Secure Your GoldenGate Environment with Server, Client & Root CA Certificates
Oracle GoldenGate 19c Microservices Architecture (MA) brings a modern, secure, web-based replication framework designed for cloud-ready, mission-critical environments. One of its biggest strengths is the focus on security, particularly in how components authenticate and communicate across deployments.
To fully leverage MA security, GoldenGate requires TLS/SSL certificates—specifically root CA, server certificates, and client certificates—to securely encrypt and validate communication between your GoldenGate deployments.
This blog (Part 2 of the series) explains how to create these certificates step-by-step using orapki, the Oracle Wallet utility included with GoldenGate and Oracle Database.
If you haven’t read Part 1 – Software Installation, it’s best to start there.
Now, let’s begin.
Why Certificates Matter in GoldenGate Microservices
GoldenGate MA communication occurs over secure HTTPS ports. To protect this communication, GoldenGate uses:
- Server Certificates → authenticate each GoldenGate service
- Client Certificates → authenticate Distribution Server and Receiver Server communications
- Root CA Certificate → acts as the trust anchor for all certificates
Authentication between servers (Admin, Distribution, Receiver, Metrics) depends on a trusted certificate chain, which ensures every call and every data packet is verified.
GoldenGate supports two types of certificates:
- CA-signed certificates (recommended for production)
- Self-signed certificates (sufficient for testing/non-production)
In this blog, we focus on creating self-signed certificates using orapki.
Phase 2: Creating Certificates
To secure a GoldenGate deployment, you need two certificates:
1. Server Certificate
Used by all GoldenGate MA services (Admin, Receiver, Distribution, etc.)
2. Client Certificate
Used by Distribution and/or Receiver servers to securely connect to remote GoldenGate deployments.
Most organizations use the same Certificate Authority (CA) for all deployments. If you use different CAs, add them as trusted certificates so GoldenGate can validate them.
Oracle recommends storing certificates in auto-login wallets, which do not require a password at runtime.
Creating a Self-Signed Root CA Certificate
The root CA certificate is the foundation of the entire GoldenGate trust model.
You will create a wallet that stores the CA certificate and use it to sign server and client certificates.
Step-by-step example
1. Create a directory for wallets
mkdir -p ~/wallet_directory
2. Create auto-login CA wallet
orapki wallet create -wallet ~/wallet_directory/root_ca -auto_login -pwd welcome123
3. Add root certificate to the wallet
orapki wallet add -wallet ~/wallet_directory/root_ca -dn "CN=RootCA" -keysize 2048 -self_signed -validity 7300 -sign_alg sha256 -pwd welcome123
4. Export the certificate
orapki wallet export -wallet ~/wallet_directory/root_ca -dn "CN=RootCA" -cert ~/wallet_directory/rootCA_Cert.pem -pwd welcome123
Your CA certificate is now created, and this wallet will be used to sign server and client certificates.
Creating a Self-Signed Server Certificate
Each GoldenGate MA deployment requires a server certificate that uniquely identifies that deployment.
You will create:
- a wallet for that server
- a CSR (Certificate Signing Request)
- a signed certificate using the root CA
- final trusted certificates for TLS communication
Steps:
1. Create server wallet
orapki wallet create -wallet ~/wallet_directory/servername -auto_login -pwd welcome123
2. Add server certificate request
orapki wallet add -wallet ~/wallet_directory/servername -dn "CN=servername" -keysize 2048 -pwd welcome123
3. Export CSR
orapki wallet export -wallet ~/wallet_directory/servername -dn "CN=servername" -request ~/wallet_directory/servername_req.pem -pwd welcome123
4. Sign server certificate using Root CA
orapki cert create -wallet ~/wallet_directory/root_ca \
-request ~/wallet_directory/servername_req.pem \
-cert ~/wallet_directory/servername_Cert.pem \
-serial_num 20 \
-validity 375 \
-sign_alg sha256 \
-pwd welcome123
5. Add trusted root certificate
orapki wallet add -wallet ~/wallet_directory/servername -trusted_cert -cert ~/wallet_directory/rootCA_Cert.pem -pwd welcome123
6. Add signed server certificate (user certificate)
orapki wallet add -wallet ~/wallet_directory/servername -user_cert -cert ~/wallet_directory/servername_Cert.pem
The server certificate wallet is now complete.
This wallet will be used for your GoldenGate Service Manager, Admin Server, Receiver Server, Distribution Server, and Metrics Server.
Creating a Self-Signed Client Certificate
Client certificates are used for:
- Distribution Server
- Receiver Server
- Cross-deployment communication
The process is extremely similar to server certificate creation.
Steps:
1. Create client wallet
orapki wallet create -wallet ~/wallet_directory/dist_client -auto_login -pwd welcome123
2. Add certificate request
orapki wallet add -wallet ~/wallet_directory/dist_client -dn "CN=distclient" -keysize 2048 -pwd welcome123
3. Export CSR
orapki wallet export -wallet ~/wallet_directory/dist_client -dn "CN=distclient" -request ~/wallet_directory/distclient_req.pem -pwd welcome123
4. Sign client certificate using root CA
orapki cert create -wallet ~/wallet_directory/root_ca \
-request ~/wallet_directory/distclient_req.pem \
-cert ~/wallet_directory/distclient_Cert.pem \
-serial_num 30 \
-validity 375 \
-pwd welcome123 \
-sign_alg sha256
5. Add root CA as trusted cert
orapki wallet add -wallet ~/wallet_directory/dist_client -trusted_cert -cert ~/wallet_directory/rootCA_Cert.pem -pwd welcome123
6. Add signed client certificate as user cert
orapki wallet add -wallet ~/wallet_directory/dist_client -user_cert -cert ~/wallet_directory/distclient_Cert.pem -pwd welcome123
Your client TLS wallet is now ready.
Adding Trusted Points
If all GoldenGate deployments use the same root CA, the trust model is straightforward—just import the same root certificate everywhere.
If not, GoldenGate supports multiple trusted certificates to enable mutual TLS.
Example:
orapki wallet add -wallet <server_wallet> -trusted_cert -cert <remote_distclient_cert>.pem -pwd <wallet_pwd>
orapki wallet add -wallet <distclient_wallet> -trusted_cert -cert <remote_server_cert>.pem -pwd <wallet_pwd>
This ensures both deployments trust each other.
Best Practices for GoldenGate Certificate Management
✔ Use CA-signed certificates in production
Self-signed certificates are fine for labs, but enterprise deployments should use a professional CA such as:
- DigiCert
- Let’s Encrypt
- Internal corporate PKI
✔ Keep certificate validity between 1–3 years
Longer durations reduce administrative overhead.
✔ Always set strong wallet passwords
Use complex passwords—even for auto-login wallets.
✔ Maintain a secure backup of all wallets
Wallet loss = certificate loss = replication outage.
✔ Use unique serial numbers
This ensures proper certificate identification across deployments.
Conclusion
Certificates are the foundation of security in Oracle GoldenGate 19c Microservices Architecture.
In this blog, you learned how to create:
- A Root CA certificate
- Server certificates
- Client certificates
- Trusted certificate chains
With these certificates in place, you’re now ready for Part 3, where we’ll configure:
- Service Manager
- Admin Server
- Distribution & Receiver Services
- Secure communication across deployments
Related Blog Posts
- What Is Oracle GoldenGate? A Beginner-Friendly Introduction
- Oracle GoldenGate 19c Microservices Architecture (MA) – Software Installation Guide
- Oracle GoldenGate 19c Microservices Architecture – Creating Certificates
- Oracle GoldenGate 19c Microservices Architecture – Configuring MA Deployment Using oggca.sh
- How to Create an Extract in Oracle GoldenGate MA (Microservices Architecture)
- Oracle GoldenGate 19c MA Distribution Server: A Complete Beginner-Friendly Guide
Comments 4