时间：2021-07-01 10:21:17 帮助过：2人阅读
This document will demonstrate the steps required to configure SSL/TLS on RAC or SIHA. Instruction is by example and also shows various methods to check the state of the configuration.
"SSL" in this document refers to either SSL or TLS protocols.
1) Configure TCPS protocol endpoints.
In Oracle RAC, clients access one of three scan listeners and are
then routed to database listeners. To support SSL all of these listeners
must have TCPS protocol endpoints.
Follow steps 1.1 & 1.2 below to add TCPS endpoints to the database (node) listeners and then the scan listeners.
Before starting, a check of the listener resources shows support for TCP endpoints:
1.1) Adding TCPS endpoints to the Database listener(s)
Database listener configuration checks:
1.2) Adding TCPS endpoints to scan listeners
Scan listener configuration checks:
2) Update the "local_listener" startup parameter on each node.
PMON
sends the endpoint values stored in local_listener to the SCAN
listeners so that they can create appropriate service handlers. Add the
TCPS endpoints
for the database/node listener that were created in step 1 to the local_listener startup parameter on each node.
2.1) Select a node and identify the local listener endpoints:
The TCPS protocol endpoint is easily identified by the PROTOCOL value.
2.2) Before modifying, review the current local_listener value and make note of it.
2.3) Add the TCPS endpoint identified in step 2.1 to the
local_listener value. Be sure to also set the sid to the local nodes
instance name. Set the scope to memory so that changes can be verified
before updating the spfile.
After modification:
SQL> show parameter local_listener;If the RAC cluster is using COST to restrict instance registration all local/node listener COST value lists must include TCPS. Without a TCPS rule the scan listeners TCPS handlers will go into a blocked state. For more information please see DocID: 1537743.1 "Scan Listener TCPS Service Handlers are Blocked after Implementing COST on an SSL Cluster"
2.4) Once updated in memory PMON notifies the scan listeners (via
registration) of the new local_listener value. Using lsnrctl confirm
that the scan listeners have created service handlers for the new TCPS
endpoints. If the handlers were created properly then commit the change
to the spfile by re-issueing the command with "scope=both" (memory and
spfile). If the scan listeners do not show the new TCPS handlers then
retrace steps and correct any errors. The scan listeners are mirrors of
each other so only one scan listener needs to be checked.
Writing final changes to the spfile:
SQL> alter system set local_listener=‘(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=10.141.155.188)(PORT=1521))(ADDRESS=(PROTOCOL=TCPS)(HOST=10.141.155.188)(PORT=1523))))‘ scope=both sid=‘NETRAC1‘;
2.5) Update the remaining nodes until all nodes are properly registering their TCPS endpoints with the scan listeners.
3) Create SSL certificates and wallets for the cluster and also for clients that will be connecting to the cluster over SSL.
To make a successful SSL connection the server and connecting
clients must have unique SSL certificates that are signed by the same
trusted Certificate Authority. Using the method of choice for your
organization create certificate requests for the cluster and then for a
test client that will connect to the database over SSL. Have those
requests signed by the CA and then build wallets using the signed user
certificates and trusted root certificate. (If this is not a familiar
process use DocID 1489301.1).
In this SSL setup example there are two wallets, one for the
cluster and one for a test client. The user DN‘s for those entities and
for the CA are as follows:
The finished rac cluster (server side) wallet:
The finished client wallet:
Note that the cluster and client wallets have unique identities but share the same trusted certificate. This is the proper wallet setup for an SSL connection.
4) Wallet placement and creation of the obfuscated wallet.
The
finished cluster wallet that was created in step 3 should now to be
copied to each node of the cluster. There is no specific rule to wallet
placement except that the wallet location should be accessable by both
the Database (PMON) and by the scan and local listeners which are
normally running out of the GI home.
In this example we have chosen a DB home wallet location on each node:
In addition to the PKCS12 wallet or ewallet.p12, an additional
wallet file named cwallet.sso must also be created. The cwallet.sso is
an obfuscated mirror copy of the ewallet.p12 and is the file that is
accessed by PMON and listeners. If the cwallet.sso is created on the
cluster it can be copied along with the ewallet.p12 to the wallet
directory on each node. The cwallet.sso can also be created on each node
separately if ewallet.p12 is already in place. Use the following
command run from the same location as ewallet.p12 to create cwallet.sso
(you will be prompted for the wallet password).
5) Define wallet locations in listener.ora and sqlnet.ora.
As
mentioned earlier both PMON and the listener processes of each node
must be able to access the wallets. Each node‘s sqlnet.ora and
listener.ora will need to have wallet locations defined. This step
should be performed on all nodes.
5.1) Listeners on an 11.2 RAC
cluster will normally run out of the Grid Infrastructure (GI) home. Edit
the $GRID_HOME/network/admin/listener.ora and add the following items:
5.2) Instances on an 11.2 RAC cluster run out of the Database
home. Edit the database $ORACLE_HOME/network/admin/sqlnet.ora and add
the following items:
6) Restart instances and listeners.
With
wallets in place and ora files edited the PMON and listener processes
must be restarted so that they pick up the new wallet settings. With the
restart the instances will also use the local_listener values that were
added in step 2. Re-confirm that scan listeners have the proper tcps
handlers, correct any discrepancies.
Command examples:
srvctl stop listener
7) Testing from a cluster node.
With the cluster environment configured for SSL the simplest way to quickly test is to make an SSL connection on one of the cluster nodes.
7.1) Create a connect descriptor that uses the scan listener TCPS endpoint.
NETRACSSL =
7.2) Make a connection with sqlplus and the TCPS connect descriptor.
[oracle@net-rac1 admin]$ sqlplus mike/mike@netracssl
8) Testing from a remote client.
8.1) Create a wallet directory and add the location to the clients sqlnet.ora.
WALLET_LOCATION =
8.2) Move the client wallet created in step 3 to the client wallet directory and create the cwallet.sso.
C:\app\oracle\product\12.1.0.2\dbhome_1\NETWORK\ADMIN\wallet>orapki wallet create -wallet . -auto_login
Enter wallet password:
C:\app\oracle\product\12.1.0.2\dbhome_1\NETWORK\ADMIN\wallet>dir
Volume in drive C has no label.
Volume Serial Number is 0865-9427
Directory of C:\app\oracle\product\12.1.0.2\dbhome_1\NETWORK\ADMIN\wallet
03/06/2012 04:01 PM <DIR> .
03/06/2012 04:01 PM <DIR> ..
02/22/2013 05:53 PM 1,101 cwallet.sso
02/28/2012 02:26 PM 1,024 ewallet.p12
8.3) Create a connect descriptor that uses the scan listener TCPS endpoint.
8.4) Make a connection with sqlplus using the TCPS connect descriptor.
NOTE:1504785.1 - Listener Does Not Create Handlers for Started Services With Multiple Endpoint Registration (ORA-12520, ORA-12516)
NOTE:1489301.1 - Using Orapki as Certificate Authority
NOTE:1537743.1 - Scan Listener TCPS Service Handlers are Blocked after Implementing COST on an SSL Cluster
 To Bottom |
 |
Step by Step Guide: How to Configure SSL/TLS on ORACLE RAC (with SCAN) (Doc ID 1448841.1)
标签：startup via ade deb follow oca color fir srv