http://docs.oracle.com/cd/B19306_01/network.102/b14268/asowalet.htm#i1010563
How To Create Database Wallet Used For SSL Authentication (Doc ID 1573911.1)
Application DBAs and developers who've had extensive experience with Oracle's
business applications and fusion middleware would be more likely to encounter this technology. A core DBA, even working on these systems, might only install a wallet based upon a set of instructions without having much debugging or troubleshooting experience, since it really is an application-specific feature, and won't cause operational problems for the database itself if misconfigured.
Additionally, a second type of security authentication involves encryption within the database, and using a wallet to decrypt. You can get more information on this topic from these Oracle support resources (or do an internet search for them if you don't have an account):
Note 317311.1 - 10g R2 New Feature TDE : Transparent Data Encryption
Note 1251597.1 – Quick and Dirty TDE Setup and FAQ
Note 1228046.1 - Master Note For Transparent Data Encryption (TDE)
Note 432776.1 - 11g New Feature: Transparent Data Encryption at Tablespace Level
One of the biggest issues surrounding the wallet is the fact that it has a password, usually different from database passwords, as this is recommended. In one major client installation, this password was not preserved, resulting in the potential loss of data should the wallet files be lost or changed at the OS level, leaving the authentication and validation processes unable to be executed. Additionally, if the wallet is optionally paired with a third-party certificate, the certificate file can also be lost, damaged, and can expire. In such cases, The only solution is to create a new wallet and link it to a new certificate, with the exact same credentials, before expiration.
There is an executable to manage the wallet interactively, called "owm", which is included with the Oracle database software for 11gr2. This tool gives you the ability to do any and all wallet processing. An older utility, at command line level, is orapki. This can be a life-saver on machines where x-windows processing is not an option. Here is an example of using orapki to display the contents and expiration information about a wallet:
orapki wallet export -wallet /u01/app/grid/acfsmounts/racdb_data_acfsvol1/ssl_wallet -dn 'CN=server-name,OU=Company Name,O=Organization,L=City,ST=State,C=Country' -cert /tmp/mycert
orapki cert display -cert /tmp/mycert -summary
Above will present wallet internal names, certificate names, date of implementation, and expiration date. A very common catch-all error can occur when attempting to access the database through a connection secured by a wallet:
ORA-28860: Fatal SSL Error
This error hints at an inconsistency in wallet configuration.
Carefully check that the wallet files themselves exist on both
source and target, that they are in the appropriate directory,
and that they are current. There are pointers to the wallet files
in tnsnames.ora, listener.ora and sqlnet.ora for the database,
and these must also be consistent.
Any deviations, which are especially possible in a multiple client
and/or multiple node RAC configuration, can result in sporadic
connectivity issues that are difficult to troubleshoot.
I hope you enjoyed this brief overview. I would prefer to hear comments
from those who know quite a bit more, or would like to know more.
I'll try to find the answers or make corrections to any inconsistencies
seen here. We had a two-month project to replace wallets with expiring
certificates without passwords, and we barely completed it on time!
No comments:
Post a Comment