---
title: "Oracle SQL Connectors with Connector Hosts"
slug: "oracle-sql-connectors-with-connector-hosts"
status: "new"
updated: 2026-10-09T18:56:18Z
published: 2026-10-09T18:56:18Z
canonical: "support.tulip.co/oracle-sql-connectors-with-connector-hosts"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.tulip.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Oracle SQL Connectors with Connector Hosts

*Use this guide to check which Oracle Database versions your connector host supports and how to encrypt the connection.*

**In this article, you will learn:**

- **Which Oracle Database versions each LTS release supports**
- **How to encrypt connections to Oracle Database (TLS and NNE)**
- **How to configure an On-Premise Connector Host (OPCH) for Oracle**

This article applies to [SQL connectors](https://support.tulip.co/docs/sql-connectors) using the **Oracle DB** database type.

## Oracle driver by release

Each connector host release ships a specific Oracle driver. The driver determines which Oracle Database versions you can connect to and which encryption options are available.

### Cloud Connector Host (CCH)

| LTS release | Weekly release | node-oracledb | Mode |
| --- | --- | --- | --- |
| LTS15.10 and earlier | r309–r335 | 4.2.0 | Thick |
| LTS16 – LTS16.1 | r336–r369 | 6.10.0 | Thin |
| LTS16.2 | — | 6.10.0 | Thick |
| LTS17+ (planned) | r4xx (TBD) | 6.10.0 | Thin |

### On-Premise Connector Host (OPCH)

| LTS release | Weekly release | node-oracledb | Mode | Bundled Instant Client |
| --- | --- | --- | --- | --- |
| LTS15.10 and earlier | r309–r335 | 4.2.0 | Thick | 12.2.0.1.0 |
| LTS16 – LTS16.1 | r336–r369 | 6.10.0 | Thin | None |
| LTS16.2+ | — | 6.10.0 | Thick | 19.32.0.0 |

> **Note:** If you connect to Oracle Database from an OPCH, update to **LTS16.2 or later**. It includes important fixes, including support for 11G password verification.

---

## Compatibility matrix

This matrix applies to **LTS16.2 and later**. Check the **Mode** column in the tables above, then find your Oracle DB version below.

| Oracle DB | Thick mode | Thin mode |
| --- | --- | --- |
| 11.2.0.3 and earlier | Not supported | Not supported |
| 11.2.0.4 | Supported | **Not supported** |
| 12.1 / 12.2 | Supported | Supported |
| 18c (18.4) | Supported | Supported |
| 19c / 21c / 23ai / 26ai | Supported | Supported |

**Supported** means the version falls within the range Oracle publishes for the shipped driver and client. See Oracle's [client/server interoperability support matrix](https://support.oracle.com/epmos/faces/DocumentDisplay?parent=DOCUMENT&sourceId=207303.1&id=161818.1).

---

## Encrypt the connection

Oracle Database supports two ways to encrypt traffic:

- **TLS:** Standard transport encryption using certificates. Oracle [recommends TLS](https://docs.oracle.com/en/database/oracle/oracle-database/26/dbseg/nne-vs-tls.html).
- **Native Network Encryption (NNE):** Oracle's own encryption, configured on the database server.

| Feature | Thin mode | Thick mode |
| --- | --- | --- |
| TLS with a publicly trusted certificate | Supported | Not supported |
| TLS with an internal (private) certificate authority | OPCH only | Not supported |
| Native Network Encryption (NNE) | Not supported | Supported |

> **Note:** TLS and NNE can't be used together on the same connector host.

> **Known issue:** On releases before r4xx (TBD), turning on **SSL** for an Oracle DB connector has no effect and the connection is not encrypted. No error is shown. If you rely on encryption, use NNE on an OPCH until the fix is available.

### Set up TLS

TLS is available on connector hosts running in Thin mode:

- Cloud Connector Host: from LTS17+ and an upcoming weekly release (TBD)
- On-Premise Connector Host with `TULIP_DISABLE_ORACLE_THICK_MODE=true`

On these hosts, turn on **SSL** in the Oracle DB connector settings to encrypt the connection.

**Internal certificate authority:** If your database uses a certificate from an internal CA, the connector host must trust that CA. This is only possible on an OPCH in Thin mode: add your CA certificate with `TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_FILES` or `TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_STRINGS`. The Cloud Connector Host supports publicly trusted certificates only.

A connector host running in Thick mode doesn't support TLS. Use NNE instead.

> **Note:** Switching an OPCH to Thin mode applies to every Oracle connector on that host. In Thin mode, NNE and Oracle DB 11.2.0.4 are not available.

---

## OPCH environment variables for Oracle

| Variable | Description |
| --- | --- |
| `TULIP_DISABLE_ORACLE_THICK_MODE` | Set to `true` to run the Oracle driver in Thin mode. Default: `false`. Applies to the whole connector host, not individual connectors. |
| `TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_FILES` | JSON array of paths to extra trusted CA certificate files. Thin mode only. |
| `TULIP_CONNECTORS_EXTRA_TRUSTED_CAS_FROM_STRINGS` | JSON array of extra trusted CA certificates as inline strings. Thin mode only. |

For OPCH setup, see [Connector hosts](https://support.tulip.co/docs/connector-hosts).