Oracle 11g post PSU Oct18 设置ssl连接（使用jks）

看到千里之外的云2025-05-22 21:05

说明

oracle 11g 从PSU 2018Oct（含）及之后的补丁不支持MD5. 要使用JDBC SSL要使用TSL1.2.

update: 2025.05.21. 把jks文件放到jks目录下。而不是lib. wallets_2_jks.sh自动建立此目录。并把jks文件生成在此目录.

生成wallet时，把validate改为3650（10年） -validity 3650

1. 为什么用TSL 1.2

提到:
JDK 7 and JDK 8 releases support TLSv1.2 protocol. The other protocols such as TLSv1.1, TLSv1, SSLv3, and SSLv2 have security vulnerabilities and the recommendation is to use the latest standard version TLSv1.2 and use more secure SSL cipher suites. Follow these pre-requisites below to use TLSv1.2.

TLS 1.2是比较稳定的版本。建议使用它。

2. 使用TSL 1.2 ,需要什么环境

1) ojdbc8.jar

上文提到， 需要ojdbc8.jar, (是jdbc 12.2.0.1 的ojdbc8.jar).

注意，这里的12.2.0.1,不是数据库的版本。 而是JDBC Drivers的版本号。更多版本参看：

实际从19c的$ORACLE_HOME/jdbc下得到ojdbc8.jar. 看其readme：

Oracle JDBC Drivers release 12.2.0.1.0 production Readme.txt
==========================================================

如果从Oracle数据库12cR2的$ORACLE_HOME/jdbc下，看其readme：
Oracle JDBC Drivers release 12.1.0.1.0 production Readme.txt
==========================================================

2) java环境。

需要JDK9 or JDK8u162或者以上

实际使用版本：1.8.0_391.

bash 复制代码 
#cd /usr/local; tar zxvf jdk-8u391-linux-x64.tar.gz
#ln -s /usr/local/jdk1.8.0_391 jdk

并设置oracle的PATH
export PATH=/usr/local/jdk/bin:$ORACLE_HOME/bin:$PATH
java -version 确认版本是1.8
[oracle@RHEL8 trace]$ which java
/usr/local/jdk/bin/java
[oracle@RHEL8 trace]$ java -version
java version "1.8.0_391"
Java(TM) SE Runtime Environment (build 1.8.0_391-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.391-b13, mixed mode)

3. 如何确认jdbc版本和Oracle数据库的支持情况？

文档： How To Configure Oracle JDBC Thin Driver To Connect To Database Using TLS v1.2 (Doc ID 2436911.1)

文档 Starting With Oracle JDBC Drivers - Installation, Certification, and More! (Doc ID 401934.1)

从oracle客户端和数据库之间兼容表：

  • Client / Server Interoperability Support Matrix for Different Oracle
    Versions (Doc ID 207303.1)

可以看到：

Client

Version Server Version

23ai 21c 19c 18c 12.2.0 12.1.0 11.2.0

23ai#11 Yes Yes Yes No No No No

21c Yes Yes Yes Was Was Yes#12 No

19c Yes Yes Yes Was Was Yes#12 Yes#9

18c No Was Was Was Was Was Was#9

12.2.0 No Was Was Was Was Was Was#9

12.1.0 No Yes#12 Yes#12 Was Was Yes#12 Yes#12

11.2.0 No No Yes#9 Was#9 Was#9 Yes#12 Yes#9

数据库 11.2.0 ，客户端可以是 11.2.0, 直到 19c.

4. 其他参考文档

1）TLS Connection String For JDBC Thin Driver Without A Wallet (Doc ID 2970468.1)

把wallet的内容转化为jks

5. 步骤

先在数据库服务器上测试。

1） 生成数据库服务器的wallet

bash 复制代码 
[oracle@RHEL8 scripts]$ cat ssl_sha256_onlyserver.sh
if [ -d /home/oracle/wallets ]; then
        mv /home/oracle/wallets /home/oracle/wallets-`date +%y%m%d-%H%M%S`
fi
mkdir -p /home/oracle/wallets
cd /home/oracle/wallets #进入当前目录

orapki wallet create -wallet ./server_wallet -auto_login -pwd Welcome1_
orapki wallet add -wallet ./server_wallet -sign_alg sha256 -dn "CN=server" -keysize 1024 -self_signed -validity 365 -pwd Welcome1_
orapki wallet display -wallet ./server_wallet
orapki wallet export -wallet ./server_wallet -dn "CN=server" -cert ./server_wallet/cert.txt


# check the alg
openssl x509 -noout -text -in ./server_wallet/cert.txt

注意，如果以前使用了wallets方式，那么修改了/u01/app/oracle/product/11.2.0/db_1/jdk/jre/lib/security/java.security.

如果以前备份过，可以覆盖修改后的。

2) 把wallet转化为jks

参考文档Doc ID 2970468.1

bash 复制代码 
[oracle@testdb1 server_setup]$ cat wallets_2_jks.sh
CURRENT_PATH=$(pwd)
echo $CURRENT_PATH
if [ ! -d $CURRENT_PATH/../jks ]; then
        mkdir $CURRENT_PATH/../jks
fi
cd  /home/oracle/wallets && orapki wallet pkcs12_to_jks -wallet ./server_wallet -pwd Welcome1_ -jksTrustStoreLoc $CURRENT_PATH/../jks/truststore.jks -jksTrustStorepwd Welcome1_ -jksKeyStoreLoc $CURRENT_PATH/../jks/keystore.jks -jksKeyStorepwd Welcome1_

3) 配置侦听

添加tpcs的端口

bash 复制代码 
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /home/oracle/wallets/server_wallet)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = RHEL8.localdomain)(PORT = 1521))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = 192.168.56.89)(PORT = 2484))
    )
  )

ADR_BASE_LISTENER = /u01/app/oracle

修改sqlnet.ora

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

ADR_BASE = /u01/app/oracle

SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /home/oracle/wallets/server_wallet)
    )
  )

SQLNET.AUTHENTICATION_SERVICES= (BEQ,TCPS, NTS)

4) 重启侦听

bash 复制代码 
lsnrctl stop
lsnrctl start

5) 修改测试java程序

下载测试程序，

修改连接符, 用户名密码

java 复制代码 
final static String DB_URL = "jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(PORT=2484)(HOST=192.168.56.89))"
    + "(CONNECT_DATA=(SERVICE_NAME=orcl))"
    + "(SECURITY=(SSL_SERVER_CERT_DN=\"CN = server\")))";

  // For ATP and ADW - use the TNS Alias name along with the TNS_ADMIN when using 18.3 JDBC driver
  // final static String DB_URL="jdbc:oracle:thin:@wallet_dbname?TNS_ADMIN=/Users/test/wallet_dbname";
  // In case of windows, use the following URL
  // final static String DB_URL="jdbc:oracle:thin:@wallet_dbname?TNS_ADMIN=C:/Users/test/wallet_dbname";
  final static String DB_USER = "system";
  final static String DB_PASSWORD = "oracle";

6) 准备测试数据employees表

为systme用户建表employees,测试使用

sql 复制代码 
sqlplus system/oracle
create table employees(first_name varchar2(10), last_name varchar2(10));
insert into employees values('a','a')
commit;

7) 测试脚本run.sh

bash 复制代码 
[oracle@testdb1 jdbc_tsl_jks]$ cat run.sh
javac -cp .:ojdbc8.jar DataSourceSample.java
java -cp .:ojdbc8.jar \
-Doracle.net.ssl_server_dn_match="false" \
-Djavax.net.ssl.trustStore="/home/oracle/jdbc_tsl/jks/truststore.jks" \
-Djavax.net.ssl.trustStorePassword="Welcome1_" \
-Djavax.net.ssl.trustStoreType="JKS" \
-Djavax.net.ssl.keyStore="/home/oracle/jdbc_tsl/jks/keystore.jks" \
-Djavax.net.ssl.keyStoreType="JKS" \
-Djavax.net.ssl.keyStorePassword="Welcome1_" DataSourceSample
#-Djavax.net.debug=all \
#-Djavax.net.debug=ssl,handshake \

使用了前面生成的jks文件，密码，调试时可以加上最后的debug参数

8) 测试

bash 复制代码 
[oracle@RHEL8 jdbc_tsl]$ ./run.sh
Driver Name: Oracle JDBC driver
Driver Version: 19.9.0.0.0
Default Row Prefetch Value is: 20
Database Username is: SYSTEM

FIRST_NAME  LAST_NAME
---------------------
a a

6. 在客户端测试

1)

把/home/oracle/jdbc_tls压缩复制到客户端并解压到相同的/home/oracle/jdb_tls目录。

这里面包含了jks文件。

不需要复制wallets和sqlnet.ora

2)客户端安装jdk 1.8,

bash 复制代码 
#cd /usr/local; tar zxvf jdk-8u391-linux-x64.tar.gz
#ln -s /usr/local/jdk1.8.0_391 jdk

并设置oracle的PATH

export PATH=/usr/local/jdk/bin: O R A C L E H O M E / b i n : ORACLE_HOME/bin: ORACLEHOME/bin:PATH

java -version 确认版本是1.8

3)客户端测试

bash 复制代码 
[oracle@hol jdbc_tsl]$ ./run.sh
Driver Name: Oracle JDBC driver
Driver Version: 19.9.0.0.0
Default Row Prefetch Value is: 20
Database Username is: SYSTEM

FIRST_NAME  LAST_NAME
---------------------
a a

7. 其他错误分析

https://www.oracle.com/database/technologies/application-development/jdbc-eecloud-troubleshooting-tips.html

相关推荐
qq_192779873 小时前
高级爬虫技巧：处理JavaScript渲染（Selenium）
jvm·数据库·python
u0109272713 小时前
使用Plotly创建交互式图表
jvm·数据库·python
爱学习的阿磊3 小时前
Python GUI开发：Tkinter入门教程
jvm·数据库·python
tudficdew4 小时前
实战：用Python分析某电商销售数据
jvm·数据库·python
sjjhd6524 小时前
Python日志记录（Logging）最佳实践
jvm·数据库·python
Configure-Handler4 小时前
buildroot System configuration
java·服务器·数据库
2301_821369614 小时前
用Python生成艺术：分形与算法绘图
jvm·数据库·python
电商API_180079052475 小时前
第三方淘宝商品详情 API 全维度调用指南：从技术对接到生产落地
java·大数据·前端·数据库·人工智能·网络爬虫
Genie cloud5 小时前
1Panel SSL证书申请完整教程
服务器·网络协议·云计算·ssl
2401_832131955 小时前
Python单元测试（unittest）实战指南
jvm·数据库·python
热门推荐
01GitHub 镜像站点02Clawdbot 中文汉化版 接入微信、飞书03OpenClaw部署与配置教程：在Mac mini上接入国产大模型与飞书042026美赛A题智能手机电池续航时间预测的连续时间数学模型05OpenCode 入门教程：介绍 · 安装 · 配置第三方 API (如 Claude)06UV安装并设置国内源07Linux下V2Ray安装配置指南08Claude Code + GLM4.7 避坑指南：解决 Unable to connect to Anthropic services092025 年大语言模型发展回顾：关键突破、意外转折与 2026 年展望10Claude Code Skills 实用使用手册