8 Configuring Secure Sockets Layer Authentication

8.2.2.1 Certificate Authority

A certificate authority (CA) is a trusted third party that certifies the identity of entities, such as users, databases, administrators, clients, and servers. When an entity requests certification, the CA verifies its identity and grants a certificate, which is signed with the CA's private key.

Different CAs may have different identification requirements when issuing certificates. Some CAs may verify a requester's identity with a driver's license, some may verify identity with the requester's fingerprints, while others may require that requesters have their certificate request form notarized.

The CA publishes its own certificate, which includes its public key. Each network entity has a list of trusted CA certificates. Before communicating, network entities exchange certificates and check that each other's certificate is signed by one of the CAs on their respective trusted CA certificate lists.

Network entities can obtain their certificates from the same or different CAs. By default, Oracle Advanced Security automatically installs trusted certificates from VeriSign, RSA, Entrust, and GTE CyberTrust when you create a new wallet.

Oracle Application Server Certificate Authority, part of Oracle Identity Management Infrastructure, is a new Oracle PKI component available in Oracle Application Server 10g (9.0.4).

8.2.2.2 Certificates

A certificate is created when an entity's public key is signed by a trusted certificate authority (CA). A certificate ensures that an entity's identification information is correct and that the public key actually belongs to that entity.

A certificate contains the entity's name, public key, and an expiration date, as well as a serial number and certificate chain information. It can also contain information about the privileges associated with the certificate.

When a network entity receives a certificate, it verifies that it is a trusted certificate, that is, one that has been issued and signed by a trusted certificate authority. A certificate remains valid until it expires or until it is revoked.

8.2.2.3 Certificate Revocation Lists

Typically, when a CA signs a certificate binding a public key pair to a user identity, the certificate is valid for a specified period of time. However, certain events, such as user name changes or compromised private keys, can render a certificate invalid before the validity period expires. When this happens, the CA revokes the certificate and adds its serial number to a Certificate Revocation List (CRL). CAs periodically publish CRLs to alert the user population when it is no longer acceptable to use a particular public key to verify its associated user identity.

When servers or clients receive user certificates in an Oracle environment, they can validate the certificate by checking its expiration date, signature, and revocation status. Certificate revocation status is checked by validating it against published CRLs. If certificate revocation status checking is turned on, then the server searches for the appropriate CRL depending on how this feature has been configured. The server searches for CRLs in the following locations:

1. Local file system

2. Oracle Internet Directory

3. CRL Distribution Point, a location specified in the CRL Distribution Point (CRL DP) X.509, version 3, certificate extension when the certificate is issued.

   See Also:

   "Certificate Validation with Certificate Revocation Lists" for information about configuring and managing this PKI component

8.2.2.4 Wallets

A wallet is a container that is used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL. In an Oracle environment, every entity that communicates over SSL must have a wallet containing an X.509 version 3 certificate, private key, and list of trusted certificates, with the exception of Diffie-Hellman.

Security administrators use Oracle Wallet Manager to manage security credentials on the server. Wallet owners use it to manage security credentials on clients. Specifically, you use Oracle Wallet Manager to do the following:

• Generate a public-private key pair and create a certificate request

• Store a user certificate that matches with the private key

• Configure trusted certificates

  Note:

  Installation of Oracle Advanced Security 11g Release 1 (11.1) also installs Oracle Wallet Manager release 10.1.

  See Also:

  • Chapter 9, "Using Oracle Wallet Manager"

  • "Creating a New Wallet"

  • "Managing Trusted Certificates"

8.2.2.5 Hardware Security Modules

Oracle Advanced Security uses these devices for the following functions:

• Store cryptographic information, such as private keys

• Perform cryptographic operations to off load RSA operations from the server, freeing the CPU to respond to other transactions

Cryptographic information can be stored on two types of hardware devices:

• (Server-side) Hardware boxes where keys are stored in the box, but managed by using tokens.

• (Client-side) Smart card readers, which support storing private keys on tokens.

An Oracle environment supports hardware devices using APIs that conform to the RSA Security, Inc., Public-Key Cryptography Standards (PKCS) #11 specification.

8.6.2.1 Step 1: Confirm Wallet Creation on the Server

Before proceeding to the next step, you must confirm that a wallet has been created. To confirm that your wallet is ready, open it by using Oracle Wallet Manager. The wallet should contain a certificate with a status of Ready and auto login turned on. If auto login is not on, then select it from the Wallet menu and save the wallet again. This turns auto login on.

8.6.2.2 Step 2: Specify the Database Wallet Location on the Server

Use Oracle Net Manager to specify required configuration parameters for the server (Refer to "Starting Oracle Net Manager"):

1. Navigate to the Oracle Advanced Security profile. (Refer to "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security SSL window is displayed. (Figure 8-5).

2. Click the SSL tab and select Configure SSL for: Server.

3. In the Wallet Directory box, enter the directory in which the Oracle wallet is located or click Browse to find it by searching the file system.

   Note that if you are configuring the database-to-directory SSL connection for Enterprise User Security, then Database Configuration Assistant automatically creates a database wallet while registering the database with the directory. You must use that wallet to store the database PKI credentials for SSL-authenticated Enterprise User Security.

   Important:

   • Use Oracle Wallet Manager to create the wallet. Refer to "Creating a New Wallet".

   • Use Oracle Net Manager to set the wallet location in the sqlnet.ora file.

   Ensure that you enter the same wallet location when you create it and when you set the location in the sqlnet.ora file.

1. Select File, Save Network Configuration.

   The sqlnet.ora and listener.ora files are updated with the following entries:

   wallet_location = 
    (SOURCE=
     (METHOD=File)
     (METHOD_DATA=
      (DIRECTORY=wallet_location)))
   

   Note:

   The listener uses the wallet defined in the listener.ora file. It can use any database wallet. When SSL is configured for a server using Net Manager, the wallet location is entered into the listener.ora and the sqlnet.ora files. The listener.ora file is not relevant to the Oracle client.

   To change the listener wallet location so that the listener has its own wallet, you can edit listener.ora to enter the new location.

8.6.2.3 Step 3: Set the SSL Cipher Suites on the Server (Optional)

A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities. During an SSL handshake, two entities negotiate to see which cipher suite they will use when transmitting messages back and forth.

When you install Oracle Advanced Security, the SSL cipher suites listed in Table 8-1 are set for you by default and negotiated in the order they are listed. You can override the default order by setting the SSL_CIPHER_SUITES parameter. For example, if you use Oracle Net Manager to add the cipher suite SSL_RSA_WITH_RC4_128_SHA, all other cipher suites in the default setting are ignored.

You can prioritize the cipher suites. When the client negotiates with servers regarding which cipher suite to use, it follows the prioritization you set. When you prioritize the cipher suites, consider the following:

• Compatibility. Server and client must be configured to use compatible cipher suites for a successful connection.

• Cipher priority and strength. Prioritize cipher suites starting with the strongest and moving to the weakest to ensure the highest level of security possible.

• The level of security you want to use. For example, triple-DES encryption is stronger than DES

• The impact on performance. For example, triple-DES encryption is slower than DES.

  Notes:

  Regarding Diffie-Hellman anonymous authentication:

  1. If you set the server to employ this cipher suite, then you must also set the same cipher suite on the client. Otherwise, the connection fails.

  2. If you use a cipher suite employing Diffie-Hellman anonymous, then you must set the SSL_CLIENT_AUTHENTICATION parameter to FALSE. For more information, refer to "Step 5: Set SSL Client Authentication on the Server (Optional)".

  3. There is a known bug in which an OCI client requires a wallet even when using a cipher suite with DH_ANON, which does not authenticate the client.

Table 8-1 lists the SSL cipher suites supported in the current release of Oracle Advanced Security. These cipher suites are set by default when you install Oracle Advanced Security. The following table also lists the authentication, encryption, and data integrity types each cipher suite uses.

^Footnote 1 AES ciphers work with Transport Layer Security (TLS 1.0) only

To specify cipher suites for the server:

1. Click Add. A dialog box displays available cipher suites (Figure 8-2).

Figure 8-2 SSL Cipher Suites Window

Description of "Figure 8-2 SSL Cipher Suites Window"

1. Select a suite and click OK. The Cipher Suite Configuration list is updated (Figure 8-3):

Figure 8-3 Oracle Advanced Security SSL Window (Server)

Description of "Figure 8-3 Oracle Advanced Security SSL Window (Server)"

1. Use the up and down arrows to prioritize the cipher suites.

2. Select File, Save Network Configuration.

   The sqlnet.ora file is updated with the following entry:

   SSL_CIPHER_SUITES= (SSL_cipher_suite1 [,SSL_cipher_suite2])
   

8.6.2.4 Step 4: Set the Required SSL Version on the Server (Optional)

You can set the SSL_VERSION parameter in the sqlnet.ora file. This parameter defines the version of SSL that must run on the systems with which the server communicates. You can require these systems to use any valid version. The default setting for this parameter in sqlnet.ora is undetermined, which is set by selecting Any from the list in the SSL tab of the Oracle Advanced Security window.

To set the SSL version for the server:

1. In the Require SSL Version list, the default is Any. Accept this default or select the SSL version you want to use.

2. Select File, Save Network Configuration.

   If you chose Any, then the sqlnet.ora file is updated with the following entry:

   SSL_VERSION=UNDETERMINED
   

   Note:

   SSL 2.0 is not supported on the server side.

8.6.2.5 Step 5: Set SSL Client Authentication on the Server (Optional)

The SSL_CLIENT_AUTHENTICATION parameter in the sqlnet.ora file controls whether the client is authenticated using SSL. The default value is TRUE.

You must set this parameter to FALSE if you are using a cipher suite that contains Diffie-Hellman anonymous authentication (DH_anon). Also, you can set this parameter to FALSE for the client to authenticate itself to the server by using any of the non-SSL authentication methods supported by Oracle Advanced Security, such as Kerberos or RADIUS.

To set SSL_CLIENT_AUTHENTICATION to FALSE on the server:

Figure 8-4 Oracle Advanced Security SSL Window (Server)

Description of "Figure 8-4 Oracle Advanced Security SSL Window (Server)"

1. Deselect Require Client Authentication.

2. Select File, Save Network Configuration.

   The sqlnet.ora file is updated with the following entry:

   SSL_CLIENT_AUTHENTICATION=FALSE
   

8.6.2.6 Step 6: Set SSL as an Authentication Service on the Server (Optional)

The SQLNET.AUTHENTICATION_SERVICES parameter in the sqlnet.ora file sets the SSL authentication service.

Set this parameter if you want to use SSL authentication in conjunction with another authentication method supported by Oracle Advanced Security. For example, use this parameter if you want the server to authenticate itself to the client by using SSL and the client to authenticate itself to the server by using Kerberos.

To set the SQLNET.AUTHENTICATION_SERVICES parameter on the server:

Add TCP/IP with SSL (TCPS) to this parameter in the sqlnet.ora file by using a text editor. For example, if you want to use SSL authentication in conjunction with RADIUS authentication, set this parameter as follows:

SQLNET.AUTHENTICATION_SERVICES = (TCPS, radius)

If you do not want to use SSL authentication in conjunction with another authentication method, then do not set this parameter.

8.6.2.7 Step 7: Create a Listening Endpoint that Uses TCP/IP with SSL on the Server

Configure the listener with a TCP/IP with SSL listening endpoint in the listener.ora file. Oracle recommends using port number 2484 for typical Oracle Net clients.

8.6.3.1 Step 1: Confirm Client Wallet Creation

Before proceeding to the next step, you must confirm that a wallet has been created on the client and that the client has a valid certificate.

8.6.3.2 Step 2: Configure Oracle Net Service Name to Include Server DNs and Use TCP/IP with SSL on the Client

You must specify the server's distinguished name (DN) and TCPS as the protocol in the client network configuration files to enable server DN matching and TCP/IP with SSL connections. Server DN matching prevents the database server from faking its identity to the client during connections by matching the server's global database name against the DN from the server certificate.

You must manually edit the client network configuration files, tnsnames.ora and listener.ora, to specify the server's DN and the TCP/IP with SSL protocol. The tnsnames.ora file can be located on the client or in the LDAP directory. If it is located on the client, then it typically resides in the same directory as the listener.ora file. Depending on the operating system, these files reside in the following directory locations:

• (UNIX) $ORACLE_HOME/network/admin/

• (Windows) ORACLE_BASE\ORACLE_HOME\network\admin\

To edit the tnsnames.ora and listener.ora files, use the following steps:

1. In the client tnsnames.ora file, add the SSL_SERVER_CERT_DN parameter and specify the database server's DN as follows:

   (SECURITY=
   

(SSL_SERVER_CERT_DN="cn=finance,cn=OracleContext,c=us,o=acme"))

The client uses this information to obtain the list of DNs it expects for each of the servers, enforcing the server's DN to match its service name. Example 8-1 shows an entry for the Finance database in the tnsnames.ora file.

Alternatively, the administrator can ensure that the common name (CN) portion of the server's DN matches the service name.

1. In the client tnsnames.ora file, enter tcps as the PROTOCOL in the ADDRESS parameter. This specifies that the client will use TCP/IP with SSL to connect to the database that is identified in the SERVICE_NAME parameter. Example 8-1 also shows an entry that specifies TCP/IP with SSL as the connecting protocol in the tnsnames.ora file.

2. In the listener.ora file, enter tcps as the PROTOCOL in the ADDRESS parameter. Example 8-2 shows an entry that specifies TCP/IP with SSL as the protocol.

finance=
(DESCRIPTION=

(ADDRESS_LIST=

(ADDRESS= (PROTOCOL = tcps) (HOST = finance_server) (PORT = 1575)))

(CONNECT_DATA=

(SERVICE_NAME= Finance.us.acme.com))

(SECURITY=

(SSL_SERVER_CERT_DN="cn=finance,cn=OracleContext,c=us,o=acme"))

LISTENER=

(DESCRIPTION_LIST=

(DESCRIPTION=

(ADDRESS= (PROTOCOL = tcps) (HOST = finance_server) (PORT = 1575))))

8.6.3.3 Step 3: Specify Required Client SSL Configuration (Wallet Location)

Use Oracle Net Manager to specify required configuration parameters for the client (Refer to "Starting Oracle Net Manager"):

1. Navigate to the Oracle Advanced Security profile. (Refer to "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security SSL window is displayed (Figure 8-5):

Figure 8-5 Oracle Advanced Security SSL Window (Client)

Description of "Figure 8-5 Oracle Advanced Security SSL Window (Client)"

1. Click the SSL tab.

2. Select Configure SSL for: Client.

3. In the Wallet Directory box, enter the directory in which the Oracle wallet is located, or click Browse to find it by searching the file system.

4. From the Match server X.509 name list, select one of the following options:

   • Yes: Requires that the server's distinguished name (DN) match its service name. SSL ensures that the certificate is from the server and connections succeed only if there is a match.

     Note:

     This check can be made only when RSA ciphers are selected, which is the default setting.

   • No (default): SSL checks for a match between the DN and the service name, but does not enforce it. Connections succeed regardless of the outcome but an error is logged if the match fails.

   • Let Client Decide: Enables the default.

     Note:

     The following alert is displayed when you select No:

     Security Alert

     Not enforcing the server X.509 name match allows a server to potentially fake its identity. Oracle recommends selecting YES for this option so that connections are refused when there is a mismatch.

5. Select File, Save Network Configuration.

   The sqlnet.ora file on the client is updated with the following entries:

   SSL_CLIENT_AUTHENTICATION =TRUE
   wallet_location = 
    (SOURCE=
     (METHOD=File)
     (METHOD_DATA=
      (DIRECTORY=wallet_location)))
   
   SSL_SERVER_DN_MATCH=(ON/OFF)
   

   See Also:

   For information about the server match parameters:

   • "SSL X.509 Server Match Parameters"

   For information about using Oracle Net Manager to configure TCP/IP with SSL:

   • Oracle Database Net Services Administrator's Guide

   • Oracle Database Net Services Reference

8.6.3.4 Step 4: Set the Client SSL Cipher Suites (Optional)

A cipher suite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network entities. During an SSL handshake, two entities negotiate to see which cipher suite they will use when transmitting messages back and forth.

When you install Oracle Advanced Security, the SSL cipher suites listed in Table 8-1 are set for you by default. This table lists them in the order they are tried when two entities are negotiating a connection. You can override the default by setting the SSL_CIPHER_SUITES parameter. For example, if you use Oracle Net Manager to add the cipher suite SSL_RSA_WITH_RC4_128_SHA, all other cipher suites in the default setting are ignored.

You can prioritize the cipher suites. When the client negotiates with servers regarding which cipher suite to use, it follows the prioritization you set. When you prioritize the cipher suites, consider the following:

• The level of security you want to use. For example, triple-DES encryption is stronger than DES.

• The impact on performance. For example, triple-DES encryption is slower than DES. Refer to "Configuring Your System to Use Hardware Security Modules" for information about using SSL hardware accelerators with Oracle Advanced Security.

• Administrative requirements. The cipher suites selected for a client must be compatible with those required by the server. For example, in the case of an Oracle Call Interface (OCI) user, the server requires the client to authenticate itself. You cannot, in this case, use a cipher suite employing Diffie-Hellman anonymous authentication, which disallows the exchange of certificates.

You typically prioritize cipher suites starting with the strongest and moving to the weakest.

Table 8-1 lists the SSL cipher suites supported in the current release of Oracle Advanced Security. These cipher suites are set by default when you install Oracle Advanced Security. The table also lists the authentication, encryption, and data integrity types each cipher suite uses.

To specify client cipher suites:

1. In the Cipher Suite Configuration region, click Add. A dialog box displays available cipher suites as shown in (Figure 8-2).

2. Select a suite and click OK. The Cipher Suite Configuration list is updated as shown in (Figure 8-6):

Figure 8-6 Oracle Advanced Security SSL Window (Client)

Description of "Figure 8-6 Oracle Advanced Security SSL Window (Client)"

1. Use the up and down arrows to prioritize the cipher suites.

2. Select File, Save Network Configuration.

   The sqlnet.ora file is updated with the following entry:

   SSL_CIPHER_SUITES= (SSL_cipher_suite1 [,SSL_cipher_suite2])
   

8.6.3.5 Step 5: Set the Required SSL Version on the Client (Optional)

You can set the SSL_VERSION parameter in the sqlnet.ora file. This parameter defines the version of SSL that must run on the systems with which the client communicates. You can require these systems to use any valid version. The default setting for this parameter in sqlnet.ora is undetermined, which is set by selecting Any from the list in the SSL tab of the Oracle Advanced Security window. When Any is selected, TLS 1.0 is tried first, then SSL 3.0, and SSL 2.0 are tried in that order. Ensure that the client SSL version is compatible with the version the server uses.

To set the required SSL version for the client:

1. In the Require SSL Version list, the default setting is Any. Accept this default or select the SSL version you want to configure.

2. Select File, Save Network Configuration.

   The sqlnet.ora file is updated. If you selected Any, then it is updated with the following entry:

   SSL_VERSION=UNDETERMINED
   

8.6.3.6 Step 6: Set SSL as an Authentication Service on the Client (Optional)

The SQLNET.AUTHENTICATION_SERVICES parameter in the sqlnet.ora file sets the SSL authentication service. Typically, the sqlnet.ora file is located in the same directory as the other network configuration files. Depending on the platform, the sqlnet.ora file is in the following directory location:

• (UNIX) $ORACLE_HOME/network/admin

• (Windows) ORACLE_BASE\ORACLE_HOME\network\admin\

Set the SQLNET.AUTHENTICATION_SERVICES parameter if you want to use SSL authentication in conjunction with another authentication method supported by Oracle Advanced Security. For example, use this parameter if you want the server to authenticate itself to the client by using SSL and the client to authenticate itself to the server by using RADIUS.

To set the client SQLNET.AUTHENTICATION_SERVICES parameter:

Add TCP/IP with SSL (TCPS) to this parameter in the sqlnet.ora file by using a text editor. For example, if you want to use SSL authentication in conjunction with RADIUS authentication, set this parameter as follows:

SQLNET.AUTHENTICATION_SERVICES = (TCPS, radius)

If you do not want to use SSL authentication in conjunction with another authentication method, then do not set this parameter.

8.8.4.1 Displaying orapki Help

You can display all the orapki commands that are available for managing CRLs by entering the following at the command line:

orapki crl help

This command displays all available CRL management commands and their options.

8.8.4.2 Renaming CRLs with a Hash Value for Certificate Validation

When the system validates a certificate, it must locate the CRL issued by the CA who created the certificate. The system locates the appropriate CRL by matching the issuer name in the certificate with the issuer name in the CRL.

When you specify a CRL storage location for the Certificate Revocation Lists Path field in Oracle Net Manager,which sets the SSL_CRL_PATH parameter in the sqlnet.ora file, use the orapki utility to rename CRLs with a hash value that represents the issuer's name. Creating the hash value enables the server to load the CRLs.

On UNIX operating systems, orapki creates a symbolic link to the CRL. On Windows operating systems, it creates a copy of the CRL file. In either case, the symbolic link or the copy created by orapki are named with a hash value of the issuer's name. Then when the system validates a certificate, the same hash function is used to calculate the link (or copy) name so the appropriate CRL can be loaded.

Depending on the operating system, enter one of the following commands to rename CRLs stored in the file system.

To rename CRLs stored in UNIX file systems:

orapki crl hash -crl crl_filename [-wallet wallet_location] -symlink crl_directory [-summary]

To rename CRLs stored in Windows file systems:

orapki crl hash -crl crl_filename [-wallet wallet_location] -copy crl_directory [-summary]

where crl_filename is the name of the CRL file, wallet_location is the location of a wallet that contains the certificate of the CA that issued the CRL, and crl_directory is the directory where the CRL is located.

Using -wallet and -summary are optional. Specifying -wallet causes the tool to verify the validity of the CRL against the CA's certificate prior to renaming the CRL. Specifying the -summary option causes the tool to display the CRL issuer's name.

8.8.4.3 Uploading CRLs to Oracle Internet Directory

Publishing CRLs in the directory enables CRL validation throughout your enterprise, eliminating the need for individual applications to configure their own CRLs. All applications can use the CRLs stored in the directory where they can be centrally managed, greatly reducing the administrative overhead of CRL management and use.

The user who uploads CRLs to the directory by using orapki must be a member of the directory group CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%). This is a privileged operation because these CRLs are accessible to the entire enterprise. Contact your directory administrator get added to this administrative directory group.

To upload CRLs to the directory, enter the following at the command line:

orapki crl upload -crl crl_location -ldap hostname:ssl_port -user username [-wallet wallet_location] [-summary]

where crl_location is the file name or URL where the CRL is located, hostname and ssl_port (SSL port with no authentication) are for the system on which your directory is installed, username is the directory user who has permission to add CRLs to the CRL subtree, and wallet_location is the location of a wallet that contains the certificate of the CA that issued the CRL.

Using -wallet and -summary are optional. Specifying -wallet causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory. Specifying the -summary option causes the tool to print the CRL issuer's name and the LDAP entry where the CRL is stored in the directory.

The following example illustrates uploading a CRL with the orapki utility:

orapki crl upload -crl /home/user1/wallet/crldir/crl.txt -ldap host1.oracle.com:3533 -user cn=orcladmin

8.8.4.4 Listing CRLs Stored in Oracle Internet Directory

You can display a list of all CRLs stored in the directory with orapki, which is useful for browsing to locate a particular CRL to view or download to your local computer. This command displays the CA who issued the CRL (Issuer) and its location (DN) in the CRL subtree of your directory.

To list CRLs in Oracle Internet Directory, enter the following at the command line:

orapki crl list -ldap hostname:ssl_port

where the hostname and ssl_port are for the system on which your directory is installed. Note that this is the directory SSL port with no authentication as described in the preceding section.

8.8.4.5 Viewing CRLs in Oracle Internet Directory

You can view specific CRLs that are stored in Oracle Internet Directory in a summarized format or you can request a complete listing of revoked certificates for the specified CRL. A summary listing provides the CRL issuer's name and its validity period. A complete listing provides a list of all revoked certificates contained in the CRL.

To view a summary listing of a CRL in Oracle Internet Directory, enter the following at the command line:

orapki crl display -crl crl_location [-wallet wallet_location] -summary

where crl_location is the location of the CRL in the directory. It is convenient to paste the CRL location from the list that displays when you use the orapki crl list command. Refer to, "Listing CRLs Stored in Oracle Internet Directory".

To view a list of all revoked certificates contained in a specified CRL, which is stored in Oracle Internet Directory, enter the following at the command line:

orapki crl display -crl crl_location [-wallet wallet_location] -complete

For example, the following orapki command:

orapki crl display -crl $T_WORK/pki/wlt_crl/nzcrl.txt -wallet $T_WORK/pki/wlt_crl -complete

produces the following output, which lists the CRL issuer's DN, its publication date, date of its next update, and the revoked certificates it contains:

issuer = CN=root,C=us, thisUpdate = Sun Nov 16 10:56:58 PST 2003, nextUpdate = Mon Sep 30 11:56:58 PDT 2013, revokedCertificates = {(serialNo = 153328337133459399575438325845117876415, revocationDate - Sun Nov 16 10:56:58 PST 2003)}
CRL is valid

Using the -wallet option causes the orapki crl display command to validate the CRL against the CA's certificate.

Depending on the size of your CRL, choosing the -complete option may take a long time to display.

You can also use Oracle Directory Manager, a graphical user interface tool that is provided with Oracle Internet Directory, to view CRLs in the directory. CRLs are stored in the following directory location:

cn=CRLValidation,cn=Validation,cn=PKI,cn=Products,cn=OracleContext

8.8.4.6 Deleting CRLs from Oracle Internet Directory

The user who deletes CRLs from the directory by using orapki must be a member of the directory group CRLAdmins. Refer to "Uploading CRLs to Oracle Internet Directory" for information about this directory administrative group.

To delete CRLs from the directory, enter the following at the command line:

orapki crl delete -issuer issuer_name -ldap host:ssl_port -user username [-summary]

where issuer_name is the name of the CA who issued the CRL, the hostname and ssl_port are for the system on which your directory is installed, and username is the directory user who has permission to delete CRLs from the CRL subtree. Ensure that this must be a directory SSL port with no authentication. Refer to, "Uploading CRLs to Oracle Internet Directory" for more information about this port.

Using the -summary option causes the tool to print the CRL LDAP entry that was deleted.

For example, the following orapki command:

orapki crl delete -issuer "CN=root,C=us" -ldap machine1:3500 -user cn=orcladmin -summary

produces the following output, which lists the location of the deleted CRL in the directory:

Deleted CRL at cn=root cd45860c.rN,cn=CRLValidation,cn=Validation,cn=PKI,cn=Products,cn=OracleContext

8.8.5.1 Oracle Net Tracing File Error Messages Associated with Certificate Validation

The following trace messages, relevant to certificate validation, may be logged between the entry and exit entries in the Oracle Net tracing file. Oracle SSL looks for CRLs in multiple locations, so there may be multiple errors in the trace.

Check the following list of possible error messages for information about how to resolve them.

8.9.2.1 Oracle Components Required To Use an nCipher Hardware Security Module

To use an nCipher hardware security module, you need the following components:

• nCipher Hardware Security Module

• Supporting nCipher PKCS #11 library

  The following platform-specific PKCS#11 library is required:

  • libcknfast.so library for UNIX 32-Bit

  • libcknfast-64.so library for UNIX 64-Bit

  • cknfast.dll library for Windows

    Note:

    You must contact your nCipher representative to have the hardware security module or the secure accelerator installed, and to acquire the necessary library.

    These tasks must be performed before you can use an nCipher hardware security module with Oracle Advanced Security.

8.9.2.2 About Installing an nCipher Hardware Security Module

To use the secure accelerator, you must provide the absolute path to the directory that contains the nCipher PKCS #11 library (including the library name) when you create the wallet by using Oracle Wallet Manager. This enables the library to be loaded at runtime. Typically, the nCipher card is installed at the following locations:

• /opt/nfast for UNIX

• C:\nfast for Windows

The nCipher PKCS #11 library is located at the following location for typical installations:

• /opt/nfast/toolkits/pkcs11/libcknfast.so for UNIX 32-Bit

• /opt/nfast/toolkits/pkcs11/libcknfast-64.so for UNIX 64-Bit

• C:\nfast\toolkits\pkcs11\cknfast.dll for Windows

  Note:

  Use the 32-bit library version when using the 32-bit release of Oracle Database and use the 64-bit library version when using the 64-bit release of Oracle Database. For example, use the 64-bit nCipher PKCS #11 library for the Oracle Database for Solaris Operating System (SPARC 64-bit).

8.9.3.1 Oracle Components Required To Use a SafeNET Luna SA Hardware Security Module

To use a SafeNET Luna SA hardware security module, you need the following components

• SafeNET Luna SA Hardware Security Module

• Supporting SafeNET Luna SA PKCS #11 library

  The following platform-specific PKCS#11 library is required:

  • libCryptoki2.so library for UNIX

  • cryptoki.dll library for Windows

8.9.3.2 About Installing a SafeNET Hardware Security Module

To use the secure accelerator, you must provide the absolute path to the directory that contains the SafeNET PKCS #11 library (including the library name) when you create the wallet using Oracle Wallet Manager. This enables the library to be loaded at runtime. Typically, the SafeNET Luna SA client is installed at the following location:

• /usr/lunasa for UNIX

• C:\Program Files\LunaSA for Windows

The SafeNET Luna SA PKCS #11 library is located at the following location for typical installations:

• /usr/lunasa/lib/libCryptoki2.so for UNIX

• C:\Program Files\LunaSA\cryptoki2.dll for Windows

8.9.4.1 Error Messages Associated with Using Hardware Security Modules

The following errors are associated with using PKCS #11 hardware security modules: