9
Configuring SSL Authentication

This chapter covers the following topics:

SSL in an Oracle Environment

SSL (Secure Sockets Layer) is an industry standard protocol designed by Netscape Communications Corporation for securing network connections. SSL provides authentication, encryption, and data integrity using public key infrastructure (PKI).

This section discusses the following topics.

What You Can Do with the SSL Feature

By including the SSL feature, the Oracle Advanced Security option expands its own support for encryption, and provides public key authentication based on the SSL standard.

You can use the SSL feature of the Oracle Advanced Security option to secure communications between any client and any server. Specifically, you can use SSL to authenticate:

Any client or server to one or more Oracle servers
An Oracle server to any client

You can use SSL features by themselves or in combination with other authentication methods supported by the Oracle Advanced Security option. For example, you can use the encryption provided by SSL in combination with the authentication provided by Kerberos.

More Information:
For more information on authentication methods, see Chapter 1, "Introduction to Oracle Advanced Security".

You can use SSL in one of three authentication modes. You can require:

Only the server to authenticate itself to the client
Both client and server to authenticate themselves to each other
Neither the client nor the server to authenticate itself to the other

You can also disable SSL authentication and use its encryption feature alone.

More Information:
For a full explanation of SSL, see the Internet Engineering Task Force document The SSL Protocol, Version 3.0.
For important security concepts and terminology, see the Glossary.

Architecture of SSL in an Oracle Environment

In an Oracle environment, SSL operates at the Oracle Protocols layer using TCP/IP as illustrated in Figure 9-1.

Figure 9-1 Architecture of SSL in an Oracle Environment

Components of SSL in an Oracle Environment

The components of SSL in an Oracle environment include the following, each of which is described below:

Certificate

A certificate ensures that the entity's identity information is correct and that the public key actually belongs to that entity. A certificate is created when an entity's public key is signed by a trusted identity, that is, a certificate authority (CA), described more fully in this section.

A certificate contains the entity's name, public key, serial number, and expiration date. It may contain information about the privileges associated with the certificate. Finally, it contains information about the CA that issued it.

When an entity receives a certificate--either its own certificate from a CA or a certificate from another entity--it verifies that certificate is a trusted certificate, that is, that it is issued by a trusted certificate authority. A certificate is valid until it expires.

Certificate Authority (CA)

A trusted third party that certifies that other entities--users, databases, administrators, clients, servers--are who they say they are. The certificate authority verifies the user's identity and grants a certificate, signing it with the certificate authority's private key.

Different CAs may have different identification requirements when issuing certificates. One certificate authority may want to see a user's driver's license, another may want the certificate request form to be notarized, yet another may want fingerprints of the person requesting a certificate.

The certificate authority publishes its own certificate which includes its public key. Each network entity has a list of such certificates of the CAs it trusts. Before communicating with another entity, a given entity uses this list to verify that the signature on the other entity's certificate is from a trusted CA.

Network entities can obtain their certificates from the same or from different CAs.

Note:
The Oracle Advanced Security option is installed with a set of VeriSign certificates.
For information on adding certificates, see "Step 5: Create a new wallet".
For information on adding trusted certificates, see "Step 7: Add new trusted certificates".

Wallet

An abstraction used to store and manage authentication data such as keys, certificates, and trusted certificates which are needed by SSL. In an Oracle environment, each system using SSL has a wallet with an X509 version 3 certificate, private key, and list of trusted certificates.

Security administrators use the Oracle Wallet Manager to manage security credentials on the server. Wallet owners use it to manage security credentials on clients. Specifically, the Oracle Wallet Manager is used to do the following:

generate a public-private key pair and create a certificate request for submission to a certificate authority
install a certificate for the identity
configure trusted certificates for the identity

Note:
Installation of the Oracle Advanced Security option, release 8.1.5, includes installation of the Oracle Wallet Manager, release 1.3-beta.

More Information:
For information on the Oracle Wallet Manager, see the sections beginning with "Step 4: Start the Oracle Wallet Manager". See also "Managing Wallets".

How SSL Works in an Oracle Environment: The SSL Handshake

More Information:
For a full explanation of SSL, see the Internet Engineering Task Force document The SSL Protocol, Version 3.0.

At the beginning of their communication, the client and server perform an SSL handshake which includes three important tasks:

The client and server establish which cipher suite to use.
The server sends its certificate to the client. The client verifies that the server's certificate was signed by a trusted CA.

Similarly, if client authentication is required, the client sends its own certificate to the server. The server verifies that the client's certificate was signed by a trusted CA.
The client and server exchange key material using public key cryptography, and, from this material, they each generate a session key. All subsequent communication between client and server is encrypted and decrypted by using this set of session keys and the negotiated cipher suite.

In an Oracle environment, the authentication process involves three basic steps:

The user initiates a Net8 connection to the server by using SSL.
SSL performs the handshake between client and server.
If the handshake is successful, the server verifies that the user has the appropriate authorization to access the database.

SSL beyond an Oracle Environment

You can use the SSL feature of the Oracle Advanced Security option to secure connections between non-Oracle clients and Oracle servers. For example, SSL can allow a client outside an Oracle network to access authorized data securely within the Oracle network.

Figure 9-2 offers an example of how you can use SSL to secure connections between Oracle and non-Oracle entities--beginning over the Internet and proceeding to an Oracle server. In this example, a Web server runs as an Oracle8i Java client. It receives messages over HTTPS (HTTP secured by SSL), and sends CORBA requests to the Oracle server via a servlet over IIOP/SSL (IIOP secured by SSL.). Note that, in this example, the Web server passes its own--and not the Web client's--certificate to the Oracle server.

More Information:
For information on using and configuring IIOP/SSL, see Oracle8i Enterprise JavaBeans and CORBA Developer's Guide.

Figure 9-2 Connecting to an Oracle Server over the Internet

SSL in Combination with Other Authentication Methods

You can combine the features of SSL with other authentication methods supported by the Oracle Advanced Security option, for example, Kerberos, SecurID, or Identix.

More Information:
For more information on authentication methods, see Chapter 1, "Introduction to Oracle Advanced Security".

This section discusses the topics in the following list.

Architecture of SSL in Combination with Other Authentication Methods

As Figure 9-3 illustrates, the Oracle Advanced Security option operates at the session layer, on top of SSL which uses TCP/IP at the transport layer.

More Information:
For more information on stack communications in an Oracle networking environment, see Net8 Administrator's Guide.

Figure 9-3 SSL in Relation to the Oracle Advanced Security Option

Example: Using SSL in Combination with Other Authentication Methods

Figure 9-4 illustrates one possible scenario when using SSL in combination with another authentication method supported by the Oracle Advanced Security option. In this scenario, server authentication uses SSL, and client authentication uses an authentication method supported by the Oracle Advanced Security option, for example, Kerberos, SecurID, Identix.

Figure 9-4 Example: SSL in Relation to Other Oracle Advanced Security Authentication Methods

The client seeks to connect to the Oracle server.
SSL performs a handshake during which the server authenticates itself to the client and both the client and server establish which cipher suite to use. See "How SSL Works in an Oracle Environment: The SSL Handshake".
Once the SSL handshake is successfully completed, the user seeks access to the database.
The Oracle server exchanges the user's authentication information with the authentication server.

Upon validation by the authentication server, the Oracle server grants access and authorization to the user.

Note:
You can use SSL encryption in combination with another authentication method of the Oracle Advanced Security option. When you do this, you must disable any non-SSL encryption to comply with government regulations prohibiting double encryption. If you do not do this, the connection will fail.
For information on how to disable encryption in the Oracle Advanced Security option, see "Negotiating Encryption and Checksumming".
You cannot use SSL authentication with the Oracle Advanced Security option encryption.

Issues When Using SSL

SSL cannot be proxied through traditional application level firewalls (such as the CERN proxy server).

SSL does not provide authorization, that is, the allocation of privileges and roles. Rather, these are provided in Oracle8i by the Oracle server.

Because SSL does authentication and encryption, from a performance standpoint it is slower than the standard Net8 TCP/IP transport.

The SSL feature of the Oracle Advanced Security option does not work with versions of Oracle earlier than Oracle8i.

Each SSL authentication mode as described requires unique configuration settings. These unique settings are explained in the section "Enabling SSL".

Enabling SSL

To enable SSL, you perform the general tasks in the following list. Each task is explained more fully in the next several pages.

Step 1: Install Oracle Advanced Security and the Oracle Wallet Manager

Do this on both the client and server.

When you install the Oracle Advanced Security option, the Oracle Universal Installer adds both SSL and the Oracle Wallet Manager to your system.

More Information:
See the Oracle8i installation documentation for your platform.

Step 2: Configure SSL on the client

To configure SSL on the client, perform the tasks in the following list, each of which is described more fully below.

There are two ways to configure a parameter:

Static--setting the parameter in sqlnet.ora. You can set the location of the Oracle wallet and modify the default settings of any of the other parameters either by using the Net8 Assistant (Figure 9-5) or by editing the sqlnet.ora file with any text editor.
Dynamic--setting the parameter in the security subsection of the Net8 address.

More Information:
For the dynamic parameter names, see "Parameters for Clients and Servers using SSL".

Using Net8 Assistant

This graphical interface tool makes it easy to set parameters in the sqlnet.ora file and other Oracle8i configuration files.

To launch Net8 Assistant:

On UNIX, run the script netasst at $ORACLE_HOME/bin.
On Windows platforms, click the Start button > Programs > Oracle for Windows NT--HOME_NAME > Net8 Assistant.

To begin configuring the Oracle Advanced Security option using Net8 Assistant:

In the Net8 Assistant's left pane, click the Profile folder. Then go to the drop down list box at the top of the right pane, and select Advanced Security Option. The tabbed pages for the Oracle Advanced Security option appear.

To save changes with Net8 Assistant:

Go to the menu bar and click File > Save Network Configuration.

If you have not yet configured SSL, specify client configuration

You need to do this only if you are using Net8 Assistant.

Figure 9-5 Using Net8 Assistant to Specify Client Configuration

Refer to Figure 9-5.

In the right pane, select the SSL tab.
On the SSL tabbed page, select the Configure SSL for Client radio button. The SSL tabbed page changes to allow you to make the appropriate configurations for the client (Figure 9-6 ).

Figure 9-6 Net8 Assistant's SSL Tabbed Page for Configuring a Client

Set the Oracle wallet location

Do this by setting the The OSS.SOURCE.MY_WALLET parameter. There is no default for this parameter.

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-6.

At the top of the SSL tabbed page, be sure that the Configure SSL for Client radio button is selected.

In the Wallet Directory box, type the directory for the Oracle wallet. To find it by searching your file system, click the Browse button.

Note: You must enter this same directory later when you come to "Step 5: Create a new wallet".

Set the following parameter:
oss.source.my_wallet = (SOURCE= (METHOD=File) (METHOD_DATA= (DIRECTORY=<your_wallet_
location>)

)
)

Use the Net8 Assistant...	... or modify SQLNET.ORA
Refer to Figure 9-6. At the top of the SSL tabbed page, be sure that the Configure SSL for Client radio button is selected. In the Wallet Directory box, type the directory for the Oracle wallet. To find it by searching your file system, click the Browse button. Note: You must enter this same directory later when you come to "Step 5: Create a new wallet".	Set the following parameter: oss.source.my_wallet = (SOURCE= (METHOD=File) (METHOD_DATA= (DIRECTORY=<your_wallet_ location>) ) )

Set the SSL cipher suites (optional)

A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities. During an SSL handshake, two entities negotiate to see which cipher suite they will use when transmitting messages back and forth.

The SSL_CIPHER_SUITES parameter sets the cipher suites SSL uses.

When you install the Oracle Advanced Security option, several SSL cipher suites are set for you by default. Setting one or more cipher suites yourself overrides the other default cipher suites set during installation. For example, if you use Net8 Assistant to add the cipher suite SSL_RSA_WITH_RC4_128_SHA, all other cipher suites in the default setting are ignored.

You can prioritize the cipher suites. When the client negotiates with servers regarding which cipher suite to use, it follows the prioritization you set. When you prioritize the cipher suites, consider the following:

The level of security you want to use. For example, triple-DES encryption is stronger than DES.
The impact on performance. For example, triple-DES encryption is slower than DES.
Administrative requirements. The cipher suites selected for a client must be compatible with those required by the server. For example, in the case of an Oracle Call Interface (OCI) user, the server requires the client to authenticate itself. You cannot, in this case, use a cipher suite employing Diffie-Hellman anonymous authentication which disallows the exchange of certificates. By contrast, in the case of an Enterprise Java Beans (EJB) user, the server does not require the client to authenticate itself. In this case, you can use Diffie-Hellman anonymous authentication.

Normally, you would prioritize cipher suites starting with the strongest and moving to the weakest.

The following two tables list the available SSL cipher suites supported in both the domestic and export versions of the Oracle Advanced Security option. These cipher suites are set by default when you install Oracle Advanced Security option. These tables also list the authentication, encryption, and data integrity types each cipher suite uses.

Table 9-1 SSL Cipher Suites in Domestic Version of Oracle Advanced Security

Cipher Suite	Authentication	Encryption	Data Integrity
SSL_RSA_WITH_3DES_EDE_CBC_SHA	RSA	3DES EDE CBC	SHA
SSL_RSA_WITH_RC4_128_SHA	RSA	RC4 128	SHA
SSL_RSA_WITH_RC4_128_MD5	RSA	RC4 128	MD5
SSL_RSA_WITH_DES_CBC_SHA	RSA	DES CBC	SHA
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA	DH anon	3DES EDE CBC	SHA
SSL_DH_anon_WITH_RC4_128_MD5	DH anon	RC4 128	MD5
SSL_DH_anon_WITH_DES_CBC_SHA	DH anon	DES CBC	SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5	RSA	RC4 40	MD5
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA	RSA	DES40 CBC	SHA
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5	DH anon	RC4 40	MD5
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA	DH anon	DES40 CBC	SHA

Table 9-2 SSL Cipher Suites in Export Version of Oracle Advanced Security

Cipher Suite	Authentication	Encryption	Data Integrity
SSL_RSA_EXPORT_WITH_RC4_40_MD5	RSA	RC4 40	MD5
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA	RSA	DES40 CBC	SHA
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5	DH anon	RC4 40	MD5
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA	DH anon	DES40 CBC	SHA

Note:
If you use SSL in conjunction with another authentication method supported by the Oracle Advanced Security option, you must disable any non-SSL encryption to comply with government regulations prohibiting double encryption. If you do not do this, the connection will fail.
For information on how to disable encryption in the Oracle Advanced Security option, see "Negotiating Encryption and Checksumming".

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-6 .

At the top of the SSL tabbed page, be sure that the Configure SSL for Client radio button is selected.

Click the Add button. A secondary dialog box (Figure 9-7) listing available cipher suites appears.

To add a suite to your list, select it in the secondary dialog box and click OK. The cipher suite appears in the Cipher Suite Configuration window of the main Net8 Assistant dialog box.

To prioritize the cipher suites, use the Promote and Demote buttons. The order you set determines the order in which the client is to negotiate with other entities on which cipher suite to use.

Set the following parameter in the server's sqlnet.ora file, listing the cipher suites in priority:
SSL_CIPHER_SUITES=
(SSL cipher suite1 [,SSL
cipher suite2])

Use the Net8 Assistant...	... or modify SQLNET.ORA
Refer to Figure 9-6 . At the top of the SSL tabbed page, be sure that the Configure SSL for Client radio button is selected. Click the Add button. A secondary dialog box (Figure 9-7) listing available cipher suites appears. To add a suite to your list, select it in the secondary dialog box and click OK. The cipher suite appears in the Cipher Suite Configuration window of the main Net8 Assistant dialog box. To prioritize the cipher suites, use the Promote and Demote buttons. The order you set determines the order in which the client is to negotiate with other entities on which cipher suite to use.	Set the following parameter in the server's sqlnet.ora file, listing the cipher suites in priority: SSL_CIPHER_SUITES= (SSL cipher suite1 [,SSL cipher suite2]`)`

Figure 9-7 Net8 Assistant Secondary Dialog Box: Selecting a Cipher Suite

Set the required SSL version (optional)

Do this by setting the SSL_VERSION parameter. This parameter determines which version of SSL must be running on the machines with which the client is communicating. You can require those machines to use SSL 3.0, or any existing or future versions. The default setting for this parameter in sqlnet.ora is "0"; in Net8 Assistant it is "Any".

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-6 .

At the top of the SSL tabbed page, be sure that the Configure SSL for Client radio button is selected.

In the Require SSL Version scroll box the default is Any. Accept this default or select the SSL version you want to enforce.

Set the following parameter:
SSL_VERSION={ 0 | 3.0 }

Use the Net8 Assistant...	... or modify SQLNET.ORA
Refer to Figure 9-6 . At the top of the SSL tabbed page, be sure that the Configure SSL for Client radio button is selected. In the Require SSL Version scroll box the default is Any. Accept this default or select the SSL version you want to enforce.	Set the following parameter: SSL_VERSION={ 0 \| 3.0 }

Set SSL as an authentication service (optional)

The SQLNET.AUTHENTICATION_SERVICES parameter sets the SSL authentication service.

You must set this parameter only if both of the following two conditions apply:

You want to use SSL authentication in conjunction with another authentication method supported by the Oracle Advanced Security option. For example, you want the server to authenticate itself to the client by using SSL, and the client to authenticate itself to the server by using Kerberos or SecurID.

and
You are not using Net8 Assistant to make you configurations.

If both of the above conditions apply, add TCPS to this parameter in the sqlnet.ora file by using a text editor. For example:

 SQLNET.AUTHENTICATION_SERVICES = (BEQ, 

                                    TCPS,
                                    identix,
                                    securid)

If either or both of the above conditions do not apply, you do not need to set this parameter.

Select "TCP/IP with SSL" as the Net Service Name

The client must be configured with the location of the listener. For an SSL connection, the address of the listener must use the TCP/IP with SSL protocol.

More Information:
See the on-line help for the Net8 Assistant and the Net8 Administrator's Guide.

Step 3: Configure SSL on the server

During installation, Oracle sets defaults on both the Oracle server and the Oracle client for all SSL parameters except the location of the Oracle wallet. To configure SSL on the server, perform the tasks in the following list, each of which is described below.

As with the Oracle client, there are two ways to configure a parameter on the Oracle server:

Static--setting the parameter in sqlnet.ora. You can set the location of the Oracle wallet, and modify the default settings of any of the other parameters, either by using the Net8 Assistant or by editing the sqlnet.ora file with any text editor.
Dynamic--setting the parameter in the security subsection of the Net8 address.

More Information:
For the dynamic parameter names, see "Parameters for Clients and Servers using SSL".

Using Net8 Assistant

This graphical interface tool makes it easy to set parameters in the sqlnet.ora file and other Oracle8i configuration files.

To launch Net8 Assistant:

On UNIX, run the script netasst at $ORACLE_HOME/bin.
On Windows platforms, click the Start button > Programs > Oracle for Windows NT--HOME_NAME > Net8 Assistant.

To begin configuring the Oracle Advanced Security option using Net8 Assistant:

To save changes with Net8 Assistant:

Go to the menu bar and click File > Save Network Configuration.

If you have not yet configured SSL, specify server configuration

You need to do this only if you are using Net8 Assistant.

Figure 9-8 Using Net8 Assistant to Specify Server Configuration

Refer to Figure 9-8.

In the right pane, select the SSL tab.
On the SSL tabbed page, select the Configure SSL for Server radio button. The SSL tabbed page changes to allow you to make the appropriate configurations for the server (Figure 9-9 ).

Figure 9-9 Net8 Assistant's SSL Tabbed Page for Configuring a Server

Set the Oracle wallet location

Do this by setting the OSS.SOURCE.MY_WALLET parameter. There is no default for this parameter.

Note:
There are two occasions during the client and the server configuration when you set the location of the Oracle wallet. Be sure to enter the same location on both occasions.

On the occasion described in this section, you set the location of the wallet either by using the Net8 Assistant or by modifying the file sqlnet.ora.

Later, you use the Oracle Wallet Manager as described in "Step 5: Create a new wallet".

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-9 .

At the top of the SSL tabbed page, be sure that the Configure SSL for Server radio button is selected.

In the Wallet Directory box, type the directory for the Oracle wallet. To find it by searching your file system, click the Browse button

Note: You must enter this same directory later when you come to "Step 5: Create a new wallet".

Set the following parameter:
oss.source.my_wallet = (SOURCE= (METHOD=File) (METHOD_DATA= (DIRECTORY=your wallet location)

)
)

Use the Net8 Assistant...	... or modify SQLNET.ORA
Refer to Figure 9-9 . At the top of the SSL tabbed page, be sure that the Configure SSL for Server radio button is selected. In the Wallet Directory box, type the directory for the Oracle wallet. To find it by searching your file system, click the Browse button Note: You must enter this same directory later when you come to "Step 5: Create a new wallet".	Set the following parameter: oss.source.my_wallet = (SOURCE= (METHOD=File) (METHOD_DATA= (DIRECTORY=your wallet location) ) )

Set the SSL cipher suites (optional)

The SSL_CIPHER_SUITES parameter sets the cipher suites SSL uses.

You can prioritize the cipher suites. When the server negotiates with clients over which cipher suite to use, it follows the prioritization you set.

When you prioritize the cipher suites, consider the following:

The level of security you want to effect. For example, triple-DES encryption is stronger than DES. See "SSL Can Provide Triple-DES".
The impact on performance. For example, Triple-DES encryption is slower than DES.

Administrative requirements. The cipher suites selected for a server must be compatible with those required by the client. For example, in the case of an Oracle Call Interface (OCI) user, the server requires the client to authenticate itself. In this case, you cannot use a cipher suite employing Diffie-Hellman anonymous authentication which disallows the exchange of certificates. By contrast, in the case of an Enterprise Java Beans (EJB) user, the server does not require the client to authenticate itself. In this case, you can use Diffie-Hellman anonymous authentication.

Note:
Inversion 8.1.5 of the Oracle Advanced Security option, if you set a cipher suite employing Diffie-Hellman anonymous authentication on the server, you must also set the same cipher suite on the client. Otherwise, the connection will fail.
If you have decided to use a cipher suite employing Diffie-Hellman anonymous, you must set the SSL_CLIENT_AUTHENTICATION parameter to FALSE. See "Set SSL client authentication (optional)".

Normally, you would prioritize cipher suites starting with the strongest and moving to the weakest.

The following two tables list the available SSL cipher suites supported in both the domestic and export versions of the Oracle Advanced Security option. These tables also list the authentication, encryption, and data integrity types each cipher suite uses.

Table 9-3 SSL Cipher Suites in Domestic Version of Oracle Advanced Security

Cipher Suite	Authentication	Encryption	Data Integrity
SSL_RSA_WITH_3DES_EDE_CBC_SHA	RSA	3DES EDE CBC	SHA
SSL_RSA_WITH_RC4_128_SHA	RSA	RC4 128	SHA
SSL_RSA_WITH_RC4_128_MD5	RSA	RC4 128	MD5
SSL_RSA_WITH_DES_CBC_SHA	RSA	DES CBC	SHA
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA	DH anon	3DES EDE CBC	SHA
SSL_DH_anon_WITH_RC4_128_MD5	DH anon	RC4 128	MD5
SSL_DH_anon_WITH_DES_CBC_SHA	DH anon	DES CBC	SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5	RSA	RC4 40	MD5
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA	RSA	DES40 CBC	SHA
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5	DH anon	RC4 40	MD5
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA	DH anon	DES40 CBC	SHA

Table 9-4 SSL Cipher Suites in Export Version of Oracle Advanced Security

Cipher Suite	Authentication	Encryption	Data Integrity
SSL_RSA_EXPORT_WITH_RC4_40_MD5	RSA	RC4 40	MD5
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA	RSA	DES40 CBC	SHA
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5	DH anon	RC4 40	MD5
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA	DH anon	DES40 CBC	SHA

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-9 .

At the top of the SSL tabbed page, be sure that the Configure SSL for Server radio button is selected.

Click the Add button. A secondary dialog box (Figure 9-10) listing available cipher suites appears.

To add a suite to your list, select it in the secondary dialog box and click OK. The cipher suite appears in the Cipher Suite Configuration window of the main Net8 Assistant dialog box.

To prioritize the cipher suites, use the Promote and Demote buttons. The order you set determines the order in which the server is to negotiate with other entities on which cipher suite to use.

Set the following parameter in the server's sqlnet.ora file, listing the cipher suites in priority:
SSL_CIPHER_SUITES=
(SSL cipher suite1 [,SSL
cipher suite2])

Figure 9-10 Net8 Assistant Secondary Dialog Box: Selecting a Cipher Suite

Set the required SSL version (optional)

Do this by setting the SSL_VERSION parameter. This parameter determines which version of SSL must be running on the machines with which the server communicates. You can require those machines to use SSL 3.0 or any existing or future versions.

The default setting for this parameter in sqlnet.ora is "0"; in Net8 Assistant it is "Any." Oracle recommends accepting the default value which allows clients with previous SSL versions to interoperate with servers using later SSL versions.

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-9 .

At the top of the SSL tabbed page, be sure that the Configure SSL for Server radio button is selected.

In the Require SSL Version list box the default is Any. Accept this default or select the SSL version you want to enforce.

Set the following parameter:
SSL_VERSION={ 0 | 3.0}

Set SSL client authentication (optional)

The SSL_CLIENT_AUTHENTICATION parameter controls whether the client is authenticated using SSL. The default value is TRUE.

You must set this parameter to FALSE if you are using a cipher suite that contains Diffie-Hellman anonymous authentication (DH_anon). Also, you may want to set this parameter to FALSE if you want the client to authenticate itself to the server by using any of the non-SSL authentication methods supported by Oracle Advanced Security option, for example, Kerberos, Identix, etc.

Use the Net8 Assistant... ... or modify SQLNET.ORA

Refer to Figure 9-9 .

At the top of the SSL tabbed page, be sure that the Configure SSL for Server radio button is selected.

By default, the Require Client Authentication check box is selected. Accept this default, or, if you do not want to require client authentication, deselect this check box.

Set the following parameter:
SSL_CLIENT_AUTHENTICATION={ TRUE | FALSE }

Set SSL as an authentication service (optional)

The SQLNET.AUTHENTICATION_SERVICES parameter sets the SSL authentication service.

You must set this parameter only if both of the following two conditions apply:

You want to use SSL authentication in conjunction with another authentication method supported by the Oracle Advanced Security option. For example, you want the server to authenticate itself to the client by using SSL, and the client to authenticate itself to the server by using Kerberos or SecurID.

and
You are not using Net8 Assistant to make you configurations.

If both of the above conditions apply, add TCPS to this parameter in the sqlnet.ora file by using a text editor. For example:

 SQLNET.AUTHENTICATION_SERVICES = (BEQ, TCPS,
                                   selected_method_1,
                                  selected_method_2)

If either or both of the above conditions do not apply, you do not need to set this parameter.

Select "TCP/IP with SSL" as the listening endpoint

To activate SSL for a client connection, you must select the TCP/IP with SSL protocol as the listening endpoint in listener.ora. If you have IIOP clients connecting to the Java option in the database, be sure the port number is 2482.

More Information:
See the Net8 Administrator's Guide.

Step 4: Start the Oracle Wallet Manager

You use the Oracle Wallet Manager to do the following on both the client and the server:

create a wallet
request a certificate from a certificate authority and install it in the wallet
optionally add new trusted certificates
save a wallet

Note:
If you are not requiring client authentication, you must nevertheless create wallets on both the server and the client, each with a list of trusted certificates.

The way you invoke the Oracle Wallet Manager depends on what kind of system you use.

Windows NT

Start the Oracle Wallet Manager on a Windows NT by clicking Start > Programs > Oracle Wallet Manager > Oracle Wallet Manager. You can also start the application by typing wmtgui at a command prompt. The Oracle Wallet Manager's Oracle Wallet dialog box (Figure 9-11) appears.

Solaris

Type wmtgui at the command line to invoke the Oracle Wallet Manager. The Oracle Wallet Manager's Oracle Wallet dialog box (Figure 9-11) appears.

Figure 9-11 Oracle Wallet Manager

This dialog box displays the default wallet location, the version of the certificate that is stored in the wallet, and the status of the wallet: EMPTY, REQUESTED, or READY. The following tables describe the fields and buttons in the dialog box.

Wallet Location text box

Displays the default wallet file location. Click the Browse... button to locate a wallet at another location.

Help > Wallet Information

Displays the version of the Oracle Wallet Manager that you are using and the status of the certificate (if any) installed in the wallet.

Create

Creates a new wallet.

Delete

Deletes the wallet displayed in this dialog box.

Open

Opens the wallet displayed in this dialog box.

Step 5: Create a new wallet

Follow the steps below to create a new wallet. The steps assume that you have started the Oracle Wallet Manager and are at the program's initial dialog box (Figure 9-11).

Click Create to create a new wallet.

The New Wallet Identity dialog box (Figure 9-12) appears.

Figure 9-12 New Wallet Identity

Type the identity you want to use for your certificate, and click OK.

If you are using single sign-on, make a note of the fields in this dialog box and value you enter in each one. You will need this information later when you create a global user. See "Step 10: Create a user identified globally through certificates on the Oracle server".

The New Wallet location dialog box (Figure 9-13) prompts you to choose a directory on your file system in which to store the new wallet.

Note:
There are two occasions when you set the location of the Oracle wallet. Be sure to enter the same location on both occasions.

On this occasion, you use the Oracle Wallet Manager.

Earlier in the configuration process, you either used the Net8 Assistant or modified the sqlnet.ora file. Depending on which machine you are now configuring, see either "Step 2: Configure SSL on the client" or "Step 3: Configure SSL on the server".

Figure 9-13 Specify Wallet File Location

Type the file location for the new wallet. Click Browse to find a wallet in another directory. Click Cancel to return to the initial program dialog box, or click Next to continue. The New Wallet password dialog box (Figure 9-14) appears.

Figure 9-14 Type a Password for the New Wallet

Type your password once in the Enter Password field, and re-type that same password in the Verify Password field.

Note:
An Error dialog box appears if you do not type exactly the same password in the Enter Password and Verify Password text boxes. Click OK to return to the New Wallet password dialog box, re-type your password in the Enter Password text box, then verify it by re-typing it in the Verify Password text box.

Click Next to continue.

The New Wallet Random Data dialog box (Figure 9-15) appears.

Figure 9-15 New Wallet Random Data

Type a random string of at least 20 characters in length in the field. This character string will be used to seed the public/private key generation. Click OK.

A New Wallet dialog box (Figure 9-16) informs you that the new wallet will overwrite the wallet, certificate and trusted certificates that already exist at the default file location. This occurs when you already have an existing wallet in the default location.

Figure 9-16 Create a New Wallet

Click OK. The Replace Wallet dialog box (Figure 9-17) appears.

Figure 9-17 Replace Wallet dialog box

Click the Replace your old wallet radio button to replace the entire wallet including the certificate and trusted certificates, or click the Replace your old wallet, but reuse... radio button to replace the wallet but reuse the old wallet's trusted certificates. Click Cancel to return to the initial program dialog box, or click OK to continue.

A dialog box (Figure 9-18) displays the location of your certificate request file. This is the file you send to your Certificate Authority.

Figure 9-18 Certificate Request Location

Click View to view your certificate request, or click Close.

The Oracle Wallet dialog box (Figure 9-19) appears with a status value of REQUESTED and a certificate value of NONE.

Figure 9-19 New Wallet with a Requested Certificate

Step 6: Install a certificate into the new wallet

Once you send the certificate request to the certificate authority, wait until you receive an e-mail reply containing your signed certificate. Depending upon the Certificate Authority, you may receive a certificate file such as certificate.txt. Proceed to install the certificate into the new wallet using either of the following two options.

Option 1: Install a Certificate from a File

Open the file from your certificate authority and locate the certificate text. The certificate content is usually delimited by the words Begin Certificate and End Certificate.
Click Install on the Oracle Wallet dialog box (Figure 9-19).

The Install a new Certificate dialog box (Figure 9-20) appears.
Click Browse.

A directory dialog box appears. Use this dialog box to locate the certificate.txt file (it may also have some other name depending upon the Certificate Authority).
Select the file name, and click Open. The contents of the certificate file will appear in the dialog box area (Figure 9-20).

Figure 9-20 Certificate Text Pasted into Window

Click OK.

You are returned to the Oracle Wallet dialog box. Its status changes to READY.

Option 2: Install a Certificate from the Body of an E-mail

Open the e-mail you received from the certificate authority.
Select and copy the certificate text from the body of the e-mail.
Click Paste on the Install a new Certificate dialog box. The certificate text will be pasted into this dialog box (Figure 9-20).
Click OK.
You are returned to the Oracle Wallet dialog box. Its status changes to READY.

Step 7: Add new trusted certificates

A trusted certificate is a third party identity that is qualified with a level of trust. Trusted certificates are contained within a wallet. The trusted certificate is used when an identity is being validated as the entity it claims to be. Trusted certificates are also referred to as trustpoints.

A default set of trusted certificates from VeriSign is installed in your default wallet when you install the Oracle Wallet Manager. You manage these trusted certificates by using the Oracle Wallet Manager which enables you to add a new trusted certificate, view existing trusted certificate information, and delete a trusted certificate.

If you are using a certificate that is issued by a CA not yet on your list of trusted certificates, you must add that CA to the list. If a CA's certificate is signed by a root CA, you must add to the list the entire certificate chain, one certificate at a time.

More Information:
For instructions on adding, viewing and managing trusted certificates, see "Managing Trusted Certificates".

Once the wallet is in the file system, applications can start using SSL, provided each application has been configured to locate the wallet.

Step 8: Save changes to your wallet

Click File > Save in the Oracle Wallet dialog box to save changes you make to the wallet.

Step 9: For single sign-on functionality, create an auto-login wallet

If you want to use SSL's single sign-on functionality--as opposed to having users enter passwords each time they open their wallets--you must create an auto-login wallet from the wallet you created earlier in "Step 5: Create a new wallet". You do this by using the command line version of the Oracle Wallet Manager.

To create an auto-login wallet:

Be sure that your sqlnet.ora file has the following lines:

oss.source.my_wallet = 
(SOURCE=
  (METHOD=File)
  (METHOD_DATA=
    (DIRECTORY=your wallet location)
  )
)

Set the following environment variable:
```
setenv TNS_ADMIN your_sqlnet.ora_file
```
Launch the command line version of the Oracle Wallet Manager by typing the following command at the command prompt:
```
owmcmd -f
```
For example:
```
/vobs/oracle/network/bin/owmcmd -f
```
The command line version of the Oracle Wallet Manager prompts you for the user's password.

Enter the password you entered when you created in Step 5: Create a new wallet
The Oracle Wallet Manager prompts you for the Wallet Resource Locator.
Enter the Wallet Resource Locator.

The Oracle Wallet Manager creates the auto-login wallet, names it cwallet.sso, and places it at the Wallet Resource Locator you specified. If the initial wallet is stored on a directory server rather than on the local machine, the Oracle Wallet Manager downloads it from the directory server, uses it to create an auto-login wallet, and places the latter at the Wallet Resource Locator you specified.

Step 10: Create a user identified globally through certificates on the Oracle server

If you are using an enterprise directory service, you create global users in each local database by using the Security Manager tool of the Oracle Enterprise Manager, or by typing the following commands:

CONNECT system/manager@database_name;
CREATE USER username IDENTIFIED GLOBALLY AS 'external_name'

The external_name must match the full distinguished name of the user.

Note:
If you are using a directory server, be sure that the distinguished name in the directory matches that in the Oracle wallet.

About Distinguished Names

A distinguished name consists of up to six fields of information which uniquely identify a user. The fields are:

Common Name (CN)
Location (L)
State (ST)
Organizational Unit (OU)
Organization (O)
Country (C)

The format of a distinguished name begins at the left with the lowest level of granularity:

CN=user, L=location, ST=state, OU=unit, O=organization, C=country

For example, suppose you have a user with the following attributes:

Common Name: Tom Jones
Location: HQ
State: California
Organizational Unit: Information Technologies
Organization: Acme Corporation
Country: US

The full distinguished name of this user would be:

CN=Tom Jones, L=HQ, ST=CA, OU=Information Technologies, O=Acme Corporation, 
C=US

Thus, the following statement creates a new account for Tom Jones:

CREATE USER tjones IDENTIFIED GLOBALLY AS "CN=Tom Jones, L=HQ, ST=CA, 
OU=Information Technologies, O=Acme Corporation, C=US"

To obtain the full distinguished name of an Oracle wallet owner:

Refer to the values you entered in the Create a New Wallet dialog box in "Step 5: Create a new wallet". Start with the field at the bottom of that dialog box, namely, Common Name, and record the value you entered in that field. Then move successively up to the next field, namely, Organizational Unit, and record the value you entered in that field. Then move up to the next field, and so on, until you have recorded the value for each field. Be sure to use the correct format for the distinguished name as described above.

More Information:
Oracle8i Administrator's Guide

Ongoing Administrative Tasks

Once you have initially configured the SSL feature of the Oracle Advanced Security option, there are various tasks you may need to perform from time to time. This section discusses these tasks in the following categories:

Managing Wallets

Use the Oracle Wallet Manager to open, view, or modify an existing wallet or to create a new wallet.

This section discusses the following tasks:

Opening an Existing Wallet
Viewing Wallet Contents

Copying a Wallet to Remote Nodes

More Information:
For information on starting the Oracle Wallet Manager, see "Step 4: Start the Oracle Wallet Manager".
For information on creating a new wallet, see "Step 5: Create a new wallet".
For information on installing a certificate into a new wallet, see "Step 6: Install a certificate into the new wallet".

Opening an Existing Wallet

The Oracle Wallet Manager enables wallet owners to open their default wallets. The default wallet is displayed in the Oracle Wallet Manager Start-up dialog box. Wallet owners must provide a valid Wallet Resource Locator (WRL) and the correct password to open the wallet.

Click Open on the Oracle Wallet Manager start-up dialog box.

The Open Wallet Password dialog box (Figure 9-21) appears.

Figure 9-21 Open the Default Wallet

Type your password. Click Cancel to return to the Oracle Wallet Manager start-up dialog box, or click OK to continue.

The Oracle Wallet dialog box (Figure 9-22) appears.

Note:
An error dialog box titled "Failed to Open wallet!" will appear if you type an incorrect password. Click OK to return to the Oracle Wallet Manager Start-up dialog box. Check your password and try again.

Figure 9-22 Default Wallet

Viewing Wallet Contents

Use the Oracle Wallet dialog box to access functions that allow you to view or modify the wallet's contents. This dialog box contains the following fields and buttons.

Status

Displays the status of the wallet. The three values are EMPTY, REQUESTED, and READY. A status of EMPTY means that no certificate is requested or installed in the wallet. A status of REQUESTED indicates that the certificate request for your wallet has been generated. A status of READY means that you have a certificate.

Location

The directory in which the wallet is stored.

Certificate

The name of the identity for whom this certificate is installed in the wallet.

View

Views the installed certificate.

Install

Installs a new certificate into the wallet.

Trusted certificates

Views and manages the trusted certificates installed in your wallet.

Close

Returns to the Oracle Wallet Manager start-up dialog box.

Copying a Wallet to Remote Nodes

If you are using replicated servers, each node must have the same wallet.

Managing Trusted Certificates

Use the Oracle Wallet Manager to manage the trusted certificates in your wallet. You can add a new trusted certificate, view existing trusted certificate information, and delete a trusted certificate. A default set of four trusted certificates is installed in your default wallet when you install the Oracle Wallet Manager.

This section discusses the following tasks:

Adding a New Trusted Certificate

Add a new trusted certificate to your wallet as follows.

Click Trustpoints on the Oracle Wallet dialog box (Figure 9-22 ).

The Trustpoints dialog box (Figure 9-23 ) appears.

Figure 9-23 Trusted Certificates

Click Add.

The Install a New Trustpoint dialog box (Figure 9-24) appears. This is the dialog box into which you paste the trusted certificate.

Figure 9-24 Install a New Trusted Certificate

Click Paste. The certificate text appears in the body of the dialog box.

Click Next.

The Trustpoint Name dialog box (Figure 9-25) appears.

Figure 9-25 Trustpoint Name Dialog Box

Type a name for the trusted certificate alias. This name can be any set of alphanumeric characters, but it cannot contain any spaces.

Click Cancel to return to the previous dialog box, or click Next to continue.

The trusted certificate you created is added to the list of trusted certificates in the Trustpoints dialog box (Figure 9-23 ).

Click Close, and you are returned to the Oracle Wallet dialog box (Figure 9-22 ).

Viewing Existing Trusted Certificate Information

You can view detailed trusted certificate information from the Trustpoints dialog box as follows.

Click the name of the trusted certificate for which you want to view detailed information.
Click View.

The Trustpoint Certificate dialog box (Figure 9-26 ) appears.

Figure 9-26 Trustpoint Certificate

Review the trusted certificate information that was installed into your wallet. This information includes the certificate identity and the certificate issuer.

Click Extensions to display the X.509 v3 certificate extension information for your wallet trusted certificate, or click Close to return to the Trustpoints dialog box.

Deleting a Trusted Certificate

The Oracle Wallet Manager offers you the option of deleting selected trusted certificates in the event that they become compromised. Delete a trusted certificate from the Trustpoints dialog box (Figure 9-23 ) as follows.

Click the name of the trusted certificate listed in the Trustpoint column to select that trusted certificate.
Click Delete.

A dialog box prompts you with, "Do you really want to delete this trusted certificate?"
Click Yes to delete the trusted certificate.

You are returned to the Trustpoints dialog box, and the deleted trusted certificate is no longer displayed in the trusted certificate list.

If you click No, you are returned to the Trustpoints dialog box, and the trusted certificate remains displayed in the trusted certificate list.
Click Close to return to the Oracle Wallet dialog box.

Saving a Wallet to an Existing WRL (Wallet Resource Locator)

Click File > Save in the Oracle Wallet dialog box to save changes you make to the wallet.

Logging in to the Database

If you are using SSL authentication, launch SQL*Plus and, at the prompt, type the following:

CONNECT/@database_alias

If you are not using SSL authentication, launch SQL*Plus and, at the prompt, type the following:

CONNECT username/password@database_alias

Wallet Location text box	Displays the default wallet file location. Click the Browse... button to locate a wallet at another location.
Help > Wallet Information	Displays the version of the Oracle Wallet Manager that you are using and the status of the certificate (if any) installed in the wallet.

Create	Creates a new wallet.
Delete	Deletes the wallet displayed in this dialog box.
Open	Opens the wallet displayed in this dialog box.

Status	Displays the status of the wallet. The three values are EMPTY, REQUESTED, and READY. A status of EMPTY means that no certificate is requested or installed in the wallet. A status of REQUESTED indicates that the certificate request for your wallet has been generated. A status of READY means that you have a certificate.
Location	The directory in which the wallet is stored.
Certificate	The name of the identity for whom this certificate is installed in the wallet.

View	Views the installed certificate.
Install	Installs a new certificate into the wallet.
Trusted certificates	Views and manages the trusted certificates installed in your wallet.
Close	Returns to the Oracle Wallet Manager start-up dialog box.

9 Configuring SSL Authentication

SSL in an Oracle Environment

What You Can Do with the SSL Feature

Architecture of SSL in an Oracle Environment

Figure 9-1 Architecture of SSL in an Oracle Environment

Components of SSL in an Oracle Environment

Certificate

Certificate Authority (CA)

Wallet

How SSL Works in an Oracle Environment: The SSL Handshake

SSL beyond an Oracle Environment

Figure 9-2 Connecting to an Oracle Server over the Internet

SSL in Combination with Other Authentication Methods

Architecture of SSL in Combination with Other Authentication Methods

Figure 9-3 SSL in Relation to the Oracle Advanced Security Option

Example: Using SSL in Combination with Other Authentication Methods

Figure 9-4 Example: SSL in Relation to Other Oracle Advanced Security Authentication Methods

Issues When Using SSL

Enabling SSL

Step 1: Install Oracle Advanced Security and the Oracle Wallet Manager

Step 2: Configure SSL on the client

Using Net8 Assistant

If you have not yet configured SSL, specify client configuration

Figure 9-5 Using Net8 Assistant to Specify Client Configuration

Figure 9-6 Net8 Assistant's SSL Tabbed Page for Configuring a Client

Set the Oracle wallet location

Set the SSL cipher suites (optional)

Table 9-1 SSL Cipher Suites in Domestic Version of Oracle Advanced Security

Table 9-2 SSL Cipher Suites in Export Version of Oracle Advanced Security

Figure 9-7 Net8 Assistant Secondary Dialog Box: Selecting a Cipher Suite

Set the required SSL version (optional)

Set SSL as an authentication service (optional)

Select "TCP/IP with SSL" as the Net Service Name

Step 3: Configure SSL on the server

Using Net8 Assistant

If you have not yet configured SSL, specify server configuration

Figure 9-8 Using Net8 Assistant to Specify Server Configuration

Figure 9-9 Net8 Assistant's SSL Tabbed Page for Configuring a Server

Set the Oracle wallet location

Set the SSL cipher suites (optional)

Table 9-3 SSL Cipher Suites in Domestic Version of Oracle Advanced Security

Table 9-4 SSL Cipher Suites in Export Version of Oracle Advanced Security

Figure 9-10 Net8 Assistant Secondary Dialog Box: Selecting a Cipher Suite

Set the required SSL version (optional)

Set SSL client authentication (optional)

Set SSL as an authentication service (optional)

Select "TCP/IP with SSL" as the listening endpoint

Step 4: Start the Oracle Wallet Manager

Windows NT

Solaris

Figure 9-11 Oracle Wallet Manager

Step 5: Create a new wallet

Figure 9-12 New Wallet Identity

Figure 9-13 Specify Wallet File Location

Figure 9-14 Type a Password for the New Wallet

Figure 9-15 New Wallet Random Data

Figure 9-16 Create a New Wallet

Figure 9-17 Replace Wallet dialog box

Figure 9-18 Certificate Request Location

Figure 9-19 New Wallet with a Requested Certificate

Step 6: Install a certificate into the new wallet

Option 1: Install a Certificate from a File

Figure 9-20 Certificate Text Pasted into Window

Option 2: Install a Certificate from the Body of an E-mail

Step 7: Add new trusted certificates

Step 8: Save changes to your wallet

Step 9: For single sign-on functionality, create an auto-login wallet

Step 10: Create a user identified globally through certificates on the Oracle server

About Distinguished Names

To obtain the full distinguished name of an Oracle wallet owner:

Ongoing Administrative Tasks

Managing Wallets

Opening an Existing Wallet

Figure 9-21 Open the Default Wallet

Figure 9-22 Default Wallet

Viewing Wallet Contents

Copying a Wallet to Remote Nodes

Managing Trusted Certificates

Adding a New Trusted Certificate

Figure 9-23 Trusted Certificates

9
Configuring SSL Authentication