How to resolve Root Certificate Expiry Issue for Enterprise Manager - Database Control ( )

Transcription

1 PURPOSE 14 th June, 2011 This paper demonstrates how to resolve the Oracle Enterprise Manager Database Control configuration errors in Oracle Database versions or , arising due to the Root Certificate Expiry issue since 31st December, CASE STUDY We use Oracle Enterprise Manager Database Control for our Production Box. All was fine until mid of February 11, when we noticed some stale information on Enterprise Manager Database Control. Despite carrying out the respective activities and the scheduled runs (like ADDM, Segment Advisor, etc.), for some reason the latest collection/information was not reflected on the Enterprise Manager Database Control Dashboard. All it showed was couple of days old data. By the end of March, we decided to drop the Enterprise Manager and create it afresh, so as to resolve the inconsistent data reflection issue. To our surprise, whenever we tried to setup Enterprise Manager (manually or using DBCA), it would fail to create the repository with exceptions/errors in the emca.log file. To simulate this issue and find the root cause of the problem, we tried the clean setup of Enterprise Manager Database Control on two different test databases, which subsequently resulted in similar repository creation errors, as follows: Apr 6, :37:11 PM oracle.sysman.emcp.emreposconfig invoke SEVERE: Error creating the repository Apr 6, :37:11 PM oracle.sysman.emcp.emreposconfig invoke INFO: Refer to the log file at C:\oracle\product\10.2.0\db_1\cfgtoollogs\emca\DBTEST\emca_repos_create_<date>.l og for more details. Apr 6, :37:11 PM oracle.sysman.emcp.emconfig perform SEVERE: Error creating the repository Refer to the log file at C:\oracle\product\10.2.0\db_1\cfgtoollogs\emca\DBTEST\emca_ _ PM.log for more details. Apr 6, :37:11 PM oracle.sysman.emcp.emconfig perform CONFIG: Stack Trace: oracle.sysman.emcp.exception.emconfigexception: Error creating the repository at oracle.sysman.emcp.emreposconfig.invoke(emreposconfig.java:204) at oracle.sysman.emcp.emreposconfig.invoke(emreposconfig.java:134) at oracle.sysman.emcp.emconfig.perform(emconfig.java:171) at oracle.sysman.emcp.emconfigassistant.invokeemca(emconfigassistant.java:486) at oracle.sysman.emcp.emconfigassistant.performconfiguration(emconfigassistant.java :1142) at oracle.sysman.emcp.emconfigassistant.statusmain(emconfigassistant.java:470) at oracle.sysman.emcp.emconfigassistant.main(emconfigassistant.java:419) 1

2 Upon investigation, we found out that the Root Certificate from Certification Authority, which is used to secure communications via the Secure Socket Layer (SSL) protocol, has expired on 31 st December, 2010 for Oracle Database versions and And, if anyone who installs or tries to secure Enterprise Manager Database Control on or after 31 st December, he is likely to face configuration errors, just as we did. In a nutshell, this is what My Oracle Support (MOS) had to say on the subject: ATTENTION! After 31-Dec-2010, creating/recreating/securing / EM DB Control will fail due to the expiration of the Certificate Authority. More informations in: NOTE ATTENTION: Patch Required If You Plan To Configure Enterprise Manager Database Control With Oracle Database Or On Or After 31-Dec-2010 NOTE Recovering From Database Control Configuration Errors Due to CA Expiry on Oracle Database or One needs to apply Patch to the Oracle Home of or Databases, before configuring the Enterprise Manager Database Control. No database downtime is necessary to apply the patch. Also, the MOS Note says that the existing Database Control configurations are not impacted by the Root Certificate Expiry issue. Likewise, we encountered the Enterprise Manager configuration issues only after attempting the re-install of Enterprise Manager Database Control. Had we not noticed the stale information on our Enterprise Manager Dashboard, we would not have attempted the Enterprise Manager reinstall and would not have known about the Root Certificate Expiry issue either. Why the accurate information was not reflected on the Enterprise Manager Dashboard, could have been related to the Root Certificate Expiry issue or could have been not. We didn t investigate on this to conclude on it. But one thing we can say is that we haven t noticed the stale information issue after having patched the production box with Patch till date. Here, I will demonstrate how we applied the Patch to our Single-Instance, Test Oracle Database to resolve the Enterprise Manager configuration issues. The Operating System used was Microsoft Windows 2003 and the Oracle Database Product used was 10g Release 2 ( ). 2

3 GETTING STARTED The two My Oracle Support Notes, namely and , entail detailed explanation and resolution for successful Enterprise Manager Database Control configuration for both Single Instance as well as RAC Databases. In circumstances, where the Enterprise Manager Database Control re-install or re-creation has not been attempted yet, you can stop the Oracle Database Console and relevant services and directly apply the patch. Once the patch is successful, you can start the all the stopped services. In our case, as we had already tried to re-install the Enterprise Manager Database Control and had encountered the configuration errors, hence we had to clean the existing Enterprise Manager Database Control installation before we could attempt the patch. Before we apply the patch, we need to ensure that: 1. We have downloaded and extracted the Patch We have downloaded the supporting version of OPatch utility for Oracle Home. 3. We have removed any trails of failed Enterprise Manager Installation, if applicable. NOTE: OPatch Version is the version used to patch both as well as databases. The relevant OPatch utility for Oracle Home and the Patch can be downloaded using My Oracle Support website ( Once the necessary files are downloaded, the OPatch utility needs to be extracted to a reference directory. So, we created a new directory OPatch in our Oracle Home, extracted all the files in it. C:\oracle\product\10.2.0\db_1\OPatch>opatch version Invoking OPatch OPatch Version: OPatch succeeded. Then, we need to set the Oracle Home and set the path for OPatch such that the executables appears in the system PATH. C:\>set path=c:\oracle\product\10.2.0\db_1\opatch C:\>set oracle_home=c:\oracle\product\10.2.0\db_1 3

4 Next, we need to verify the OUI Inventory. If any errors are observed in this step, then we should contact Oracle Support for its resolution. Make sure this step is successful before attempting the patch. NOTE: Ensure that OUI Inventory verification is successful before attempting the patch. C:\>opatch lsinventory Invoking OPatch Oracle Interim Patch Installer version Copyright (c) 2010, Oracle Corporation. All rights reserved. Oracle Home : C:\oracle\product\10.2.0\db_1 Central Inventory : C:\Program Files\Oracle\Inventory from : n/a OPatch version : OUI version : OUI location : C:\oracle\product\10.2.0\db_1\oui Log file location : C:\oracle\product\10.2.0\db_1\cfgtoollogs\opatch\opatch _ AM.log Patch history file: C:\oracle\product\10.2.0\db_1\cfgtoollogs\opatch\opatch_history.txt Lsinventory Output file location : C:\oracle\product\10.2.0\db_1\cfgtoollogs\opatch\lsinv\lsinventory _ AM.txt Installed Top-level Products (3): Oracle Database 10g Oracle Database 10g Products Oracle Database 10g Release 2 Patch Set There are 3 products installed in this Oracle Home. There are no Interim patches installed in this Oracle Home OPatch succeeded. Next, we need to create a directory to retain the Patch files in. Accordingly, we created a new directory under OPatch directory and then extracted the patch files from the archive file. C:\oracle\product\10.2.0\db_1\OPatch> C:\oracle\product\10.2.0\db_1\OPatch>cd C:\oracle\product\10.2.0\db_1\OPatch\ > Before you begin to apply the patch, ensure that you have stopped the Database Console service. The database and listener services do not need to be stopped, but ensure that all java processes running from Oracle Home are stopped. 4

5 Using opatch apply command, you can now initiate the patch application process. After performing the prerequisite checks, the OPatch utility will prompt you to enter your My Oracle Support (MOS) username and password for receiving any future MOS Security updates. You may ignore this or set it up, as per your comfort. Choosing not to receive the MOS Security updates will not hinder the patch application process in any way. To ignore the MOS Setup, just leave the password blank or supply NONE when prompted for MOS configuration and Proxy information. Before applying the Patch , the OPatch utility will backup the necessary files for any possible rollbacks. NOTE: We have changed the MOS ID to a dummy ID (abc@xyz.com) for demonstration purpose. C:\oracle\product\10.2.0\db_1\OPatch\ >opatch apply Invoking OPatch Oracle Interim Patch Installer version Copyright (c) 2010, Oracle Corporation. All rights reserved. Oracle Home : C:\oracle\product\10.2.0\db_1 Central Inventory : C:\Program Files\Oracle\Inventory from : n/a OPatch version : OUI version : OUI location : C:\oracle\product\10.2.0\db_1\oui Log file location : C:\oracle\product\10.2.0\db_1\cfgtoollogs\opatch\opatch _ AM.log Patch history file: C:\oracle\product\10.2.0\db_1\cfgtoollogs\opatch\opatch_history.txt ApplySession applying interim patch ' ' to OH 'C:\oracle\product\10.2.0\db_1' Running prerequisite checks... Provide your address to be informed of security issues, install and initiate Oracle Configuration Manager. Easier for you if you use your My Oracle Support address/user Name. Visit for details. address/user Name: abc@xyz.com Provide your My Oracle Support password to receive security updates via your My Oracle Support account. Password (optional): Unable to establish a network connection to Oracle. If your systems require a proxy server for outbound Internet connections, enter the proxy server details in this format: [<proxy-user>@]<proxy-host>[:<proxy-port>] If you want to remain uninformed of critical security issues in your configuration, enter NONE Proxy specification: NONE 5

6 OPatch detected non-cluster Oracle Home from the inventory and will patch the local system only. Backing up files and inventory (not for auto-rollback) for the Oracle Home Backing up files affected by the patch ' ' for restore. This might take a while... Backing up files affected by the patch ' ' for rollback. This might take a while... Patching component oracle.sysman.agent.core, a... "\sysman\jlib\emcore.jar\oracle\sysman\eml\sec\fsc\fswalletutil.class" "\sysman\jlib\emcore.jar\oracle\sysman\eml\sec\rep\repwalletutil.class" "\sysman\jlib\emcore.jar\oracle\sysman\eml\sec\util\rootcert.class" "\sysman\jlib\emcore.jar\oracle\sysman\eml\sec\util\secconstants.class" "\sysman\jlib\emd_java.jar\oracle\sysman\eml\sec\fsc\fswalletutil.class" "\sysman\jlib\emd_java.jar\oracle\sysman\eml\sec\rep\repwalletutil.class" "\sysman\jlib\emd_java.jar\oracle\sysman\eml\sec\util\rootcert.class" "\sysman\jlib\emd_java.jar\oracle\sysman\eml\sec\util\secconstants.class" ApplySession adding interim patch ' ' to inventory Verifying the update... Inventory check OK: Patch ID is registered in Oracle Home inventory with proper meta-data. Files check OK: Files from Patch ID are present in Oracle Home. OPatch succeeded. C:\oracle\product\10.2.0\db_1\OPatch\ > Once the patch is applied, the OPatch utility verifies the affected files and the OUI Inventory, before confirming that the patch process is a success. In the situation where the Enterprise Manager services were stopped simply to apply the patch, we can now start the Oracle Database Console and related services, and start using the Enterprise Manager Database Control Dashboard. For those of us who would want to install, secure or re-create the Enterprise Manager Database Control, then these can now be carried out smoothly. 6