Oracle – How to Import Certificates When a Connection Error Indicates Missing Certificates (4228863)

When monitoring remote Oracle databases in SSL mode, the Foglight Agent Manager (FglAM) must trust the database server's certificate. This requires importing the server certificate into the appropriate keystore used by the Oracle cartridge.

If the required certificate is not present in the keystore, the Oracle agent will fail to establish a secure connection, resulting in a certificate-related error.

Oracle Cartridge in FIPS-Compliant Mode

Applicable when:

• Foglight Management Server (FMS) is version 5.9.7 or later
• FIPS compliance mode is enabled
• Oracle cartridge is version 5.9.7.10 or later

Steps:

1. Navigate to the cartridge's lib directory:
   {FGLAM_HOME}/agents/DB_Oracle/5.9.7.10-xxxx-xxxx/lib
2. Run the certificate import tool:

Windows:

certificatetool-5.9.7.10.bat --add-certificate alias=c:\path	o\certificate.cer

Linux:

chmod u+x certificatetool-5.9.7.10.sh
./certificatetool-5.9.7.10.sh --add-certificate alias=/path/to/certificate.cer
    

Oracle Cartridge in Non-FIPS Mode

Applicable when FMS is running in non-FIPS mode.

Steps:

1. Ensure the Agent Manager is running.
2. Navigate to the FglAM bin directory:
   {FGLAM_HOME}/bin
3. Run the certificate import command:

fglam --add-certificate alias=c:/path/to/certificate.cer

The following video uses the same process as described above for SQL Server certificates and is relevant for Oracle agents.

• Ensure the certificate file is in a supported format (e.g., .cer or .pem).
• Use meaningful aliases to identify certificates in the keystore.
• Restart the Agent Manager after importing certificates to apply changes.