Oracle Database Advanced Security 10g Release 1, Administrator'S Manual

Page: 183 / 518

Enabling SSL
Configuring Secure Sockets Layer Authentication 7-17
The
sqlnet.ora
and
listener.ora
files are updated with the following
entries:
wallet_location =
(SOURCE=
(METHOD=File)
(METHOD_DATA=
(DIRECTORY=wallet_location)))
Step 3: Set the SSL Cipher Suites on the Server (Optional)
A cipher suite is a set of authentication, encryption, and data integrity algorithms
used for exchanging messages between network entities. During an SSL handshake,
two entities negotiate to see which cipher suite they will use when transmitting
messages back and forth.
When you install Oracle Advanced Security, the SSL cipher suites listed in Table 7–1
are set for you by default and negotiated in the order they are listed. You can
override the default order by setting the
SSL_CIPHER_SUITES
parameter. For
example, if you use Oracle Net Manager to add the cipher suite SSL_
RSA_WITH_
RC4_128_SHA
, all other cipher suites in the default setting are ignored.
You can prioritize the cipher suites. When the client negotiates with servers
regarding which cipher suite to use, it follows the prioritization you set. When you
prioritize the cipher suites, consider the following:
■
Server and client must be configured to use compatible cipher suites for a
successful connection.
■
The level of security you want to use. For example, triple-DES encryption is
stronger than DES.
■
The impact on performance. For example, triple-DES encryption is slower than
DES.
Note:
The listener uses the wallet defined in
listener.ora
(it
can use any database wallet). When SSL is configured for a server
using Net Manager, the wallet location is entered into the
listener.ora
and the
sqlnet.ora
files. The
listener.ora
file is not relevant to the Oracle client.
To change the listener wallet location (so that the listener has its
own wallet), you can edit
listener.ora
to enter the new
location.