Last updated: 2026-09-08

Oracle Database TLS/SSL Configuration Guide

This guide provides recommended TLS/SSL settings for Oracle Database to encrypt connections between clients and the database server using the TCPS protocol. Oracle manages TLS certificates through Oracle Wallets.

Prerequisites#

• Oracle Database 19c or later (for TLS 1.2)
• Oracle Database 19c Release Update 19.32 or later with the next-generation cryptographic provider enabled, or Oracle Database 23ai or later (for TLS 1.3 support; Oracle 21c is TLS 1.2 only)
• SSL certificates (server certificate, private key, and CA certificate)
• orapki utility (included with Oracle Database) for wallet management

Wallet Setup#

Oracle traditionally manages TLS certificates through Oracle Wallets. A wallet is a PKCS#12 container that stores certificates and private keys.

Create an Auto-Login Wallet#

# Create wallet directory
mkdir -p /etc/oracle/ssl
chmod 750 /etc/oracle/ssl

# Create a new auto-login wallet
orapki wallet create -wallet /etc/oracle/ssl -auto_login -pwd WalletPassword123

# Import the CA certificate
orapki wallet add -wallet /etc/oracle/ssl -trusted_cert -cert ca.crt -pwd WalletPassword123

# Import the server certificate and private key
# First convert to PKCS12 if you have PEM files
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name oracle_cert

# Import the PKCS12 into the wallet
orapki wallet import_pkcs12 -wallet /etc/oracle/ssl -pkcs12file server.p12 -pwd WalletPassword123

Verify Wallet Contents#

orapki wallet display -wallet /etc/oracle/ssl

The output should show your server certificate, private key, and trusted CA certificates.

Server Configuration (sqlnet.ora)#

The sqlnet.ora file controls network encryption settings. The file is typically located in $ORACLE_HOME/network/admin/.

Wallet-Based Configuration#

# TLS wallet location
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /etc/oracle/ssl)
    )
  )

# Require TLS connections
SSL_CLIENT_AUTHENTICATION = FALSE
SQLNET.AUTHENTICATION_SERVICES = (TCPS)

# Protocol version
SSL_VERSION = 1.2 or 1.3

# Cipher suites
SSL_CIPHER_SUITES = (TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

Configuration Explained#

• SSL_VERSION - Sets the allowed TLS protocol versions. Use 1.2 or 1.3 to allow both TLS 1.2 and TLS 1.3. TLS 1.3 requires Oracle Database 23ai, or Oracle Database 19c Release Update 19.32 or later with the next-generation cryptographic provider enabled; Oracle 21c supports TLS 1.2 only. On 19c the legacy provider remains the default and does not support TLS 1.3, so switch providers first with python $ORACLE_HOME/bin/set_crypto_provider.py next-generation, then restart the database instance and the listener.
• SSL_CIPHER_SUITES - Restricts the allowed cipher suites to strong AEAD ciphers with forward secrecy.
• SSL_CLIENT_AUTHENTICATION - Set to TRUE to require client certificates (mutual TLS). Set to FALSE for server-only authentication.

See RFC 8446 §4.3.2 for the TLS Certificate Request specification, and Wikipedia: Mutual authentication for a general overview.

Listener Configuration (listener.ora)#

Configure the Oracle Net Listener to accept TCPS (TLS-encrypted) connections. The file is typically located in $ORACLE_HOME/network/admin/.

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS_LIST =
        (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
        (ADDRESS = (PROTOCOL = TCPS)(HOST = ::)(PORT = 2484))
      )
    )
  )

# Wallet location for the listener
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /etc/oracle/ssl)
    )
  )

SSL_CLIENT_AUTHENTICATION = FALSE

Note: The default port for Oracle TCPS is 2484. You can run both TCP (1521) and TCPS (2484) listeners simultaneously during migration.

Note on IPv6: Each endpoint above pairs the IPv4 wildcard 0.0.0.0 with the IPv6 all-interfaces address :: so the listener accepts both families on the same port. Multiple ADDRESS entries are grouped in an ADDRESS_LIST inside one DESCRIPTION, which Oracle Net supports for dual-stack listeners. IPv6 literals are written without square brackets in listener.ora (brackets are only used in connect strings such as EasyConnect). Oracle does not formally document :: as an all-IPv6 wildcard; if your Oracle version does not honor it, replace :: with the server's specific IPv6 address, for example (ADDRESS = (PROTOCOL = TCPS)(HOST = 2001:db8::1)(PORT = 2484)). Specifying a resolvable host name instead of a literal address also causes the listener to bind every interface it resolves to, covering both families.

To support both unencrypted and TLS connections during a migration period:

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS_LIST =
        (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
        (ADDRESS = (PROTOCOL = TCP)(HOST = ::)(PORT = 1521))
        (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
        (ADDRESS = (PROTOCOL = TCPS)(HOST = ::)(PORT = 2484))
      )
    )
  )

Complete Configuration#

sqlnet.ora#

# Oracle TLS Configuration

# Wallet location
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /etc/oracle/ssl)
    )
  )

# TLS protocol version
SSL_VERSION = 1.2 or 1.3

# Cipher suites
SSL_CIPHER_SUITES = (TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

# Client authentication
SSL_CLIENT_AUTHENTICATION = FALSE

# Server DN verification
SQLNET.AUTHENTICATION_SERVICES = (TCPS)

listener.ora#

# Oracle TCPS Listener

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS_LIST =
        (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
        (ADDRESS = (PROTOCOL = TCPS)(HOST = ::)(PORT = 2484))
      )
    )
  )

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /etc/oracle/ssl)
    )
  )

SSL_CLIENT_AUTHENTICATION = FALSE

Client Connections#

SQL*Plus#

Connect using TCPS with SQL*Plus:

sqlplus username/password@"(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=oracle.example.com)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=ORCL)))"

tnsnames.ora#

Configure a TNS alias for TLS connections in tnsnames.ora:

ORCL_TLS =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCPS)(HOST = oracle.example.com)(PORT = 2484))
    (CONNECT_DATA =
      (SERVICE_NAME = ORCL)
    )
    (SECURITY =
      (SSL_SERVER_CERT_DN = "CN=oracle.example.com")
    )
  )

Then connect with:

sqlplus username/password@ORCL_TLS

JDBC Thin Driver#

For Java applications using the Oracle JDBC thin driver:

jdbc:oracle:thin:@tcps://oracle.example.com:2484/ORCL

Configure the JVM with truststore and keystore properties:

java -Djavax.net.ssl.trustStore=/path/to/truststore.jks \
     -Djavax.net.ssl.trustStorePassword=changeit \
     -Djavax.net.ssl.keyStore=/path/to/keystore.jks \
     -Djavax.net.ssl.keyStorePassword=changeit \
     -jar myapp.jar

Security Notes#

Oracle Database TLS uses Oracle's native wallet-based implementation (Oracle Advanced Security) for server-side TLS, and Java's JSSE when connecting from Java clients. The relevant vulnerability history depends on the component:

Oracle server (Oracle Advanced Security / wallet):

• POODLE / BEAST / FREAK / Sweet32 / ROBOT: Mitigated by the SSL_VERSION and SSL_CIPHER_SUITES parameters in sqlnet.ora. Set SSL_VERSION = 1.2 or higher and exclude legacy cipher suites as shown in this guide.
• Oracle 12.2+ supports TLS 1.2. TLS 1.3 requires Oracle Database 23ai, or Oracle Database 19c Release Update 19.32 or later with the next-generation cryptographic provider enabled; Oracle 21c supports TLS 1.2 only.

Java clients (JDBC Thin driver with JSSE):

• POODLE (CVE-2014-3566, 2014): SSL 3.0 disabled by default since Java 8u31 (January 2015).
• BEAST (CVE-2011-3389, 2011): TLS 1.0 disabled by default since Java 8u292 / Java 11.0.11 (April 2021).
• FREAK (CVE-2015-0204, 2015): EXPORT ciphers disabled by default since Java 8u40 (March 2015).
• Sweet32 (CVE-2016-2183, 2016): 3DES disabled by default since Java 8u151 (October 2017).
• ROBOT (2017): Static RSA key exchange is excluded from the recommended configuration.

The following are not addressable through TLS configuration alone:

• Heartbleed (CVE-2014-0160, 2014): Not applicable to Oracle's native TLS or Java JSSE; neither is based on OpenSSL.
• BREACH (CVE-2013-3587, 2013): Not applicable. BREACH targets HTTP-level response compression; the Oracle SQL*Net wire protocol does not involve HTTP.
• DROWN (CVE-2016-0800, 2016): Not applicable. Oracle Advanced Security and Java JSSE do not support SSLv2.

Verification#

Restart the listener and verify the TCPS endpoint is active:

lsnrctl stop
lsnrctl start
lsnrctl status

The output should show the TCPS endpoint listening on port 2484.

Test the TLS connection with openssl:

openssl s_client -connect oracle.example.com:2484

Verify the TLS protocol and cipher from within an active session:

SELECT sys_context('USERENV', 'NETWORK_PROTOCOL') AS protocol FROM dual;
SELECT sys_context('USERENV', 'SSL_CIPHER') AS cipher FROM dual;

Check active TLS sessions from the server:

SELECT username, program, network_service_banner
FROM v$session_connect_info
WHERE network_service_banner LIKE '%TLS%' OR network_service_banner LIKE '%SSL%';