WebSphere Application Server & Liberty

WebSphere Application Server & Liberty

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

How to setup TLS for Oracle Datacource?

  • 1.  How to setup TLS for Oracle Datacource?

    Posted 09/25/20 05:43 PM
    Hello! 
    Could somebody explain how we can achieved secure connection to Oracle database?
    Currently we have set Oracle 12.2 with wallet, and secure connection from sqlplus from workstation is successfully established by tcps protocol -  we see it in V$SESSION_CONNECT_INFO

    Later - in WAS 9 BASE we create new node with datasource on default listener  port 1521 - test successful. For secure datasource 1543 port -
    1. add self-signed database host certificate from wallet to Key stores and certificates > NodeDefaultTrustStore > Signer certificates
    2. create self-signed certificate at Key stores and certificates > NodeDefaultKeyStore > Personal certificates 
    3. place  created at (2) certificate as trusted to wallet at database host
    4. connection string wrote as jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=dbhost)(PORT=1543))(CONNECT_DATA=(SERVICE_NAME=dbservicename)))
    Thus both servers has trusted certificate from other one.
    At this point if we test datasource we got error (ssl debug enabled on both sides):

    [9/24/20 11:20:16:265 MSK] 0000008e SystemOut O Default : 4, fatal error: 46: General SSLEngine problem
    com.ibm.jsse2.util.h: PKIX path building failed: java.security.cert.CertPathBuilderException: unable to find valid certification path to requested target
    [9/24/20 11:20:16:265 MSK] 0000008e SystemOut O %% Invalidated: [Session-28, SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA384]
    [9/24/20 11:20:16:265 MSK] 0000008e SystemOut O Default : 4, SEND TLSv1.2 ALERT: fatal, description = certificate_unknown
    [9/24/20 11:20:16:265 MSK] 0000008e SystemOut O Default : 4, WRITE: TLSv1.2 Alert, length = 2
    [9/24/20 11:20:16:266 MSK] 0000008e SystemOut O Default : 4, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: General SSLEngine problem
    [9/24/20 11:20:16:267 MSK] 0000008e DSConfigurati W DSRA8201W: DataSource Configuration: DSRA8040I: Failed to connect to the DataSource jdbc/SSL. Encountered java.sql.SQLRecoverableExcep
    java.sql.SQLRecoverableException: IO Error: General SSLEngine problem, connect lapse 10 ms., Authentication lapse 0 ms. DSRA0010E: SQL State = 08006, Error Code = 17,002

    I don`t understand which path is mean unable to find valid certification path to requested target ? there is no chained certificate is used.




    ------------------------------
    Oleg SAgay
    ------------------------------


Related Content