Use this guide to check which Oracle Database versions your connector host supports and how to encrypt the connection.
In this article, you will learn:
- Which Oracle Database versions each LTS release supports
- How to encrypt connections to Oracle Database (TLS and NNE)
- How to configure an On-Premise Connector Host (OPCH) for Oracle
This article applies to SQL connectors using the Oracle DB database type.
Oracle driver by release
Each connector host release ships a specific Oracle driver. The driver determines which Oracle Database versions you can connect to and which encryption options are available.
Cloud Connector Host (CCH)
| LTS release | Weekly release | node-oracledb | Mode |
|---|---|---|---|
| LTS15.10 and earlier | r309–r335 | 4.2.0 | Thick |
| LTS16 – LTS16.1 | r336–r369 | 6.10.0 | Thin |
| LTS16.2 | — | 6.10.0 | Thick |
| LTS17+ (planned) | r4xx (TBD) | 6.10.0 | Thin |
On-Premise Connector Host (OPCH)
| LTS release | Weekly release | node-oracledb | Mode | Bundled Instant Client |
|---|---|---|---|---|
| LTS15.10 and earlier | r309–r335 | 4.2.0 | Thick | 12.2.0.1.0 |
| LTS16 – LTS16.1 | r336–r369 | 6.10.0 | Thin | None |
| LTS16.2+ | — | 6.10.0 | Thick | 19.32.0.0 |
Note: If you connect to Oracle Database from an OPCH, update to LTS16.2 or later. It includes important fixes, including support for 11G password verification.
Compatibility matrix
This matrix applies to LTS16.2 and later. Check the Mode column in the tables above, then find your Oracle DB version below.
| Oracle DB | Thick mode | Thin mode |
|---|---|---|
| 11.2.0.3 and earlier | Not supported | Not supported |
| 11.2.0.4 | Supported | Not supported |
| 12.1 / 12.2 | Supported | Supported |
| 18c (18.4) | Supported | Supported |
| 19c / 21c / 23ai / 26ai | Supported | Supported |
Supported means the version falls within the range Oracle publishes for the shipped driver and client. See Oracle's client/server interoperability support matrix.
Encrypt the connection
Oracle Database supports two ways to encrypt traffic:
- TLS: Standard transport encryption using certificates. Oracle recommends TLS.
- Native Network Encryption (NNE): Oracle's own encryption, configured on the database server.
| Feature | Thin mode | Thick mode |
|---|---|---|
| TLS with a publicly trusted certificate | Supported | Not supported |
| TLS with an internal (private) certificate authority | OPCH only | Not supported |
| Native Network Encryption (NNE) | Not supported | Supported |
Note: TLS and NNE can't be used together on the same connector host.
Known issue: On releases before r4xx (TBD), turning on SSL for an Oracle DB connector has no effect and the connection is not encrypted. No error is shown. If you rely on encryption, use NNE on an OPCH until the fix is available.
Set up TLS
TLS is available on connector hosts running in Thin mode:
- Cloud Connector Host: from LTS17+ and an upcoming weekly release (TBD)
- On-Premise Connector Host with
TULIP_DISABLE_ORACLE_THICK_MODE=true
On these hosts, turn on SSL in the Oracle DB connector settings to encrypt the connection.
Internal certificate authority: If your database uses a certificate from an internal CA, the connector host must trust that CA. This is only possible on an OPCH in Thin mode: add your CA certificate with TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_FILES or TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_STRINGS. The Cloud Connector Host supports publicly trusted certificates only.
A connector host running in Thick mode doesn't support TLS. Use NNE instead.
Note: Switching an OPCH to Thin mode applies to every Oracle connector on that host. In Thin mode, NNE and Oracle DB 11.2.0.4 are not available.
OPCH environment variables for Oracle
| Variable | Description |
|---|---|
TULIP_DISABLE_ORACLE_THICK_MODE |
Set to true to run the Oracle driver in Thin mode. Default: false. Applies to the whole connector host, not individual connectors. |
TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_FILES |
JSON array of paths to extra trusted CA certificate files. Thin mode only. |
TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_STRINGS |
JSON array of extra trusted CA certificates as inline strings. Thin mode only. |
For OPCH setup, see Connector hosts.