1、Oracle使用者下操作，建立證書

　　 mkdir /home/oracle/wallet
    orapki wallet create -wallet "/home/oracle/wallet" -pwd WalletPasswd123 -auto_login_local
    建立一個自簽名證書並將其載入到
    $ orapki wallet add -wallet "/home/oracle/wallet" -pwd WalletPasswd123 -dn "CN=`hostname`" -keysize 1024 -self_signed -validity 3650  
    檢查wallet的內容，需要注意的是自簽名證書既是使用者也是可信證書    
    $ orapki wallet display 
 
-wallet "/home/oracle/wallet" -pwd WalletPasswd123    
    匯出證書，以便稍後將其載入到客戶的wallet中    
    $ orapki wallet export -wallet "/home/oracle/wallet" -pwd WalletPasswd123 -dn "CN=`hostname`" -cert /tmp/`hostname`-certificate.crt   
    檢查證書是否已按預期匯出    
    $ cat /tmp/`hostname`-certificate.crt

2、監聽配置

1、在伺服器上，將以下內容新增到“$ORACLE_HOME/network/admin/sqlnet.ora”檔案中
NAMES.DIRECTORY_PATH
 
= (TNSNAMES, EZCONNECT)

WALLET_LOCATION =
   (SOURCE =
     (METHOD = FILE)
     (METHOD_DATA =
       (DIRECTORY = /home/oracle/wallet)
     )
   )
SQLNET.AUTHENTICATION_SERVICES = (TCPS,NTS,BEQ)
#SSL_CLIENT_AUTHENTICATION = FALSE
SSL_CLIENT_AUTHENTICATION = TRUE
DIAG_ADR_ENABLED = OFF
SSL_CIPHER_SUITES 
 
= (SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA)
ADR_BASE = /opt/app/oracle

2、將監聽配置為接受SSL/TLS加密連線。編輯“$ORACLE_HOME/network/admin/listener.ora”檔案，新增wallet資訊以及TCPS內容

SSL_CLIENT_AUTHENTICATION = FALSE

WALLET_LOCATION =
    (SOURCE =
        (METHOD = FILE)
        (METHOD_DATA =
        (DIRECTORY = /home/oracle/wallet)
        )
    )

LISTENER =
    (DESCRIPTION_LIST =
        (DESCRIPTION =
        (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.132.13)(PORT = 1521))
        (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
        (ADDRESS = (PROTOCOL = TCPS)(HOST = 192.168.132.13)(PORT = 2484))
        (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC2484))
    )
    )
DIAG_ADR_ENABLED_LISTENER = OFF
ADR_BASE_LISTENER = /opt/app/oracle
TRACE_LEVEL_LISTENER=user
      

[oracle@db2 ~]$ cat /opt/app/oracle/product/11.2.0/dbhome_1/network/admin/tnsnames.ora
ORA11N =
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST =192.168.132.13)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl11g.us.oracle.com)
      (SID = icdc)
    )
    )
 
TCPS1 =
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCPS)(HOST = 192.168.132.13)(PORT = 2484))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl11g.us.oracle.com)
      (SID = icdc)
    )
    )


　　重啟監聽　

　　　　$ lsnrctl stop
　　　　$ lsnrctl start

　　　　```好像是 lsnrctl reload 也可以的，不用stop再start```

3、資料庫本地測試

1、tcps登入測試
[oracle@db2 ~]$ sqlplus bjxq/bjxqww2sq2z@TCPS1
2、日誌監控
[oracle@db2 ~]$ tail -f /opt/app/oracle/product/11.2.0/dbhome_1/network/log/listener.log

4、總結

　　Oracle配置tcps加密連線已經配置成功，至於業務連線需要開發配合，需要將crt檔案轉換為jks證書等等，不說了……