Oracle Client for Encrypted Database Connections

Owned by Richard Ritchie
Last updated: Jun 16, 2021
1 min read

For use when changing oracle client to use tcps

Step-by-step guide

  1. Make a wallet directory and add the cwallet.sso and ewallet.p12 files
  2. Copy access.xml and sqlnet.ora files to the client network/admin directory
  3. Update the database connection string (PROTOCOL=TCPS, PORT=2484, SERVICE_NAME=kfs40t_srv.uits.uconn.edu) in the tnsnames.ora file
  4. Copy oraclepki.jar, osdt_cert.jar, osdt_core.jar to the client lib directory


vi /usr/lib/jvm/jre/lib/security/java.security
security.provider.10=oracle.security.pki.OraclePKIProvider

cp /usr/lib/oracle/12.2/client64/lib/oraclepki.jar /usr/lib/jvm/jre/lib/ext
cp /usr/lib/oracle/12.2/client64/lib/osdt_cert.jar /usr/lib/jvm/jre/lib/ext
cp /usr/lib/oracle/12.2/client64/lib/osdt_core.jar /usr/lib/jvm/jre/lib/ext


vi /opt/tomcat-kfs/bin/setenv.sh
vi /opt/tomcat-rice/bin/setenv.sh
vi wrapper.ksh

#Oracle JDBC encryption with wallet
export CATALINA_OPTS="$CATALINA_OPTS -Doracle.net.tns_admin=/usr/lib/oracle/12.2/client64/network/admin/"
export CATALINA_OPTS="$CATALINA_OPTS -Doracle.net.wallet_location='(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/usr/lib/oracle/12.2/client64/wallet)))'"



vi /srv/uconn_configs/kfs-config/security/security.properties
vi /srv/uconn_configs/rice-config/rice-config.xml
--datasource.url=jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=YES)(FAILOVER=ON)(ADDRESS=(PROTOCOL=TCPS)(HOST=exa02-scan.uits.uconn.edu)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=kfs40t_srv.uits.uconn.edu)(FAILOVER_MODE=(TYPE=SELECT)(METHOD=BASIC)(RETRIES=20)(DELAY=5))))