In this post we will see how we can configure security in GoldenGate 23ai Microservices deployments using certificates.
In an earlier post (https://gavinsoorma.com.au/knowledge-base/configuring-a-secure-goldengate-21c-deployment-with-certificates-and-wallets/) we discussed configuring security in a GoldenGate 21c deployment – in GoldenGate 23ai we do not use wallets any longer as in the case of previous versions.
In GoldenGate 23ai we need to provide the location of the .pem file and private key file.
In the following post we will see how the certificates created are used to configure a security in deployments as well as create a secure Distribution Path between two different deployments.
Environment
- GoldenGate 23ai Microservices Source deployment: sydney
- GoldenGate 23ai Microservices Target deployment: perth
Sydney (Source)
- Server Certificate
- Root CA Certificate
- Client Certificate (Local)
- Client Certificate (Target)
- Root CA Certificate (Target) – which was used to sign Client Certificate (Target)
Create Server Certificate
[oracle@sydney oracle]$ mkdir -p /opt/oracle/ogg23ai_certs
[oracle@sydney ~]$ cat certs_sydney.sh
v_server_fqdn_01=sydney.localdomain
v_server_short_01=`echo $v_server_fqdn_01 | cut -d '.' -f 1`
v_passphrase="DreamLiner787##"
cat <<EOF> /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_cert.cnf
extendedKeyUsage = serverAuth
subjectAltName = DNS:${v_server_short_01},DNS:${v_server_fqdn_01},DNS:localhost,IP:127.0.0.1
EOF
#----------------------------------------------------------------------
#--
#-- Server Certificate SYDNEY`
#--
#----------------------------------------------------------------------
subject="/C=AU/O=OGG23/CN=${v_server_short_01}"
openssl req -subj "${subject}" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_key.pem \
-new \
-out /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}.csr
openssl x509 -CAcreateserial \
-CA /opt/oracle/ogg23ai_certs/RootCA_SYD_cert.pem \
-CAkey /opt/oracle/ogg23ai_certs/RootCA_SYD_key.pem \
-req \
-in /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}.csr \
-extfile /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_cert.cnf \
-days 365 \
-out /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_cert.pem
printf "\nSuccessfully created Server certificate for GoldenGate.\n"
tree -lt -L 1 /opt/oracle/ogg23ai_certs/
exit 0
[oracle@sydney ~]$ ./certs_sydney.sh
Generating a RSA private key
.......+++++
.....................................................................................+++++
writing new private key to '/opt/oracle/ogg23ai_certs/Server_sydney_key.pem'
-----
Signature ok
subject=C = AU, O = OGG23, CN = sydney
Getting CA Private Key
Successfully created Server certificate for GoldenGate.
/opt/oracle/ogg23ai_certs/
??? Server_sydney_cert.cnf
??? Server_sydney_cert.pem
??? Server_sydney.csr
??? Server_sydney_key.pem
0 directory, 3 files
Create RootCA Certificate
[oracle@sydney ~]$ cat root_ca.sh
#!/bin/bash
set -e
#----------------------------------------------------------------------
#--
#-- RootCA_Cert
#--
#----------------------------------------------------------------------
openssl req -subj "${subj}/CN=RootCA_SYD" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/RootCA_SYD_key.pem \
-new -x509 \
-days 365 \
-out /opt/oracle/ogg23ai_certs/RootCA_SYD_cert.pem
printf "\nSuccessfully created RootCA certificate\n"
tree -lt -L 1 /opt/oracle/ogg23ai_certs/
exit 0
[oracle@sydney ~]$ ./root_ca.sh
Generating a RSA private key
.........+++++
..........................................................................................................................+++++
writing new private key to '/opt/oracle/ogg23ai_certs/RootCA_SYD_key.pem'
-----
Successfully created RootCA certificate
/opt/oracle/ogg23ai_certs/
??? Server_sydney_cert.cnf
??? Server_sydney.csr
??? Server_sydney_key.pem
??? RootCA_SYD_cert.pem
??? RootCA_SYD_key.pem
0 directories, 5 files
Create Client Certificate
[oracle@sydney ~]$ cat distro.sh
subject="/C=AU/O=OGG23/CN=distclient"
openssl req -subj "${subject}" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/Client_key.pem \
-new \
-out /opt/oracle/ogg23ai_certs/Client.csr
openssl x509 -CAcreateserial \
-CA /opt/oracle/ogg23ai_certs/RootCA_SYD_cert.pem \
-CAkey /opt/oracle/ogg23ai_certs/RootCA_SYD_key.pem \
-req \
-in /opt/oracle/ogg23ai_certs/Client.csr \
-days 365 \
-out /opt/oracle/ogg23ai_certs/Client_cert.pem
[oracle@sydney ~]$ ./distro.sh
Generating a RSA private key
........................+++++
......................................+++++
writing new private key to '/opt/oracle/ogg23ai_certs/Client_key.pem'
-----
Signature ok
subject=C = AU, O = OGG23, CN = distclient
Getting CA Private Key
Note the server certificate related .pem file and private key – as well as RootCA .pem file and private key and the Client certificate .pem file and private key.
[oracle@sydney oracle]$ cd /opt/oracle/ogg23ai_certs/
[oracle@sydney ogg23ai_certs]$ ls -lrt
total 36
-rw-rw-r--. 1 oracle oracle 126 Apr 8 04:18 Server_sydney_cert.cnf
-rw-------. 1 oracle oracle 1708 Apr 8 04:18 Server_sydney_key.pem
-rw-rw-r--. 1 oracle oracle 928 Apr 8 04:18 Server_sydney.csr
-rw-------. 1 oracle oracle 1704 Apr 8 04:19 RootCA_SYD_key.pem
-rw-rw-r--. 1 oracle oracle 1115 Apr 8 04:19 RootCA_SYD_cert.pem
-rw-------. 1 oracle oracle 1708 Apr 8 04:20 Client_key.pem
-rw-rw-r--. 1 oracle oracle 932 Apr 8 04:20 Client.csr
-rw-rw-r--. 1 oracle oracle 41 Apr 8 04:20 RootCA_SYD_cert.srl
-rw-rw-r--. 1 oracle oracle 1034 Apr 8 04:20 Client_cert.pem
Perth (Target)
- Server Certificate
- Root CA Certificate
- Client Certificate
- Root CA Certificate (Ext) – which was used to sign Client Certificate. This certificate will be copied to the source deployment
Create RootCA Certificate
[oracle@perth oracle]$ mkdir -p /opt/oracle/ogg23ai_certs
[oracle@perth oracle]$ cd
[oracle@perth ~]$ cat root_ca.sh
#!/bin/bash
set -e
#----------------------------------------------------------------------
#--
#-- RootCA_Cert
#--
#----------------------------------------------------------------------
openssl req -subj "${subj}/CN=RootCA_PER" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/RootCA_PER_key.pem \
-new -x509 \
-days 365 \
-out /opt/oracle/ogg23ai_certs/RootCA_PER_cert.pem
printf "\nSuccessfully created RootCA certificate\n"
tree -lt -L 1 /opt/oracle/ogg23ai_certs/
exit 0
[oracle@perth ~]$ ./root_ca.sh
Generating a RSA private key
..+++++
................................................+++++
writing new private key to '/opt/oracle/ogg23ai_certs/RootCA_PER_key.pem'
-----
Successfully created RootCA certificate
/opt/oracle/ogg23ai_certs/
??? RootCA_PER_cert.pem
??? RootCA_PER_key.pem
0 directories, 2 files
Create RootCA Certificate (EXT)
[oracle@perth ~]$ cat root_ca_ext.sh
#!/bin/bash
set -e
#----------------------------------------------------------------------
#--
#-- RootCA_EXT Cert
#--
#----------------------------------------------------------------------
openssl req -subj "${subj}/CN=RootCA_EXT" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/RootCA_EXT_key.pem \
-new -x509 \
-days 365 \
-out /opt/oracle/ogg23ai_certs/RootCA_EXT_cert.pem
printf "\nSuccessfully created RootCA EXT certificate\n"
tree -lt -L 1 /opt/oracle/ogg23ai_certs/
exit 0
[oracle@perth ~]$ ./root_ca_ext.sh
Generating a RSA private key
........................+++++
..................+++++
writing new private key to '/opt/oracle/ogg23ai_certs/RootCA_EXT_key.pem'
-----
Successfully created RootCA EXT certificate
/opt/oracle/ogg23ai_certs/
??? RootCA_PER_cert.pem
??? RootCA_PER_key.pem
??? RootCA_EXT_cert.pem
??? RootCA_EXT_key.pem
0 directories, 4 files
Create Server Certificate
[oracle@perth ~]$ cat certs_perth.sh
#!/bin/bash
set -e
v_server_fqdn_01=perth.localdomain
v_server_short_01=`echo $v_server_fqdn_01 | cut -d '.' -f 1`
v_passphrase="DreamLiner787##"
cat <<EOF> /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_cert.cnf
extendedKeyUsage = serverAuth
subjectAltName = DNS:${v_server_short_01},DNS:${v_server_fqdn_01},DNS:localhost,IP:127.0.0.1
EOF
#----------------------------------------------------------------------
#--
#-- Server Certificate PERTH
#--
#----------------------------------------------------------------------
subject="/C=AU/O=OGG23/CN=${v_server_short_01}"
openssl req -subj "${subject}" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_key.pem \
-new \
-out /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}.csr
openssl x509 -CAcreateserial \
-CA /opt/oracle/ogg23ai_certs/RootCA_PER_cert.pem \
-CAkey /opt/oracle/ogg23ai_certs/RootCA_PER_key.pem \
-req \
-in /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}.csr \
-extfile /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_cert.cnf \
-days 365 \
-out /opt/oracle/ogg23ai_certs/Server_${v_server_short_01}_cert.pem
printf "\nSuccessfully created Server certificate for GoldenGate.\n"
tree -lt -L 1 /opt/oracle/ogg23ai_certs/
exit 0
[oracle@perth ~]$ ./certs_perth.sh
Generating a RSA private key
........................................+++++
.....................+++++
writing new private key to '/opt/oracle/ogg23ai_certs/Server_perth_key.pem'
-----
Signature ok
subject=C = AU, O = OGG23, CN = perth
Getting CA Private Key
Successfully created Server certificate for GoldenGate.
/opt/oracle/ogg23ai_certs/
??? RootCA_PER_cert.pem
??? RootCA_PER_key.pem
??? RootCA_EXT_cert.pem
??? RootCA_EXT_key.pem
??? RootCA_PER_cert.srl
??? Server_perth_cert.cnf
??? Server_perth_cert.pem
??? Server_perth.csr
??? Server_perth_key.pem
0 directories, 9 files
[oracle@perth ~]$
Create Client Certificate
[oracle@perth ~]$ cat distro.sh
#!/bin/bash
set -e
#----------------------------------------------------------------------
#--
#-- DistClient Certificate
#--
#----------------------------------------------------------------------
subject="/C=AU/O=OGG23/CN=distclient"
openssl req -subj "${subject}" \
-newkey rsa:2048 -nodes \
-keyout /opt/oracle/ogg23ai_certs/DistClient_key.pem \
-new \
-out /opt/oracle/ogg23ai_certs/distclient.csr
openssl x509 -CAcreateserial \
-CA /opt/oracle/ogg23ai_certs/RootCA_EXT_cert.pem \
-CAkey /opt/oracle/ogg23ai_certs/RootCA_EXT_key.pem \
-req \
-in /opt/oracle/ogg23ai_certs/distclient.csr \
-days 365 \
-out /opt/oracle/ogg23ai_certs/DistClient_cert.pem
[oracle@perth ~]$ ./distro.sh
Generating a RSA private key
.........................................................................................................................+++++
...............+++++
writing new private key to '/opt/oracle/ogg23ai_certs/DistClient_key.pem'
-----
Signature ok
subject=C = AU, O = OGG23, CN = distclient
Getting CA Private Key
Copy required certificates from Target to Source
[oracle@sydney oracle]$ cd ogg23ai_certs
[oracle@sydney ogg23ai_certs]$ mkdir perth
[oracle@sydney ogg23ai_certs]$ cd perth
[oracle@sydney perth]$ pwd
/opt/oracle/ogg23ai_certs/perth
[oracle@sydney perth]$ scp -rp oracle@perth:/opt/oracle/ogg23ai_certs/DistClient_cert.pem .
oracle@perth's password:
DistClient_cert.pem 100% 1034 1.2MB/s 00:00
[oracle@sydney perth]$ scp -rp oracle@perth:/opt/oracle/ogg23ai_certs/DistClient_key.pem .
oracle@perth's password:
DistClient_key.pem 100% 1704 1.5MB/s 00:00
[oracle@sydney perth]$ scp -rp oracle@perth:/opt/oracle/ogg23ai_certs/RootCA_PER_cert.pem .
oracle@perth's password:
RootCA_PER_cert.pem
Please refer to a very good post from Volker Kuhr from Oracle which discusses in detail GoldenGate 23ai security using certificates and has provided some very cool scripts to create certificates as well as wallets – thanks Volker!
https://blogs.oracle.com/dataintegration/post/securing-goldengate-using-certificates
