TLS or Transport Layer Security (earlier called SSL) is a cryptographic protocol that provides secure exchange of data sent between applications over the network.
The TLS protocol provides data privacy and data integrity for routing data over the network between the Distribution Server and Receiver Server as well as the communications between Oracle GoldenGate and the client application like a web browser, Admin Client or any Rest API calls.
This post outlines the process used to create the certificates that are needed for configuring a secure deployment for GoldenGate Microservices. In 19c and 21c we use wallets and in Oracle Goldengate 23ai we use certificates in pem format and not a wallet. (discussed in next post!)
There are two types of certificates commonly used:
- Trusted Certificates from a commercial/business Certificate Authority
- Self-signed certificates are created on your own with orapki or openssl commands.
We will see how to create self-signed certificates and wallets to provide the necessary configuration for a secure 21c GoldenGate deployment.
Create wallets and certificates
# Create Root CA
[oracle@sydney oracle]$ mkdir wallet_ogg21
[oracle@sydney oracle]$ cd wallet_ogg21/
[oracle@sydney wallet_ogg21]$ pwd
/opt/oracle/wallet_ogg21
[oracle@sydney wallet_ogg21]$ orapki wallet create -wallet /opt/oracle/wallet_ogg21/root_ca -auto_login -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/root_ca -dn CN=RootCA -addext_basic_cons -pathlen 10 -keysize 2048 -self_signed -validity 7300 -pwd Oracle_4U -sign_alg sha256
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet export -wallet /opt/oracle/wallet_ogg21/root_ca -dn CN=RootCA -cert /opt/oracle/wallet_ogg21/root_ca/rootCA_Cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
# Source Server (sydney) Wallet
[oracle@sydney wallet_ogg21]$ orapki wallet create -wallet /opt/oracle/wallet_ogg21/sydney -auto_login -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/sydney -dn CN=sydney.localdomain -addext_basic_cons -pathlen 10 -keysize 2048 -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet export -wallet /opt/oracle/wallet_ogg21/sydney -dn CN=sydney.localdomain -request /opt/oracle/wallet_ogg21/sydney/sydney.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki cert create -wallet /opt/oracle/wallet_ogg21/root_ca -request /opt/oracle/wallet_ogg21/sydney/sydney.pem -cert /opt/oracle/wallet_ogg21/sydney/sydney_cert.pem -validity 7300 -sign_alg sha256
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/sydney -trusted_cert -cert /opt/oracle/wallet_ogg21/root_ca/rootCA_Cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/sydney -user_cert -cert /opt/oracle/wallet_ogg21/sydney/sydney_cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet display -wallet /opt/oracle/wallet_ogg21/sydney
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=sydney.localdomain
Trusted Certificates:
Subject: CN=RootCA
[oracle@sydney wallet_ogg21]$
# Target Server (perth) Wallet
[oracle@sydney wallet_ogg21]$ orapki wallet create -wallet /opt/oracle/wallet_ogg21/perth -auto_login -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/perth -dn CN=perth.localdomain -addext_basic_cons -pathlen 10 -keysize 2048 -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet export -wallet /opt/oracle/wallet_ogg21/perth -dn CN=perth.localdomain -request /opt/oracle/wallet_ogg21/perth/perth.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki cert create -wallet /opt/oracle/wallet_ogg21/root_ca -request /opt/oracle/wallet_ogg21/perth/perth.pem -cert /opt/oracle/wallet_ogg21/perth/perth_cert.pem -validity 7300 -sign_alg sha256
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/perth -trusted_cert -cert /opt/oracle/wallet_ogg21/root_ca/rootCA_Cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/perth -user_cert -cert /opt/oracle/wallet_ogg21/perth/perth_cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet display -wallet /opt/oracle/wallet_ogg21/perth
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=perth.localdomain
Trusted Certificates:
Subject: CN=RootCA
[oracle@sydney wallet_ogg21]$
# Client Wallet
[oracle@sydney wallet_ogg21]$ orapki wallet create -wallet /opt/oracle/wallet_ogg21/client -auto_login -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/client -dn CN=client -addext_basic_cons -pathlen 10 -keysize 2048 -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet export -wallet /opt/oracle/wallet_ogg21/client -dn CN=client -request /opt/oracle/wallet_ogg21/client/client_req.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki cert create -wallet /opt/oracle/wallet_ogg21/root_ca -request /opt/oracle/wallet_ogg21/client/client_req.pem -cert /opt/oracle/wallet_ogg21/client/client_Cert.pem -validity 7300 -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/client -trusted_cert -cert /opt/oracle/wallet_ogg21/root_ca/rootCA_Cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet add -wallet /opt/oracle/wallet_ogg21/client -user_cert -cert /opt/oracle/wallet_ogg21/client/client_Cert.pem -pwd Oracle_4U
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Operation is successfully completed.
[oracle@sydney wallet_ogg21]$ orapki wallet display -wallet /opt/oracle/wallet_ogg21/client
Oracle PKI Tool Release 23.0.0.0.0 - Production
Version 23.0.0.0.0
Copyright (c) 2004, 2024, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Subject: CN=client
Trusted Certificates:
Subject: CN=RootCA
[oracle@sydney wallet_ogg21]$
[oracle@perth ~]$ cd /opt/oracle/wallet_ogg21/
[oracle@perth wallet_ogg21]$ ls -l
total 0
drwx------. 2 oracle oracle 135 Mar 26 02:48 client
drwx------. 2 oracle oracle 129 Mar 26 02:30 perth
drwx------. 2 oracle oracle 113 Mar 26 02:12 root_ca
drwx------. 2 oracle oracle 131 Mar 26 02:18 sydney
[oracle@perth wallet_ogg21]$ ls -l ./perth
total 16
-rw-------. 1 oracle oracle 3979 Mar 26 02:33 cwallet.sso
-rw-------. 1 oracle oracle 0 Mar 26 02:26 cwallet.sso.lck
-rw-------. 1 oracle oracle 3934 Mar 26 02:33 ewallet.p12
-rw-------. 1 oracle oracle 0 Mar 26 02:26 ewallet.p12.lck
-rw-------. 1 oracle oracle 1012 Mar 26 02:30 perth_cert.pem
-rw-------. 1 oracle oracle 959 Mar 26 02:28 perth.pem
[oracle@perth wallet_ogg21]$ ls -l ./sydney/
total 16
-rw-------. 1 oracle oracle 3979 Mar 26 02:22 cwallet.sso
-rw-------. 1 oracle oracle 0 Mar 26 02:14 cwallet.sso.lck
-rw-------. 1 oracle oracle 3934 Mar 26 02:22 ewallet.p12
-rw-------. 1 oracle oracle 0 Mar 26 02:14 ewallet.p12.lck
-rw-------. 1 oracle oracle 1012 Mar 26 02:18 sydney_cert.pem
-rw-------. 1 oracle oracle 959 Mar 26 02:17 sydney.pem
[oracle@perth wallet_ogg21]$ ls -l ./client/
total 16
-rw-------. 1 oracle oracle 996 Mar 26 02:48 client_Cert.pem
-rw-------. 1 oracle oracle 943 Mar 26 02:46 client_req.pem
-rw-------. 1 oracle oracle 3963 Mar 26 02:52 cwallet.sso
-rw-------. 1 oracle oracle 0 Mar 26 02:44 cwallet.sso.lck
-rw-------. 1 oracle oracle 3918 Mar 26 02:52 ewallet.p12
-rw-------. 1 oracle oracle 0 Mar 26 02:44 ewallet.p12.lck
[oracle@perth wallet_ogg21]$ ls -l ./root_ca/
total 12
-rw-------. 1 oracle oracle 3963 Mar 26 02:11 cwallet.sso
-rw-------. 1 oracle oracle 0 Mar 26 02:10 cwallet.sso.lck
-rw-------. 1 oracle oracle 3918 Mar 26 02:11 ewallet.p12
-rw-------. 1 oracle oracle 0 Mar 26 02:10 ewallet.p12.lck
-rw-------. 1 oracle oracle 1016 Mar 26 02:12 rootCA_Cert.pem
Launch oggca.sh to create the deployment
In the Security Options screen select the server and client wallets.
Also choose the appropriate Cipher Suites as required.
Test secure connection via Admin Client
[oracle@perth ~]$ export OGG_CLIENT_TLS_CAPATH=/opt/oracle/wallet_ogg21/root_ca/rootCA_Cert.pem
[oracle@perth ~]$ cd /opt/oracle/ogg21c/bin
[oracle@perth bin]$ ./adminclient
Oracle GoldenGate Administration Client for Oracle
Version 21.3.0.0.0 OGGCORE_21.3.0.0.0_PLATFORMS_210728.1047
Copyright (C) 1995, 2021, Oracle and/or its affiliates. All rights reserved.
Oracle Linux 7, x64, 64bit (optimized) on Jul 28 2021 12:32:46
Operating system character set identified as UTF-8.
OGG (not connected) 1> connect https://perth.localdomain:9001 deployment Deployment21 as oggadmin password DreamLiner787##
OGG (https://perth.localdomain:9001 Deployment21) 2> info all
Program Status Group Type Lag at Chkpt Time Since Chkpt
ADMINSRVR RUNNING
DISTSRVR RUNNING
PMSRVR DISABLED
RECVSRVR RUNNING
Note the error returned when we try to connect using ‘perth’ instead of ‘perth.localdomain’ which is the FQDN. The certificate has been created using the FQDN.
OGG (https://perth.localdomain:9001 Deployment21) 3> connect https://perth:9001 deployment Deployment21 as oggadmin password DreamLiner787##
Error: Network error - Certificate validation error: Unacceptable certificate from perth: Application verification failure
