Configuring SSL Encryption with an Oracle Database Server

This procedure describes how to configure SSL encryption between Control-M/EM, Control-M/Server, and Workload Archiving with an Oracle database server. You can configure one- or two-way SSL authentication.

Before You Begin

• Install Control-M/EM, Control-M/Server, and Workload Archiving with an Oracle database.

• (Optional) Configure Kerberos authentication, as described in Configuring Kerberos Authentication with an Oracle Database Server.

• Verify that the site Oracle DBA has done the following:

  • Created a wallet on the server site.

  • Created and signed a database certificate.

  • Set the Oracle server to listen on a non-default TCPS port.

Begin

1. Shut down Control-M/EM and Control-M/Server components.

2. Run the following commands to verify that you can run the ssl_api.sh --help command:

   • ~/ctm_server /exe_Linux-x86_64/DBUData/scripts/ssl_api.sh --help

   • ~/ctm_em/bin/DBUData/scripts/ssl_api.sh --help

3. Copy the database self-signed certificate provided by the DBA to the Control-M/EM machine.

4. Navigate to the following DBUtils scripts folder:

   • ~/ctm_server /exe_Linux-x86_64/DBUData/scripts

   • ~/ctm_em/bin/DBUData/scripts

5. Do the following:

   1. Run the following command to create a wallet:

      ssl_api.sh --CREATE_WALLET --WALLET_PASSWD <WALLET_PASSWD>

   2. Run the following command to verify that a wallet has been created:

      ssl_api.sh --DISPLAY_WALLET

      A self signed certificate file is created in the following wallet folder:

      $TNS_ADMIN/wallet/*.cert

   3. If you intend to use two-way authentication, send this certificate file to the Oracle DBA.

6. Run the following command:

   ssl_api.sh --CONFIG_FILES --TCPS_PORT <TCPS_PORT_Number>

   where the <TCPS_PORT_Number> parameter is the secured port number that is provided by the Oracle DBA.

7. Run the following command:

   ssl_api.sh --IMPORT_TRUSTED_CERT

   ssl_api.sh --IMPORT_TRUSTED_CERT --WALLET_PASSWD <mypass> --CERT_FILE <…./ora_db_server.cert>

8. (Optional) To enable support for one-way authentication, do the following:

   1. Open the following file in a text editor:

      $ORACLE_HOME/network/admin/sqlnet.ora

   2. Locate the SSL_CLIENT_AUTHENTICATION parameter and change the value from TRUE to FALSE.

   3. Save and close the file.

9. Verify the SSL connection, as follows:

   • If you are not using Kerberos validation, run the following command:

     ssl_api.sh --TEST_CONNECTION --DB_USER_PASSWD <DB_USER_PASSWD>

   • If you are using Kerberos validation, run the following command:

     ssl_api.sh --TEST_CONNECTION

   • Run DBUStatus.