ALERT: Action Required for Autonomous Databases (Doc ID 2911553.1)

Last updated on FEBRUARY 07, 2024

Applies to:

Details

DigiCert retired the Organizational Unit (OU) field for all public TLS/SSL certificates to comply with industry standards as of August 2022 per their announcement. This means that the public TLS/SSL certificates issued by DigiCert will not have the OU field anymore. This may affect existing applications, tools and/or services that are connecting to your Autonomous Database (ADB-S) instance.

How will this affect my service?

Autonomous Database does server DN matching by default based on the ssl_server_cert_dn property of your connection string, which contains the OU field today. Once the OU field is retired from the server-side certificates, DN matching will not succeed.
To avoid any disruptions to existing client connections, Autonomous Database will support doing DN matching based on the host property of your connection string.

If you are using mTLS authentication, you must use an Oracle client library version that supports this new approach (see below for supported client versions) and download your wallet zip file with the new mTLS connection strings before the due date listed for your region below (a wallet rotation is not required).

The connection strings for TLS authentication already do not include the OU field as of August 2022. However, if you are still using a TLS connect string with OU field, you must obtain and start using your new TLS string without the OU field via OCI console (or API) before the due date listed for your region below.

Failing to complete these steps before the specified date will result in existing applications, tools, and/or services to not able to connect to your Autonomous Database instance.

Actions

If you are using mTLS authentication (which requires a wallet), you need to take the following actions:

1.For your connections to support this new format, you must use an Oracle client with the following versions:

• Oracle Instant Client/Oracle Database Client:18.19 (or later), 19.2 (or later), 21 (base release or later) 

Oracle Database drivers that use Oracle Instant Client/Oracle Database Client (e.g. cx_Oracle, node-oracledb, godror, PHP OCI8, PHP PDO_OCI, ruby-oci8, ROracle, rust-oracle): Use the driver with a compatible Oracle Instant Client/Oracle Database Client release from the list above.

• ODP.NET: 12.1 (Starting with April 2022 WINDBBP; ODP.NET Managed only), 18 (base release or later), 19.4 (or later, except for 19.10), 21 (base release or later)
• JDBC Thin: 11.2.0.4 (or later with one-off patch for Bug 28492769), 12.2 (or later with one-off patch for Bug 28492769), 18 (base release or later with one-off patch for Bug 28492769), 19 (base release or later), 21 (base release or later)
• Python: python-oracledb 1.0 (or later)

You can download the latest versions of these clients from the links provided below:

• Oracle JDBC Downloads Page
• Oracle .NET Downloads Page
• Oracle Instant Client Downloads Page
• Python python-oracledb Downloads Page

2.The new mTLS connection strings without the OU field are available to download as part of your wallet zip file today. You must download your wallet zip file with the new mTLS connection strings before the due date listed for your region below (a wallet rotation is not required).

Please note that the connection strings for TLS authentication already do not include the OU field as of August 2022, and the clients that support TLS authentication already support this new connect string format. Therefore, we encourage you to use TLS authentication, which will also allow you to connect to your ADB-S instance without a wallet.

Wallet Download Due Dates by Region

Contacts

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.