Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store.

Client: Windows 7 64 bit with Oracle client 11.2.0.3.0

Server: Windows 2008 R2 64 bit with Oracle server 11.2.0.1.0

The Advanced Security Administrators guide doesn't have a whole lot of information on the interaction with Microsoft Certificate Services other than specifying METHOD=MCS for your wallet location. Does anyone have a more detailed explanation?

On the client in my user certificate store, I have a personal certificate (public/private 'smart-card') in the personal container and the server's public cert in the Trusted Root Certificate Authorities container. Both are signed by the same CA.

On the server in the Local Computer certificate store, I have the server's certificate (public/private) in the Personal container and the clients public cert in the Trusted Root Certificate Authorities container. Again signed by the same CA.

I would sure like to get some confirmation from anyone that has done this with any version of Oracle before I recommend this to a customer.

When I connect from client I get ORA-28864: SSL connection closed gracefully.

Here is what I think is the relevant part of the Servers Listener trace file. This error occurs when I attempt a client connect or when I perform a lsnrctl status. I'm making an educated guess that it can not find the Server Certificate.

2012-04-23 07:13:52.503508 : ntzGetStringParameter:found value for "wallet_location" configuration parameter: "SOURCE = (METHOD = MCS)"
2012-04-23 07:13:52.503523 : ntzGetStringParameter:exit
2012-04-23 07:13:52.503536 : ntzAllocate:entry
2012-04-23 07:13:52.503551 : ntzAllocate:allocating 26 bytes of memory.
2012-04-23 07:13:52.503565 : ntzAllocate:exit
2012-04-23 07:13:52.503585 : ntzAllocate:entry
2012-04-23 07:13:52.503600 : ntzAllocate:allocating 8 bytes of memory.
2012-04-23 07:13:52.503614 : ntzAllocate:exit
2012-04-23 07:13:52.503628 : ntzgwrlFromFile:exit
2012-04-23 07:13:52.503642 : ntzgwrl:exit
2012-04-23 07:13:52.503655 : ntzscr:entry
2012-04-23 07:13:52.503670 : ntzGetStringParameter:entry
2012-04-23 07:13:52.503684 : ntzGetStringParameter:exit
2012-04-23 07:13:52.503698 : ntzGetStringParameter:entry
2012-04-23 07:13:52.503712 : ntzGetStringParameter:exit
2012-04-23 07:13:52.503725 : ntzGetStringParameter:entry
2012-04-23 07:13:52.503740 : ntzGetStringParameter:exit
2012-04-23 07:13:52.503754 : ntzscr:exit
2012-04-23 07:13:52.503767 : ntzlogin:entry
2012-04-23 07:13:52.503784 : ntzlogin:Persona retrieval failed with error 28788
2012-04-23 07:13:52.503803 : ntzlogin:returning NZ error 28788 in result structure
2012-04-23 07:13:52.503819 : ntzlogin:failed with error 540
2012-04-23 07:13:52.503833 : ntzlogin:exit
2012-04-23 07:13:52.503847 : ntzConfigure:failed with error 540
2012-04-23 07:13:52.503862 : ntzConfigure:exit
2012-04-23 07:13:52.503876 : ntzCreateConnection:failed with error 540
2012-04-23 07:13:52.503891 : ntzCreateConnection:exit
2012-04-23 07:13:52.503906 : ntzdisconnect:entry
2012-04-23 07:13:52.503920 : ntzFreeNTZData:entry
2012-04-23 07:13:52.503936 : ntzFreeNTZData:exit
2012-04-23 07:13:52.503950 : nttdisc:entry
2012-04-23 07:13:52.557834 : nttdisc:Closed socket 816
2012-04-23 07:13:52.557864 : nttdisc:exit
2012-04-23 07:13:52.557883 : ntzdisconnect:exit
2012-04-23 07:13:52.557899 : ntzconnect:failed with error 540
2012-04-23 07:13:52.557915 : ntzconnect:exit
2012-04-23 07:13:52.557931 : nserror:entry
2012-04-23 07:13:52.557949 : nserror:nsres: id=0, op=65, ns=12560, ns2=0; 
    nt[0]=540, nt[1]=0, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=0
2012-04-23 07:13:52.557966 : nsopen:unable to open transport
2012-04-23 07:13:52.557981 : nstoClearTimeout:entry    
share|improve this question
    
2 years later, I know, but do you recall resolving this particular issue? Any information to supplement the thin Oracle documentation would be awesome. –  Rafael Rivera Sep 2 at 16:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.