How to authenticate amazon rds oracle instance with ssl certificate. (With thin model)

[moxarth-rathod]

I am trying to authenticate my amazon oracle rds service with SSL connection using a thin model. Currently, I am pasting rds-ca-2019-root.pem in ewallet.pem and passing the path in wallet_location without a password. but it throws oracledb.exceptions.OperationalError: DPY-6005: cannot connect to database. Connection failed with "[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure

In DSN i am using TCPS protocol and ssl port.

import oracledb

wall_loc = "path-to-wallet"

kwargs = {
    "wallet_location": wall_loc,
}

with oracledb.connect(
    user=username,
    password=password,
    dsn=dsn,
    **kwargs,
) as ocon:
    with ocon.cursor() as cursor:
        sql = """select '['||systimestamp||'] Connectivity OK' from dual"""
        for r in cursor.execute(sql):
            print(r[0])

[cjbj]

Are there any AWS users who can assist @moxarth-elastic ?

Do you need to specify the wallet password?

        connection = oracledb.connect(
            user=un, password=pw, dsn=cs,
            wallet_location=wloc, wallet_password=wpw)

[rudolfnoe]

Hi,
I got the same error. The problem is a mismatch in the available cipher suites. AWS RDS applies the cipher SSL_RSA_WITH_AES_256_CBC_SHA by default which is not available in the default security context of the python SSL library as it assessed as no enough secure anymore. When changing the RDS Cipher to a more secure one like TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 it works.

[anthony-tuininga]

If you can make a suggestion as to what needs to change, that would be helpful. Currently python-oracledb uses the default SSL context -- which is focused on security. Which lines need to be changed in order to allow for what you are asking? I don't have access to AWS and I only use databases that already follow the recommended security guidelines -- so can't really help much without some direction!

[hvardhan20]

I implemented a custom solution for my use case. I'm doing this:
ciphers = ":".join(c['name'] for c in ssl_context.get_ciphers())
ssl_context.set_ciphers(ciphers+":" + os.environ.get('CIPHER_SUITES', '')

in here:
https://github.com/oracle/python-oracledb/blob/main/src/oracledb/impl/thin/crypto.pyx#L115
and installing this version of package

Maybe you could allow SSLContext to be passed through the connect() method as an official fix?

[anthony-tuininga]

That would be a reasonable thing to do. I'll discuss it with @cjbj and see if he agrees!

[anthony-tuininga]

Can you create an enhancement request for that?

[hvardhan20]

#259

[aedwards9]

I'm having this issue in Python 3.11. I've tried passing the ssl_context object to the connect but it's still failing. I'm wondering if it's because the SSL_RSA_WITH_AES_256_CBC_SHA cipher isn't in the valid options. When I do:

ssl_context.set_ciphers("SSL_RSA_WITH_AES_256_CBC_SHA")

I get "No cipher can be selected."

Do I need to add/install this cipher somehow?

[anthony-tuininga]

The SSL alert handshake failure can be due to a large number of issues, unfortunately -- so I cannot suggest what might be the issue in your case!

[dmacstack]

I had to handle it on the oracle instant client side when I ran into this.
A couple ways you can do it, but the way I did was:
make a wallet
create sqlnet.ora and point it to that wallet
create tnsnames.ora and add the appropriate settings in the connection string. In my case we had to initially specify SSL 1.0 because the default cert from aws was setup that way and no one paid attention or mentioned it.
If you run into issues like I did, enable the diagnostic trace in sqlnet.ora to help you figure it out. Typing this from mobile so don’t have hard details at hand, just going from memory. Good luck my friend.

[wouttom]

I hope this helps someone in the future:

The following code worked for me to connect to an RDS-instance:

    ssl_context = ssl.create_default_context()
    ciphers = [c["name"] for c in ssl_context.get_ciphers()]
    ciphers.append("TLS_RSA_WITH_AES_256_CBC_SHA")
    ssl_context.set_ciphers(":".join(ciphers))
    oracle = oracledb.connect(
        ...
        wallet_location="/path/to/cert/bundle/dir",
        ssl_context=ssl_context,
    )

It seems that an Oracle client does 2 ssl-handshakes.
On RDS the 1st one only accepts strong digests, but the 2nd requires the appended (weak) cipher with SHA digests.
When you scan the server capabilities with ssl-scan, you never reach the 2nd handshake, making this quite hard to debug.

Greeting,
Tom