DB / Oracle / 底层与基础

Oracle 网络加密与 SSL/TLS

2026.09.06

Oracle 网络加密与 SSL/TLS

适用版本：Oracle Database 11g / 12c / 19c / 23ai 文档版本：v1.0 / 2026-07

1. 概述

Oracle 网络加密保护客户端与数据库间的数据传输[1]：

方案实现复杂度
Native Encryption内置 AES/3DES低
SSL/TLS证书 + TCPS中
Kerberos第三方认证高
RADIUS第三方认证高

2. Native Network Encryption

2.1 工作原理

客户端 ←加密通道→ 数据库
        AES/3DES

2.2 配置 sqlnet.ora

# 服务端 / 客户端通用
# 加密
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED

# 加密算法
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128, 3DES168)
SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256, AES192, AES128, 3DES168)

# 数据完整性（Checksum）
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256, SHA1, MD5)
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256, SHA1, MD5)

2.3 参数说明

参数值说明
REQUIRED强制要求
REQUESTED请求，可选
ACCEPTED接受，可选
REJECTED拒绝

协商规则：

客户端 \ 服务端 | REQUIRED | REQUESTED | ACCEPTED | REJECTED
REQUIRED        | OK       | OK        | OK       | 失败
REQUESTED       | OK       | OK        | OK       | 不加密
ACCEPTED        | OK       | OK        | 不加密   | 不加密
REJECTED        | 失败     | 不加密    | 不加密   | 不加密

2.4 验证加密

-- 查看会话网络加密
SELECT 
  network_service_banner
FROM v$session_connect_info
WHERE sid = USERENV('SID');

-- 输出包含：
-- Oracle Advanced Security: AES256 Encryption service adapter

3. SSL/TLS 配置

3.1 工作原理

客户端 ←SSL/TLS→ 数据库
        证书认证 + 加密
        端口 2484（TCPS）

3.2 创建 Wallet

# 1. 创建 Wallet
orapki wallet create -wallet /u01/wallet -auto_login

# 2. 添加自签名证书
orapki wallet add -wallet /u01/wallet \
  -dn "CN=dbserver,O=example,C=US" \
  -keysize 2048 \
  -self_signed -validity 365

# 3. 导出证书
orapki wallet export -wallet /u01/wallet \
  -dn "CN=dbserver,O=example,C=US" \
  -cert /tmp/dbserver.crt

# 4. 查看证书
orapki wallet display -wallet /u01/wallet

3.3 客户端 Wallet

# 客户端创建 Wallet
orapki wallet create -wallet /u01/client_wallet -auto_login

# 导入服务端证书
orapki wallet add -wallet /u01/client_wallet \
  -trusted_cert -cert /tmp/dbserver.crt

3.4 服务端配置

# sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES = (TCPS, NTS)
SSL_CLIENT_AUTHENTICATION = TRUE
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA)
SSL_VERSION = 1.2

# Wallet 位置
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /u01/wallet)
    )
  )

# listener.ora
LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = dbserver)(PORT = 2484))
    )
  )

# 启用 SSL
SSL_CLIENT_AUTHENTICATION = TRUE

3.5 客户端配置

# sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES = (TCPS)
SSL_CLIENT_AUTHENTICATION = TRUE
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA)
SSL_VERSION = 1.2

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /u01/client_wallet)
    )
  )

# tnsnames.ora
ORCL_SSL =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCPS)(HOST = dbserver)(PORT = 2484))
    (CONNECT_DATA = (SERVICE_NAME = orcl))
  )

3.6 连接

sqlplus scott/tiger@orcl_ssl

4. 证书管理

4.1 CA 签发证书

# 1. 创建 CA Wallet
orapki wallet create -wallet /u01/ca_wallet -auto_login

# 2. 创建自签名 CA 证书
orapki wallet add -wallet /u01/ca_wallet \
  -dn "CN=MyCA,O=example,C=US" \
  -keysize 2048 \
  -self_signed -validity 3650

# 3. 创建 CSR（服务端）
orapki wallet create -wallet /u01/server_wallet -auto_login
orapki wallet add -wallet /u01/server_wallet \
  -dn "CN=dbserver,O=example,C=US" \
  -keysize 2048 \
  -request /tmp/server.csr

# 4. CA 签发
orapki cert revoke -wallet /u01/ca_wallet ... # 创建 CA 证书
orapki cert create -wallet /u01/ca_wallet \
  -request /tmp/server.csr \
  -cert /tmp/server.crt \
  -validity 365

# 5. 导入到服务端 Wallet
orapki wallet add -wallet /u01/server_wallet \
  -user_cert -cert /tmp/server.crt

4.2 证书查看

# 查看 Wallet 中的证书
orapki wallet display -wallet /u01/wallet -complete

5. 强认证

5.1 Kerberos

# sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES = (KERBEROS5)
SQLNET.KERBEROS5_CONF = /etc/krb5.conf
SQLNET.KERBEROS5_CC_NAME = /tmp/krb5cc_1000
SQLNET.KERBEROS5_KEYTAB = /etc/krb5.keytab
SQLNET.KERBEROS5_MUTUAL_AUTHENTICATION = TRUE

# 连接（无密码）
sqlplus /@orcl_kerberos

5.2 RADIUS

# sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES = (RADIUS)
SQLNET.RADIUS_AUTHENTICATION = radius-server
SQLNET.RADIUS_AUTHENTICATION_PORT = 1812
SQLNET.RADIUS_AUTHENTICATION_TIMEOUT = 60
SQLNET.RADIUS_SECRET = /u01/secret

6. 配置文件总结

6.1 sqlnet.ora 完整配置

# === 网络加密 ===
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128)
SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256, AES192, AES128)

# === 数据完整性 ===
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256)

# === SSL/TLS ===
SQLNET.AUTHENTICATION_SERVICES = (TCPS)
SSL_CLIENT_AUTHENTICATION = TRUE
SSL_VERSION = 1.2
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA)

# === Wallet ===
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /u01/wallet)
    )
  )

6.2 listener.ora 配置

LISTENER =
  (DESCRIPTION_LIST =
    # 普通连接
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = dbserver)(PORT = 1521))
    )
    # SSL 连接
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = dbserver)(PORT = 2484))
    )
  )

# SSL 配置
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /u01/wallet)
    )
  )

7. 监控与验证

7.1 验证加密

-- 查看会话网络信息
SELECT 
  sid,
  network_service_banner,
  authentication_method
FROM v$session_connect_info
WHERE sid = USERENV('SID');

7.2 检查 Wallet

# 查看证书
orapki wallet display -wallet /u01/wallet -complete

7.3 测试连接

# Native Encryption
sqlplus scott/tiger@orcl
# 检查日志确认加密

# SSL
sqlplus scott/tiger@orcl_ssl

8. 常见坑与排错

8.1 ORA-12660: Encryption or crypto-checksumming not supported

修复：

# 1. 检查 sqlnet.ora
# 2. 确认算法兼容
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128)

# 3. 检查 Oracle Advanced Security 授权

8.2 ORA-28857: SSL protocol error

修复：

# 1. 检查 SSL 版本
SQLNET.AUTHENTICATION_SERVICES = (TCPS)
SSL_VERSION = 1.2

# 2. 检查证书有效性
orapki wallet display -wallet /u01/wallet -complete

# 3. 检查 Wallet 权限
ls -l /u01/wallet/

8.3 ORA-28759: failure to open file

修复：

# 1. 检查 Wallet 路径
ls -l /u01/wallet/ewallet.p12

# 2. 检查权限
chown oracle:dba /u01/wallet/
chmod 700 /u01/wallet/

8.4 SSL 证书过期

修复：

# 1. 查看证书过期时间
orapki wallet display -wallet /u01/wallet -complete

# 2. 续期证书
orapki wallet add -wallet /u01/wallet \
  -dn "CN=dbserver,O=example,C=US" \
  -keysize 2048 \
  -self_signed -validity 365

# 3. 重启监听器
lsnrctl reload

8.5 客户端无 Wallet

修复：

# 1. 服务端 SSL_CLIENT_AUTHENTICATION=FALSE（仅服务端认证）
# 2. 客户端无需 Wallet，但仍需信任服务端证书

9. 最佳实践

  1. 生产启用 Native Encryption：简单有效
  2. 高安全场景用 SSL/TLS：双向认证
  3. AES256：性能与安全平衡
  4. SHA256 Checksum：数据完整性
  5. 证书有效期监控：避免过期
  6. Wallet 安全：限制权限
  7. 自动登录 Wallet：避免密码
  8. SSL_VERSION 1.2+：禁用旧版
  9. 生产强制 REQUIRED：不加密则拒绝
  10. 定期审计加密配置：合规要求

10. 参考资料

[1] Oracle Database Advanced Security Guide 19c, “Configuring Network Encryption” https://docs.oracle.com/en/database/oracle/oracle-database/19/asoag/

[2] Oracle Database Security Guide 19c, “Configuring SSL Authentication” https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/