on Tue Apr 23 23:14:15 2013
Copyright (c) 1982, 2009, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 – Production
With the Partitioning, OLAP, Data Mining and Real Application Testing
options
Questions?

Thanks for listening