Securing Oracle Database Connections with TLS (on AWS RDS)

By default when deploying an Oracle database on RDS (and many other cloud providers, including on-prem), connections are made with Native Network Encryption (NNE). NNE is a great start, as it encrypts Oracle Net traffic in transit and helps protect it from being intercepted or modified on the network. However, unlike TLS, NNE does not use X.509 certificates to establish the identity of the database server through a Certificate Authority (CA). As a result, encryption alone does not provide the client with the same assurance that it is communicating with the intended database endpoint. TLS addresses this by combining encryption with certificate-based server authentication, allowing the client to verify the identity of the server it connects to and providing stronger protection against man-in-the-middle attacks.

The Oracle database supports TLS encrypted connections, which directly address this vulnerability by requiring digital X.509 certificates to cryptographically verify the server's identity. TLS is the same protocol that underpins HTTPS connections, providing both encryption AND authentication of the server. This guide aims to walk you through setting up TLS on an RDS database and making connections; it assumes a working knowledge of AWS, the Oracle database and X.509 certificates.

Whilst this will be mostly applicable to AWS RDS, the options presented and how to establish connections to a TLS secured Oracle database are standard across all deployments of the Oracle database, whether that be AWS, OCI or on-prem. 

Configuring the AWS option group

To enable TLS encryption on your RDS instance, you need to first create an AWS RDS option group with an option of the name SSL. Use these values within the option.

Option Name	Option Example Value	Option Description
Port	2484	The port that the database will listen for TLS connections on.
Security Groups	Select your database security group.	The security group for which this option is enabled. Ensure you allow inbound traffic on the above port and disallow traffic to 1521.
FIPS.SSLFIPS_140	TRUE	Specifies whether the TLS connection uses only FIPS-verified cipher suites. This is a cryptographic standard created by NIST.
SQLNET.CIPHER_SUITE	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	The desired TLS cipher suite: choose a strong cipher here to ensure the strong integrity and encryption.
SQLNET.SSL_VERSION	1.2	The desired TLS version, 1.2 is the latest supported version for Oracle.

Once you have saved these changes, apply this option group to your RDS instance. It may reboot your database but once it’s status becomes ‘Available’ you are ready to make your secure connection.

Connecting to a TLS secured database with SQL Developer

TLS uses X.509 certificates to verify identity, this means that the root CA certificates need to be used to verify the legitimacy of the leaf database certificate. This next section will walk you through creating a Java Keystore (JKS) and then using it in Oracle SQL Developer for Visual Studio Code.

Creating the JKS

You first need to download the root certificate bundle for your environment, if you are following along using AWS, these can be downloaded here. You can either download the global bundle which contains the CAs or if your deployment is just in one region, download that specific bundle.

Next you need to ensure you have a suitable Java installation on your local machine, you can check with java --version. This is required for SQLcl to make the TLS connection via JDBC, it also provides the required `keytool` command.

With the bundle downloaded, run the following commands in the terminal, ensuring you change the value YOUR_BUNDLE_PATH.pem to be the correct location of the downloaded bundle.

awk '/-BEGIN CERTIFICATE-/{n++}{print > ("/tmp/rds-ca-" sprintf("%02d", n) ".pem")}' "YOUR_BUNDLE_PATH.pem"


for f in /tmp/rds-ca-*.pem; do
   [ -e "$f" ] || continue
   keytool -importcert -noprompt -trustcacerts \
       -alias "$(basename "${f}" .pem)" \
       -file "${f}" \
       -keystore truststore.jks \
       -storepass changeit
done

This will give you a JKS file, please ensure it is stored somewhere sensible, such as your home directory.

Configuring SQL Developer

1. Create a new connection in SQL Developer.

2. As the ‘Connection Type’ select ‘Custom JDBC’

3. Under ‘Details’, set the value of ‘Custom JDBC URL’ to the following connection string. Ensure you change any highlighted values as required

jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=YOUR_DATABASE_HOST)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=YOUR_DB_SERVICE)))

4. Under ‘Advanced’, add the following options

Option Name	Option Value
javax.net.ssl.trustStore	<The FULL path of your JKS file>
javax.net.ssl.trustStoreType	JKS
javax.net.ssl.trustStorePassword	changeit
oracle.net.ssl_server_dn_match	true

5. Now enter your authentication details as you usually would and hit save.

Final notes

Enabling TLS on an Oracle RDS instance provides an additional layer of security to be used instead of NNE by ensuring that clients can cryptographically verify the identity of the database server. By configuring the RDS SSL option, restricting access to the secure port (2484), and using a trusted CA certificate store, connections can be protected against both network interception and man-in-the-middle attacks.

The same principles can also be applied when securing the connection between ORDS and the Oracle database, ensuring that application traffic to the database is both encrypted and authenticated. In Part 2, I will demonstrate this configuration in full, showing how to configure ORDS to establish a TLS-secured connection to the database, keep an eye out for this on either our blog site or our Linkedin.