Does Symantec DLP support secure connections (TLS) to Oracle ?

Products

• Data Loss Prevention

Issue/Introduction

Do the current versions of Symantec DLP 15.8 & 16 support secure TLS connections to the Oracle 19c Database.

Resolution

Yes, DLP 15.8 and 16 can both be configured to establish secure TLS based connections to the Oracle Database, however there are some caveats.

The most important issue is that database connectivity MUST be reverted to normal clear TCP connections prior to upgrade or new installs as the current DLP MSI installers do not support the TLS connections, as soon as the upgrade is completed the connections can be reverted to their secure TLS form. This is deemed a current product limitation and is NOT a defect and this limitation is detailed in our documentation.

 

Additional Information

The TLS connection string should be configured in the 15.8 / 16 jdbc.properties connection string as the following format.

jdbc.dbalias.oracle-thin=@(description=(address=(host=xxx.example.com)(protocol=tcps)(port=1801))(SSL_SERVER_CERT_DN="CN=xxx.example.com")(connect_data=(service_name=xxx.example.com)))

Notice the cert parameter in this string.  The important change is that the service name still has to be the last entry of the connection string.  While Oracle does not care about the order of these parameters, our parser that builds the sqlplus command wants the connect_data to be the last entry.   
 
One other point, make sure you have imported the Oracle wallet into the new jre's cacerts trust store as this is often a forgotten step when a new JRE is required. 

For more details, please see Configuring the Server Certificate on the Enforce Server.