Oracle Database B10772-01 User Manual download pdf (Page 199)

Troubleshooting SSL

Conﬁguring Secure Sockets Layer Authentication 7-33

Action: Check the following:

■ Ensure that the correct wallet location is speciﬁed in the sqlnet.ora ﬁle

so the system can ﬁnd the wallet.

■ Use Oracle Net Manager to ensure that cipher suites are set correctly in the

sqlnet.ora ﬁle. (Sometimes this error occurs because the sqlnet.ora

has been manually edited and the cipher suite names are misspelled. Note

that case sensitive string matching is used with cipher suite names.)

■ Use Oracle Net Manager to ensure that the SSL versions on both the client

and the server match, or are compatible. Sometimes this error occurs

because the SSL version speciﬁed on the server and client do not match. For

example, if the server accepts only SSL 3.0 and the client accepts only TLS

1.0, then the SSL connection will fail.

■ For more diagnostic information, enable Oracle Net tracing on the peer.

ORA-28865: SSL Connection Closed

Cause: The SSL connection closed because of an error in the underlying

transport layer, or because the peer process quit unexpectedly.

Action: Check the following:

■ Use Oracle Net Manager to ensure that the SSL versions on both the client

and the server match, or are compatible. Sometimes this error occurs

because the SSL version speciﬁed on the server and client do not match. For

example, if the server accepts only SSL 3.0 and the client accepts only TLS

1.0, then the SSL connection will fail.

■ If you are using a Difﬁe-Hellman anonymous cipher suite and the SSL_

CLIENT_AUTHENTICATION parameter is set to true in the server's

listener.ora ﬁle, then the client does not pass its certiﬁcate to the server.

When the server does not receive the client's certiﬁcate, it (the server)

cannot authenticate the client so the connection is closed. To resolve this use

another cipher suite, or set this listener.ora parameter to false.

■ Enable Oracle Net tracing and check the trace output for network errors.

■ See Actions listed for "ORA-28862: SSL Connection Failed" on page 7-32

ORA-28868: Peer Certiﬁcate Chain Check Failed

Cause: When the peer presented the certiﬁcate chain, it was checked and that

check failed. This failure can be caused by a number of problems, including:

■ One of the certiﬁcates in the chain is expired.

1 2 ... 194 195 196 197 198 199 200 201 202 203 204 ... 517 518

No comments

Oracle Database B10772-01 User Manual Page 199