AWS Database Blog

Create Oracle Wallet for AWS DMS SSL connections using SQLcl

AWS Database Migration Service (AWS DMS) requires Oracle Wallet files as certificates when you activate SSL for database migrations to Amazon Relational Database Service (Amazon RDS) for Oracle. SQL Developer Command Line (Oracle SQLcl) provides a lightweight, Java-based alternative for creating and managing Oracle Wallets, including essential utilities such as orapki and mkstore. Using SQLcl provides a lightweight alternative to downloading the full Oracle Client software (approximately 1.2 GB), and typically completes the setup in fewer than 10 steps.

Using SQLcl, you can execute SQL and PL/SQL statements interactively or as a batch file. SQLcl provides inline editing, statement completion, command recall, and supports existing SQL*Plus scripts. You can download Oracle SQLcl from Oracle Technology Network

Amazon Corretto 21 Java version is compatible with Oracle utilities. This post uses Amazon Corretto 21 Java version for SQLcl configuration.

This post covers the following:

  1. Installing Oracle SQLcl and Java on an Amazon Linux 2023.
  2. Creating an Oracle Wallet and adding SSL certificates.
  3. Testing SSL connections to Amazon RDS for Oracle using the Oracle Wallet.
  4. Uploading the Wallet file to Amazon Simple Storage Service (Amazon S3).
  5. Importing the Wallet file as an AWS DMS certificate.
  6. Configuring the AWS DMS endpoint with Secure Socket Layer (SSL) mode, SSL port, and certificate for a successful test connection.

Prerequisites

Verify that the following are available before you begin:

  1. An Amazon Elastic Compute Cloud (Amazon EC2) instance with Amazon Linux 2023.
  2. Oracle Java 21 (Amazon Corretto 21).
  3. Oracle SQLcl package.
  4. Amazon RDS certificate bundle.
  5. EC2 instance must have virtual private cloud (VPC) connectivity to the RDS instance (including security group configuration).
  6. Confirm that the AWS Command Line Interface (AWS CLI) is available on the EC2 instance to run aws s3 cp operations.
  7. Create a new IAM role, or use an existing one, for the EC2 service to allow access to Amazon S3. Then attach the role to your EC2 instance. For more information, see Attach an IAM role to an EC2 instance.

Note: SQLcl 26.x requires JDK 17 or 21. If the Java version is different, the SQLcl installation fails with the following error:

Error: A JNI error has occurred, please check your installation and try again Exception in thread “main” java.lang.UnsupportedClassVersionError

Verify your Java version before proceeding:

java -version

Implementation steps

The following sections walk through steps required to create an Oracle Wallet, configure SSL, and integrate it with AWS DMS. Each step builds on the previous one, so work through them in order.

1. Environment setup

Before installing SQLcl, prepare your EC2 instance and install Java version 17, 21, or later. Oracle SQLcl requires Java to run.

A. EC2 instance preparation

Complete the following preparation steps to get your EC2 instance ready for SQLcl installation. Confirming your working directory now prevents path-related errors in later steps.

  1. Launch an Amazon Linux 2023 EC2 instance.
  2. Connect to the instance using SSH.
  3. Verify your current working directory:
pwd
/home/ec2-user

B. Java installation

Update the system packages and install Amazon Corretto 21. Amazon Corretto provides a certified, production-ready distribution of OpenJDK that Oracle utilities have tested extensively.

  1. Update system packages: 
    sudo dnf update -y
  2. Install Amazon Corretto 21: 
    sudo dnf install java-21-amazon-corretto
  3. Verify the Java installation: 
    java -version

    Expected output: The version string should show OpenJDK Corretto-21.

2. SQLcl installation and setup

With Java installed, download and extract Oracle SQLcl. The SQLcl package is a self-contained zip archive and requires no system-level installation. Extract it and run the included binary. The bin directory contains both the Unix shell script and a Windows batch file for launching SQLcl.

A. Download SQLcl

Run the following command to download the latest SQLcl package:

wget "https://download.oracle.com/otn_software/java/sqldeveloper/sqlcl-latest.zip"

B. Extract SQLcl

Extract the archive and navigate to the bin directory:

unzip sqlcl-latest.zip
cd sqlcl/bin/

C. Verify SQLcl installation

Run SQLcl in no-login mode to confirm it launches successfully and displays the copyright banner:

./sql /nolog

You should see the SQLcl copyright information and the SQL prompt. The following output confirms a working installation:

[ec2-user@mytestec2 bin]$ ./sql /nolog

SQLcl: Release 26.1 Production on Fri Jun 26 05:58:41 2026

Copyright (c) 1982, 2026, Oracle. All rights reserved.

SQL> exit
[ec2-user@mytestec2 bin]$

3. SSL certificate configuration

When you add the RDS certificates to the Oracle Wallet to establish a secure connection with Amazon RDS for Oracle, add each certificate individually, because the Amazon RDS certificate bundle contains multiple certificates in a single PEM file.

Adding the bundle directly to the wallet causes the DMS endpoint test connection to fail. Refer to the Troubleshooting section for the specific error message.

A. Download the Amazon RDS certificate bundle

Download the regional certificate bundle for your AWS Region. The following example uses the us-east-1 region bundle. Substitute the bundle URL for your target Region:

wget https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem

Note: This example uses us-east-1-bundle.pem for illustration purposes. You can use the certificate bundle for any supported AWS Region. Replace the URL with the bundle URL for your target region.

B. Split the certificate bundle into individual certificates

Use the following awk command to split the bundle into separate PEM files. This creates three files, each containing one certificate: cert.pem, cert1.pem, and cert2.pem:

cat us-east-1-bundle.pem | awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cert" n ".pem"}'

4. Oracle Wallet creation and configuration

The Oracle Wallet is a secure storage container for SSL certificates. You create and manage it using the orapki utility included in SQLcl. The wallet uses auto-login mode, so Oracle tools can open it without prompting for a password. This is a requirement for automated processes like AWS DMS.

After creating the wallet and adding all three certificates, verify the wallet contents to confirm the configuration before proceeding.

A. Create the Oracle Wallet

Create the wallet directory, restrict its permissions, and then start SQLcl in no-login mode to create the wallet:

# Create the directory and its parent folders
mkdir -p /path/my_wallet
# Restrict permissions (highly recommended for security)
chmod 700 /path/my_wallet

The following session shows creating the wallet directory within the sqlcl/bin directory:

[ec2-user@mytestec2 bin]$ pwd
/home/ec2-user/sqlcl/bin
[ec2-user@mytestec2 bin]$ mkdir -p my_wallet
[ec2-user@mytestec2 bin]$ ls -ltrh
total 244K
-rw-r-----. 1 ec2-user ec2-user 152 Jan 1 2023 version.txt
-rwxr-xr-x. 1 ec2-user ec2-user 177K Jan 1 2023 sql.exe
-rwxr-xr-x. 1 ec2-user ec2-user 36K Jan 1 2023 sql
-rw-r-----. 1 ec2-user ec2-user 3.9K Jan 1 2023 dependencies.txt
-rw-r--r--. 1 ec2-user ec2-user 4.5K Sep 9 2024 us-east-1-bundle.pem
-rw-r--r--. 1 ec2-user ec2-user 2.1K Jun 26 05:59 cert2.pem
-rw-r--r--. 1 ec2-user ec2-user 989 Jun 26 05:59 cert1.pem
-rw-r--r--. 1 ec2-user ec2-user 1.5K Jun 26 05:59 cert.pem
drwxr-xr-x. 2 ec2-user ec2-user 6 Jun 26 05:59 my_wallet
[ec2-user@mytestec2 bin]$

Start SQLcl in no-login mode, then create the wallet:

./sql /nolog
SQL> orapki wallet create -wallet my_wallet -auto_login_only

Expected output: “Operation is successfully completed.” from Oracle PKI Tool Release 23.0.0.0.0.

B. Add certificates to the wallet

Add each of the three individual certificates to the wallet. All three certificates must be added for the DMS SSL connection to succeed:

SQL> orapki wallet add -wallet my_wallet -trusted_cert -cert cert1.pem -auto_login_only
SQL> orapki wallet add -wallet my_wallet -trusted_cert -cert cert.pem -auto_login_only
SQL> orapki wallet add -wallet my_wallet -trusted_cert -cert cert2.pem -auto_login_only

C. Verify the wallet contents

Confirm that all three trusted certificates were successfully added:

SQL> orapki wallet display -wallet my_wallet

The output should list three Trusted Certificates, as shown here:

Requested Certificates:
User Certificates:
Trusted Certificates:
Subject: L=Seattle,CN=Amazon RDS us-east-1 Root CA RSA2048 G1,ST=WA,OU=Amazon RDS,O=Amazon Web Services\, Inc.,C=US
Subject: L=Seattle,CN=Amazon RDS us-east-1 Root CA ECC384 G1,ST=WA,OU=Amazon RDS,O=Amazon Web Services\, Inc.,C=US
Subject: L=Seattle,CN=Amazon RDS us-east-1 Root CA RSA4096 G1,ST=WA,OU=Amazon RDS,O=Amazon Web Services\, Inc.,C=US

After adding all certificates, the wallet directory contains the Oracle Wallet files created by the orapki utility:

[ec2-user@mytestec2 bin]$ cd my_wallet/
[ec2-user@mytestec2 my_wallet]$ pwd
/home/ec2-user/sqlcl/bin/my_wallet
[ec2-user@mytestec2 my_wallet]$ ls -ltrh
total 4.0K
-rw-------. 1 ec2-user ec2-user 0 Jun 26 06:00 cwallet.sso.lck
-rw-------. 1 ec2-user ec2-user 3.8K Jun 26 06:01 cwallet.sso

5. Oracle network files configuration

Three Oracle network configuration files are required to direct SQLcl and JDBC connections to use the wallet for SSL. These files tell the Oracle client where to find the wallet, how to handle SSL authentication, and how to resolve the database alias used in the connection string. Create all three files inside the my_wallet directory.

A. Create sqlnet.ora

Navigate to the wallet directory and create sqlnet.ora. This file specifies the wallet location and SSL connection parameters:

cd my_wallet
vi sqlnet.ora

Add the following content:

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /home/ec2-user/sqlcl/bin/my_wallet)))
SSL_CLIENT_AUTHENTICATION = FALSE
SSL_VERSION = 1.2
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA)
SSL_SERVER_DN_MATCH = ON

B. Create tnsnames.ora

Create tnsnames.ora to define the ORCL connection alias that uses the TCPS protocol and SSL port 2484. Replace the HOST value with your actual Amazon RDS for Oracle endpoint:

vi tnsnames.ora

Add the following content, replacing the host and SID values with those for your RDS instance:

ORCL=
 (DESCRIPTION =
   (ADDRESS_LIST =
     (ADDRESS =
       (PROTOCOL = TCPS)
       (HOST = mytestdb.xyz.us-east-1.rds.amazonaws.com)
       (PORT = 2484)
     )
   )
   (CONNECT_DATA =
     (SID = ORCL)
   )
   (SECURITY =
     (SSL_SERVER_CERT_DN = "C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=mytestdb.xyz.us-east-1.rds.amazonaws.com")
   )
 )

C. Create ojdbc.properties

Create ojdbc.properties to configure the JDBC driver to use the wallet when SQLcl establishes connections:

vi ojdbc.properties

Add the following content:

oracle.net.wallet_location=(source=(method=file)(method_data=(directory=${TNS_ADMIN})))

After creating all three files, the wallet directory should contain the following files:

[ec2-user@mytestec2 my_wallet]$ ls -ltrh
total 16K
-rw-------. 1 ec2-user ec2-user 0 Jun 26 06:00 cwallet.sso.lck
-rw-------. 1 ec2-user ec2-user 3.8K Jun 26 06:01 cwallet.sso
-rw-r--r--. 1 ec2-user ec2-user 282 Jun 26 06:11 sqlnet.ora
-rw-r--r--. 1 ec2-user ec2-user 403 Jun 26 06:12 tnsnames.ora
-rw-r--r--. 1 ec2-user ec2-user 88 Jun 26 06:12 ojdbc.properties
[ec2-user@mytestec2 my_wallet]$

6. Environment configuration and testing

Before testing the SSL connection, set the TNS_ADMIN environment variable so that SQLcl and the Oracle JDBC driver can locate the wallet directory and the network configuration files.

Testing both a non-SSL (TCP) and SSL (TCPS) connection confirms that the wallet and network files are correctly configured. It also verifies that the SSL setup is working before you proceed to the AWS DMS integration.

Note: Navigate to the SQLcl bin directory before starting SQLcl in no-login mode:

cd /home/ec2-user/sqlcl/bin

A. Set the TNS_ADMIN environment variable

Export the TNS_ADMIN variable to point to your wallet directory:

export TNS_ADMIN=/home/ec2-user/sqlcl/bin/my_wallet

B. Test the SSL (TCPS) connection

Connect using the ORCL alias defined in tnsnames.ora. This connection uses the TCPS protocol on port 2484 with the Oracle Wallet for certificate validation:

./sql admin@ORCL

After connecting, run the following query to confirm the connection uses TCPS:

SELECT sys_context('USERENV', 'NETWORK_PROTOCOL') as network_protocol FROM dual;

The following session transcript illustrates a successful SSL connection. The result tcps in the NETWORK_PROTOCOL column confirms that the wallet and network files are correctly configured:

[ec2-user@mytestec2 bin]$ export TNS_ADMIN=/home/ec2-user/sqlcl/bin/my_wallet
[ec2-user@mytestec2 bin]$ ./sql admin@ORCL

SQLcl: Release 26.1 Production on Fri Jun 26 06:20:17 2026

Copyright (c) 1982, 2026, Oracle. All rights reserved.

Password? (**********?) *********
Last Successful login time: Fri Jun 26 2026 06:20:24 +00:00

Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.31.0.0.0

SQL>
SQL> select * from global_name;

GLOBAL_NAME
____________
ORCL

SQL> show user;
USER is "ADMIN"
SQL> SELECT sys_context('USERENV', 'NETWORK_PROTOCOL') as network_protocol FROM dual;

NETWORK_PROTOCOL
___________________
tcps

7. AWS DMS integration

With the Oracle Wallet created and SSL connectivity confirmed, you can now configure AWS DMS to use the wallet for secure Oracle endpoint connections. This involves three steps:

  • Upload the wallet file to Amazon S3.
  • Import it as a certificate in the AWS DMS console.
  • Configure a DMS endpoint that references the imported certificate.

For more information, see Configuring SSL encryption on Oracle and PostgreSQL endpoints in AWS DMS.

8. Verification and troubleshooting

Use the following checks and error resolutions if you encounter issues at any stage of the setup.

Verification steps

Verify configuration files: Confirm that sqlnet.ora, tnsnames.ora, and ojdbc.properties exist in the wallet directory:

ls -la /home/ec2-user/sqlcl/bin/my_wallet

Verify wallet permissions: Confirm that the cwallet.sso file is owned by the ec2-user and has read/write access:

ls -l /home/ec2-user/sqlcl/bin/my_wallet/cwallet.sso

Verify SSL connection protocol: After connecting through the ORCL alias, run the following query and confirm the result is tcps:

SELECT sys_context('USERENV', 'NETWORK_PROTOCOL') as network_protocol FROM dual;

Verify TNS_ADMIN is set correctly: Confirm the environment variable points to the wallet directory before launching SQLcl:

echo $TNS_ADMIN
/home/ec2-user/sqlcl/bin/my_wallet

Common errors and resolutions

Error: SSL handshake failure

If you observe the following error message during the SSL database connection, it indicates that the TLS_RSA_* cipher suites are disabled:

[ec2-user@mytestec2 bin]$ ./sql admin@ORCL

SQLcl: Release 26.1 Production on Fri Jun 26 06:14:16 2026

Copyright (c) 1982, 2026, Oracle. All rights reserved.

Password? (**********?) *********
Connection failed
USER = admin
URL = jdbc:oracle:thin:@ORCL
Error Message = ORA-17967: SSL Handshake failure.: (handshake_failure)
Received fatal alert: handshake_failure
(CONNECTION_ID=q8NRPMdTR0GCgITaOQcFXw==)
https://docs.oracle.com/error-help/db/ora-17967/
[ec2-user@mytestec2 bin]$

This error occurs because Java security settings disable TLS_RSA_* cipher suites by default. Since Amazon RDS for Oracle uses RSA certificates, you must use an SSL_RSA_* cipher suite. JDK 21 disables all TLS_RSA_* ciphers by default. The workaround is to re-enable the RSA ciphers in your JDK security configuration.

Workaround: Re-enable RSA cipher suites

  • Find your java.security file.
  • View the full jdk.tls.disabledAlgorithms value.
  • Back up the java.security file before making any changes.
  • Remove TLS_RSA_* from the disabled algorithms list.
  • Verify the changes to your java.security file.

Find your java.security file:

JAVA_SECURITY=$(find /usr/lib/jvm -name "java.security" 2>/dev/null | head -1)
echo "Found: $JAVA_SECURITY"
[ec2-user@mytestec2 bin]$ JAVA_SECURITY=$(find /usr/lib/jvm -name "java.security" 2>/dev/null | head -1)
echo "Found: $JAVA_SECURITY"
Found: /usr/lib/jvm/java-21-amazon-corretto.x86_64/conf/security/java.security
[ec2-user@mytestec2 bin]$

See the full jdk.tls.disabledAlgorithms value (multi-line with \):

sed -n '/^jdk.tls.disabledAlgorithms/,/[^\\]$/p' /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security
[ec2-user@mytestec2 bin]$ sed -n '/^jdk.tls.disabledAlgorithms/,/[^\\]$/p' /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, \
MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
ECDH, TLS_RSA_*, rsa_pkcs1_sha1 usage HandshakeSignature, \
ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature
[ec2-user@mytestec2 bin]$

Back up the java.security file:

sudo cp /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security.bak
[ec2-user@mytestec2 bin]$ sudo cp /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security.bak
[ec2-user@mytestec2 bin]$
[ec2-user@mytestec2 bin]$ ls -ltrh /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security.bak
-rw-r--r--. 1 root root 69K Jun 26 06:17 /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security.bak
[ec2-user@mytestec2 bin]$
[ec2-user@mytestec2 bin]$

Remove TLS_RSA_* from Disabled Algorithms:

sudo sed -i '/^jdk.tls.disabledAlgorithms/,/[^\\]$/{
/^jdk.tls.disabledAlgorithms/,/[^\\]$/c\
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, \\\
MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \\\
ECDH, rsa_pkcs1_sha1 usage HandshakeSignature, \\\
ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature
}' /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security

Verify the change:

echo "=== AFTER ==="
sed -n '/^jdk.tls.disabledAlgorithms/,/[^\\]$/p' /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security
[ec2-user@mytestec2 bin]$ echo "=== AFTER ==="
sed -n '/^jdk.tls.disabledAlgorithms/,/[^\\]$/p' /usr/lib/jvm/java-21-amazon-corretto/conf/security/java.security
=== AFTER ===
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, \
MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
ECDH, rsa_pkcs1_sha1 usage HandshakeSignature, \
ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature

Note: For RDS Oracle 19c and 21c versions, the Oracle SSL option is configured with the ‘SSL_RSA_WITH_AES_256_CBC_SHA’ cipher suite as the default [ TLS 1.0 or 1.2 ]. If you attempt to establish an SSL connection using SQLcl for Oracle 19c/21c with the default cipher suite, the connection fails with a “handshake_failure” message. Therefore, the preceding steps are required to establish the SSL connection to the RDS Oracle instance.

However, if you set any TLS_* cipher suite for Oracle 19c/21c, the SSL connection succeeds and you do not need to perform the preceding steps. The Oracle SSL option for the RDS Oracle 26ai version uses ‘TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384’ as the default cipher suite [ TLS 1.2 ], so the SSL connection from SQLcl succeeds without any error messages.

Error: DMS certificate validation failure

If the DMS endpoint test connection fails with the following message, the certificate bundle was added directly to the wallet instead of the individual certificate files:

Test Endpoint failed: Application-Status: 1020912,
Application-Message: ORA-12533: TNS:illegal ADDRESS parameters OCI error.
Additional info: Code: [DMS-00032], Message: [Certificate validation failure],
NativeErrorCode: [ORA-29024]

To resolve this, remove the wallet and recreate it using the split certificate files (cert.pem, cert1.pem, cert2.pem) as described in Sections 3 and 4. Adding the bundle file (us-east-1-bundle.pem or global-bundle.pem) directly to the wallet causes this failure.

Error: ORA-17002: I/O error: IO Error (certificate_unknown) PKIX path building failed.

[ec2-user@mytestec2 bin]$ ./sql admin@ORCL

SQLcl: Release 26.1 Production on Wed Jul 22 07:35:00 2026

Copyright (c) 1982, 2026, Oracle. All rights reserved.

Password? (**********?) *********
Connection failed
USER = admin
URL = jdbc:oracle:thin:@ORCL
Error Message = ORA-17002: I/O error: IO Error (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target, connect lapse 225 ms., Authentication lapse 0 ms.
https://docs.oracle.com/error-help/db/ora-17002/

Resolution: SQLcl’s JDBC thin driver ignores the WALLET_LOCATION directive in sqlnet.ora, which only works for OCI or thick clients. Instead, it falls back to the JDK’s default truststore (cacerts), which lacks the Amazon RDS root CA. This causes a TLS handshake failure, even though TNS name resolution works because tnsnames.ora is read from TNS_ADMIN. SSL trust is handled by a separate layer.

To fix this, create an ojdbc.properties file in your TNS_ADMIN or wallet directory with:

oracle.net.wallet_location=(source=(method=file)(method_data=(directory=${TNS_ADMIN})))

This tells the JDBC thin driver to load the wallet (cwallet.sso) from that directory for SSL trust, so it can find the Amazon RDS CA certificate and complete the connection.

Error: ORA-17002: I/O error: IO Error (protocol_version) The server selected protocol version TLS10 is not accepted by client preferences [TLS13, TLS12], connect lapse 14 ms., Authentication lapse 0 ms.

Resolution: This error occurs because of a mismatch between the TLS version [ SQLNET.SSL_VERSION ] in the Oracle SSL option for RDS Oracle and the TLS version set for ‘SSL_VERSION’ in the sqlnet.ora file on the EC2 instance. Make sure that the TLS versions are set up appropriately.

Error: Connection timeout

If connections time out on port 2484, verify that the EC2 instance security group and the RDS instance security group both permit inbound TCP traffic on port 2484 from the DMS replication instance subnet.

Conclusion

In this post, we demonstrated how to install Java and Oracle SQLcl and create an Oracle Wallet using Oracle SQLcl. We also showed how to split the certificate bundle and configure it for secure SSL connections with AWS DMS endpoints to Amazon RDS for Oracle. Using SQLcl instead of the full Oracle Client reduces the tooling footprint while maintaining full wallet management capability through the included orapki and mkstore utilities.

After the SSL configuration is complete, configure AWS DMS replication tasks to begin your database migration using the SSL endpoint that you configured. We also recommend that you review best practices for successful SSL connections to Amazon RDS for Oracle for advanced SSL tuning and cipher suite recommendations. Additionally, explore the AWS DMS documentation for advanced migration configurations, including ongoing replication and task settings.

Finally, try implementing this solution in your development environment before applying it to production to validate the wallet and endpoint settings.

About the authors

Vamshi Krishna Panganam

Vamshi Krishna Panganam

Vamshi is a Database Engineer at AWS with subject matter expertise in RDS for Oracle. He specializes in Amazon RDS, RDS for PostgreSQL, and AWS Database Migration Service, helping customers plan, design, and troubleshoot database and migration solutions on AWS. Outside of work, he enjoys spending time with his family and kids. He also values time for spiritual reflection and practices.

Rajat Kumar Samanta

Rajat Kumar Samanta

Rajat is a Database Engineer at AWS. With over a decade of database expertise across Oracle, PostgreSQL, and Aurora PostgreSQL, Rajat helps customers with migrations, upgrades, performance tuning, and building resilient database operations in the cloud. He is also a Subject Matter Expert in RDS for Oracle and actively contributes to the AWS community through blog posts, knowledge sharing, and mentoring fellow engineers.