This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Table of contents

• Create Oracle wallet
• Configure Oracle for SSL
• Restart services
• Connect to Oracle over SSL
• Learn more

To set up SSL configuration for Oracle connections, you need to create a wallet, configure Oracle network files, and adjust connection settings.

Prerequisites:

• Oracle Client installed
• Oracle Database Server that supports SSL
• Access rights to create directories and files
• A valid SSL certificate from a trusted CA
• Oracle Wallet Manager for wallet management

Create Oracle wallet

1. Create a wallet folder

   Create a directory to store your wallet:

   mkdir /opt/oracle/wallet
   

2. Generate a wallet

   Use the orapki utility to create a wallet:

   $ORACLE_HOME/bin/orapki wallet create -wallet /opt/oracle/wallet -pwd YourWalletPassword -auto_login
   

3. Add certificates to the wallet

   Choose one of the following:

   • Create and add a self-signed certificate:

     $ORACLE_HOME/bin/orapki wallet add -wallet /opt/oracle/wallet -pwd YourWalletPassword -dn "CN=example.com" -keysize 1024 -self_signed -validity 365
     

   • Add a CA-signed certificate:

     $ORACLE_HOME/bin/orapki wallet add -wallet /opt/oracle/wallet -pwd YourWalletPassword -trusted_cert -cert path_to_root_ca_cert
     

   Tip: Replace YourWalletPassword, CN=example.com, and path_to_root_ca_cert with your actual values.

4. Generate JKS files

   Convert the wallet to Java Keystore format:

   $ORACLE_HOME/bin/orapki wallet pkcs12_to_jks -wallet /opt/oracle/wallet -pwd YourWalletPassword -jksKeyStoreLoc /opt/oracle/wallet/oracle_keystore.jks -jksKeyStorepwd YourJKSPassword -jksTrustStoreLoc /opt/oracle/wallet/oracle_truststore.jks -jksTrustStorepwd YourJKSPassword
   

Configure Oracle for SSL

1. Edit listener.ora

   Example:

   SSL_CLIENT_AUTHENTICATION = FALSE
   
   WALLET_LOCATION =
     (SOURCE =
       (METHOD = FILE)
       (METHOD_DATA =
         (DIRECTORY = /opt/oracle/wallet)
       )
     )
   
   LISTENER =
   (DESCRIPTION_LIST =
     (DESCRIPTION =
       (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1))
       (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
     )
     (DESCRIPTION =
       (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
     )
   )
   
   DEDICATED_THROUGH_BROKER_LISTENER = ON
   DIAG_ADR_ENABLED = off
   

2. Edit sqlnet.ora

   Example:

   WALLET_LOCATION =
     (SOURCE =
       (METHOD = FILE)
       (METHOD_DATA =
         (DIRECTORY = /opt/oracle/wallet)
       )
     )
   
   SQLNET.AUTHENTICATION_SERVICES = (TCPS,NTS,BEQ)
   SSL_CLIENT_AUTHENTICATION = FALSE
   SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA)
   

3. Edit tnsnames.ora

   Example:

   SSL=
   (DESCRIPTION =
     (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
     (CONNECT_DATA =
       (SERVER = DEDICATED)
       (SERVICE_NAME = XE)
     )
   )
   
   XE=
   (DESCRIPTION =
     (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
     (CONNECT_DATA =
       (SERVER = DEDICATED)
       (SERVICE_NAME = XE)
     )
   )
   

   Tip: Replace 0.0.0.0, 2484, and XE with your server’s IP, SSL port, and service name.

Restart services

1. Restart the listener

   $ORACLE_HOME/bin/lsnrctl stop
   $ORACLE_HOME/bin/lsnrctl start
   

2. Restart the database

   $ORACLE_HOME/bin/sqlplus / as sysdba
   shutdown
   startup
   

   Tip: If running in Docker, use:

   docker restart oracle_container_name
   

Connect to Oracle over SSL

1. Open DBeaver and create a new connection

   If unsure how, see creating a connection.

2. Specify the custom JDBC URL

   Example:

   jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=0.0.0.0)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=XE)))
   

3. Set driver properties

   • javax.net.ssl.trustStorePassword: Password for the truststore
   • javax.net.ssl.trustStoreType: JKS
   • oracle.net.wallet.location: Path to your wallet

   

4. Test the connection

   Verify that you can connect over SSL.

Learn more

For general SSL configuration, see SSL overview.