3

I want my DB to send the data to the client in an encrypted way. I Googled and found that Oracle has SSL. Unfortunately, I can't find a step by step tutorial which explains how to create a self-signed certificate, configure SSL on DB side, configure SSL on client side and test it.

Please, share your knowledge with me.

Thank you in advance.

---EDIT

My steps:

  1. Run Oracle Wallet Manager on DB server.
  2. Create New wallet.
  3. Create New Certificate Request.
  4. Exported Certificate Request.
  5. Using ssl.ca-0.1 (Downloaded from http://www.openssl.org/contrib/) created self-signed root certificate using new-root-ca.sh and imported as a trusted certificate on DB server.
  6. Created self-signed server certificate by running the sign-server-cert.sh and imported as an user certificate on DB server.

Here I am confused , .... don't know how to configure client side

In ssl.ca-0.1 there is also files new-user-cert.sh and sign-user-cert.sh, for what they are used I don't understand.

Tried to run them using the same certification request that was exported from DB server and tried to import it on the client wallet AM I WRONG?

May be yes, because it doesn't import user certificate... I am really confused don't understand the main idea.

I copied wallet generated on DB server on the client side wallet location, AM I RIGHT?

Improve this question
3
  • 1
    Just pondering, did you read up on docs.oracle.com/cd/B28359_01/network.111/b28530/…
    – Munchi
    Oct 30, 2013 at 12:52
  • Thank you @Munchi. It helped me alot. I have read this assay(topic or what is its name in English, don't know) but for now I catch up a lot of info. :)
    – kupa
    Oct 30, 2013 at 14:53
  • I know i'm late but.. If your only goal is to encrypt the data transmitted between server and clients You have a (in my opinion) better option. You can use Network Data Encryption rather than SSL Authentification, since the data is encrypted with AES or 3DES before it reach the transport layer (stronger security), it uses Diffie-Hellman protocol to share the symmetric key (easiest implementation. Just set and go) and the key is changed over the time and sessions (no risk of compromised key). Take a look docs.oracle.com/cd/E11882_01/network.112/e40393/…
    – vegatripy
    Mar 29, 2016 at 11:40

1 Answer 1

Reset to default
2

I found the answer.

In my post I've described how to create trusted and user certificates. As I guess trusted certificate is public key and user certificate is a private key(correct me if I am wrong).

Now I write how I have done this job.

--on DB server

Run owm(Oracle Wallet Manager) and:

  1. Create new wallet.
  2. Create certification request.
  3. Export certification request.
  4. using ssl.ca-0.1(Downloaded from http://www.openssl.org/contrib/) created self-signed root certificate using new-root-ca.sh and imported as a trusted certificate on DB server.
  5. Created self-signed server certificate by running the sign-server-cert.sh and imported as an user certificate on DB server.

--On client server Copied root certificate(generated previously).

  1. Create new wallet.

  2. Create certification request.

  3. Import trusted certificate by choosing copied root certificate.

Edit tnsnames.ora file on client server to use TNS entry using protocol TCPS and port, for example, 2484.

Edit listener.ora file on DB server to listen port 2484 and protocol TCPS.

Open Net Manager and configure SSL on both sides.

--DB side

Indicate wallet directory.

I've unchecked "Require Client Authentication" and other options what you want.

--Client side

Indicate wallet directory..

and other options what you want.

Improve this answer
1
  • Alright, good that it is working for you. Have fun ;)
    – Munchi
    Oct 30, 2013 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.