How to Install and Configure Secure Oracle GoldenGate 26ai Microservices Architecture on Oracle Linux 9

  • Post author:
  • Post category:OGG

In this hands-on lab, we install and configure Oracle GoldenGate 26ai Microservices Architecture (MA) with TLS security on an on-premises Oracle Linux 9 server.

The environment consists of one GoldenGate Service Manager and two deployments, ORCL01 and ORCL04, running on the same host.

We will install the GoldenGate software, generate a local Certificate Authority (CA), create CA-signed server and client certificates, and configure TLS 1.3 for secure communication between GoldenGate services.

The procedure uses a private lab CA and is intended for learning and testing. Production environments require additional security controls, including appropriate certificate lifecycle management, stronger authentication policies, and network access restrictions.

Environment: Oracle Linux 9, Oracle GoldenGate 26ai, OpenSSL, and one on-premises Linux host.

Commands and paths in this guide are specific to this environment and may require modification for other operating systems or GoldenGate releases.

Install Software

$ cd fbo_ggs_Linux_x64_Oracle_services_shiphome/Disk1
$ mkdir -p /opt/app/ogg/orcl23ai01
$ mkdir /opt/app/oraInventory

$ cat /tmp/ogg.rsp
oracle.install.responseFileVersion=/oracle/install/rspfmt_ogginstall_response_schema_v23_1_0
INSTALL_OPTION=ORA26ai
SOFTWARE_LOCATION=/opt/app/ogg/orcl23ai01
INVENTORY_LOCATION=/opt/app/oraInventory
UNIX_GROUP_NAME=opc

$ ./runInstaller -silent -nowait -responseFile /tmp/ogg.rsp
$ sudo /opt/app/oraInventory/orainstRoot.sh

Set up Keys, Certificates and Truststore

I use a personal mini PC with IP address 192.168.1.95 to host GoldenGate. I added the following entry to /etc/hosts to resolve the hostname ogglab locally. This hostname is also used as the Common Name (CN) and DNS Subject Alternative Name (SAN) in the server certificate.

/etc/hosts
192.168.1.95 ogglab

In this lab, I configure one Service Manager (SM01) and two deployments (ORCL01 and ORCL04). I generate a server certificate for the GoldenGate services and separate client certificates for each deployment.
The truststore.jks file is not used in this lab. However, it is created for potential use by other applications such as the OCI Stack Monitoring plugin.

$ cd /opt/app/ogg/security/sm01
$ openssl req -subj "/CN=RootCA" -newkey rsa:2048 -nodes -keyout rootCA_key.pem -new -x509 -days 3650 -out rootCA_cert.pem
$ openssl req -subj "/C=ES/O=OGGLab/CN=ogglab" -newkey rsa:2048 -nodes -keyout ogglabsm01.pem -new -out ogglabsm01.csr
$ openssl req -subj "/C=ES/O=OGGLab/CN=ogglab" -newkey rsa:2048 -nodes -keyout ogglaborcl01.pem -new -out ogglaborcl01.csr
$ openssl req -subj "/C=ES/O=OGGLab/CN=ogglab" -newkey rsa:2048 -nodes -keyout ogglaborcl04.pem -new -out ogglaborcl04.csr
$ keytool -importcert -storetype JKS -keystore truststore.jks -alias rootca -file rootCA_cert.pem
$ cat ogglabsm01_cert.cnf
extendedKeyUsage = serverAuth
subjectAltName = DNS:ogglab,IP:192.168.1.95

$ cat ogglaborcl01_cert.cnf
extendedKeyUsage = clientAuth
subjectAltName = DNS:ogglab,IP:192.168.1.95
openssl x509 -CAcreateserial -CA    rootCA_cert.pem -CAkey rootCA_key.pem -req  -in  ogglabsm01.csr -extfile ogglabsm01_cert.cnf -days 3650 -out ogglabsm01_cert.pem
openssl x509 -CAcreateserial -CA    rootCA_cert.pem -CAkey rootCA_key.pem -req  -in  ogglaborcl01.csr -extfile ogglaborcl01_cert.cnf -days 3650 -out ogglaborcl01_cert.pem
openssl x509 -CAcreateserial -CA    rootCA_cert.pem -CAkey rootCA_key.pem -req  -in  ogglaborcl04.csr -extfile ogglaborcl01_cert.cnf -days 3650 -out ogglaborcl04_cert.pem
openssl verify -CAfile rootCA_cert.pem ogglabsm01_cert.pem
openssl verify -CAfile rootCA_cert.pem ogglaborcl01_cert.pem

I use path /opt/app/ogg/security/sm01 to store all files

$ ls -l /opt/app/ogg/security/sm01
total 60
-rw-r--r--. 1 oracle oinstall   75 May 12 09:25 ogglaborcl01_cert.cnf
-rw-r--r--. 1 oracle oinstall 1184 May 12 09:26 ogglaborcl01_cert.pem
-rw-r--r--. 1 oracle oinstall  928 May 12 09:25 ogglaborcl01.csr
-rw-------. 1 oracle oinstall 1704 May 12 09:25 ogglaborcl01.pem
-rw-r--r--. 1 oracle oinstall 1184 May 12 09:50 ogglaborcl04_cert.pem
-rw-r--r--. 1 oracle oinstall  928 May 12 09:49 ogglaborcl04.csr
-rw-------. 1 oracle oinstall 1704 May 12 09:49 ogglaborcl04.pem
-rw-r--r--. 1 oracle oinstall   75 May 11 15:51 ogglabsm01_cert.cnf
-rw-r--r--. 1 oracle oinstall 1184 May 11 15:51 ogglabsm01_cert.pem
-rw-r--r--. 1 oracle oinstall  928 May 11 15:51 ogglabsm01.csr
-rw-------. 1 oracle oinstall 1704 May 11 15:51 ogglabsm01.pem
-rw-r--r--. 1 oracle oinstall 1107 May 11 15:48 rootCA_cert.pem
-rw-r--r--. 1 oracle oinstall   41 May 12 09:50 rootCA_cert.srl
-rw-------. 1 oracle oinstall 1704 May 11 15:48 rootCA_key.pem
-rw-r--r--. 1 oracle oinstall  838 Oct 27 12:21 truststore.jks

Set up Service Manager and Deployments

To set up service manager and deployments, refer to the documentation. For 26ai: https://docs.oracle.com/en/database/goldengate/core/26/coredoc/deploy-add-deployment.html

Service Manager and ORCL01

I am also enabling StatsD metrics to be sent to Telegraf agent listening on the same host. Refer to my other post Monitor On-Premises GoldenGate Using StatsD Metrics in OCI Monitoring for details of such configuration.

Security Note: Strong Password Policy and FIPS Mode are disabled in this lab environment.

--------------------------------------------------------------------------------
Service Manager Settings
--------------------------------------------------------------------------------

- Create New Service Manager : true
- Service Manager Hostname/Address : ogglab
- Service Manager Port : 16000
- Service Manager Home : /opt/app/ogg/deployments/sm01
- Service Manager ETC_HOME : /opt/app/ogg/deployments/sm01/etc
- Service Manager CONF_HOME : /opt/app/ogg/deployments/sm01/etc/conf
- Service Manager SSL_HOME : /opt/app/ogg/deployments/sm01/etc/ssl
- Service Manager VAR_HOME : /opt/app/ogg/deployments/sm01/var
- Service Manager DATA_HOME : /opt/app/ogg/deployments/sm01/var/lib/data
- Service Manager ARCHIVE_HOME : /opt/app/ogg/deployments/sm01/var/lib/archive
- Enable Remote Metrics for the Service Manager : true
- Remote Metrics StatsD Host : 192.168.1.95
- Remote Metrics StatsD Port : 8125
--------------------------------------------------------------------------------
Configuration Settings
--------------------------------------------------------------------------------

- Deployment Configuration : ADD
- Deployment Name : ORCL01
- Software Home : /opt/app/ogg/orcl23ai01
- Strong Password Policy Enabled : false
- FIPS Mode Enabled : false
--------------------------------------------------------------------------------
Deployment Directories
--------------------------------------------------------------------------------

- Deployment Home : /opt/app/ogg/deployments/orcl01
- OGG_ETC_HOME : /opt/app/ogg/deployments/orcl01/etc
- OGG_CONF_HOME : /opt/app/ogg/deployments/orcl01/etc/conf
- OGG_SSL_HOME : /opt/app/ogg/deployments/orcl01/etc/ssl
- OGG_VAR_HOME : /opt/app/ogg/deployments/orcl01/var
- OGG_DATA_HOME : /opt/app/ogg/deployments/orcl01/var/lib/data
- OGG_ARCHIVE_HOME : /opt/app/ogg/deployments/orcl01/var/lib/archive
--------------------------------------------------------------------------------
Environment Variables
--------------------------------------------------------------------------------

- ORACLE_HOME : /opt/app/ogg/orcl23ai01/lib/instantclient
- LD_LIBRARY_PATH : ${OGG_HOME}/lib/instantclient:${OGG_HOME}/lib
- TNS_ADMIN : /opt/oracle/product/19c/dbhome_1/network/admin/
--------------------------------------------------------------------------------
Service Manager Administrator Account
--------------------------------------------------------------------------------

- Username : admin
--------------------------------------------------------------------------------
Deployment Administrator Account
--------------------------------------------------------------------------------

- Username : admin
--------------------------------------------------------------------------------
Security Options
--------------------------------------------------------------------------------

- SSL / TLS Security : true
- Server Certificate : /opt/app/ogg/security/sm01/ogglabsm01_cert.pem
- Private Key File : /opt/app/ogg/security/sm01/ogglabsm01.pem
- Server CA Certificates File : /opt/app/ogg/security/sm01/rootCA_cert.pem
- Client Certificate : /opt/app/ogg/security/sm01/ogglaborcl01_cert.pem
- Private Key File : /opt/app/ogg/security/sm01/ogglaborcl01.pem
- Client CA Certificates File : /opt/app/ogg/security/sm01/rootCA_cert.pem
--------------------------------------------------------------------------------
Advanced Security Options
--------------------------------------------------------------------------------

- TLS v1.3 Enabled : true
- TLS v1.2 Enabled : false
--------------------------------------------------------------------------------
Port Settings
--------------------------------------------------------------------------------

- Enable Administration Service : true
- Administration Service Port : 16001
- Enable Distribution Service : true
- Distribution Service Port : 16002
- Enable Receiver Service : true
- Receiver Service Port : 16003
- Enable Monitoring : true
- Metrics Service port : 16004
- Critical Service : false
- Metrics Service DataStore type : BDB
- Metrics Service DataStore home : /opt/app/ogg/deployments/orcl01/metricdb
- Enable Remote Metrics for the Deployment : true
- Remote Metrics StatsD Host : 192.168.1.95
- Remote Metrics StatsD Port : 8125
--------------------------------------------------------------------------------
Configuration Service
--------------------------------------------------------------------------------

- Enable Configuration Service : false
--------------------------------------------------------------------------------
Plugin Service
--------------------------------------------------------------------------------

- Enable Plugin Service : false
--------------------------------------------------------------------------------
Replication Settings
--------------------------------------------------------------------------------

- Replication Schema : GGADMIN
--------------------------------------------------------------------------------

ORCL04

--------------------------------------------------------------------------------
Service Manager Settings
--------------------------------------------------------------------------------

- Create New Service Manager : false
- Service Manager Hostname/Address : ogglab
- Service Manager Port : 16000
- Existing Service Manager integrated with XAG : false
- Enable Remote Metrics for the Service Manager : false
--------------------------------------------------------------------------------
Configuration Settings
--------------------------------------------------------------------------------

- Deployment Configuration : ADD
- Deployment Name : ORCL04
- Software Home : /opt/app/ogg/orcl23ai01
- Strong Password Policy Enabled : false
- FIPS Mode Enabled : false
--------------------------------------------------------------------------------
Deployment Directories
--------------------------------------------------------------------------------

- Deployment Home : /opt/app/ogg/deployments/orcl04
- OGG_ETC_HOME : /opt/app/ogg/deployments/orcl04/etc
- OGG_CONF_HOME : /opt/app/ogg/deployments/orcl04/etc/conf
- OGG_SSL_HOME : /opt/app/ogg/deployments/orcl04/etc/ssl
- OGG_VAR_HOME : /opt/app/ogg/deployments/orcl04/var
- OGG_DATA_HOME : /opt/app/ogg/deployments/orcl04/var/lib/data
- OGG_ARCHIVE_HOME : /opt/app/ogg/deployments/orcl04/var/lib/archive
--------------------------------------------------------------------------------
Environment Variables
--------------------------------------------------------------------------------

- ORACLE_HOME : /opt/app/ogg/orcl23ai01/lib/instantclient
- LD_LIBRARY_PATH : ${OGG_HOME}/lib/instantclient:${OGG_HOME}/lib
- TNS_ADMIN : /opt/oracle/product/19c/dbhome_1/network/admin/
--------------------------------------------------------------------------------
Service Manager Administrator Account
--------------------------------------------------------------------------------

- Username : admin
--------------------------------------------------------------------------------
Deployment Administrator Account
--------------------------------------------------------------------------------

- Username : admin
--------------------------------------------------------------------------------
Security Options
--------------------------------------------------------------------------------
- SSL / TLS Security : true
- Server Certificate : /opt/app/ogg/security/sm01/ogglabsm01_cert.pem
- Private Key File : /opt/app/ogg/security/sm01/ogglabsm01.pem
- Server CA Certificates File : /opt/app/ogg/security/sm01/rootCA_cert.pem
- Client Certificate : /opt/app/ogg/security/sm01/ogglaborcl04_cert.pem
- Private Key File : /opt/app/ogg/security/sm01/ogglaborcl04.pem
- Client CA Certificates File : /opt/app/ogg/security/sm01/rootCA_cert.pem
--------------------------------------------------------------------------------
Advanced Security Options
--------------------------------------------------------------------------------

- TLS v1.3 Enabled : true
- TLS v1.2 Enabled : false
--------------------------------------------------------------------------------
Port Settings
--------------------------------------------------------------------------------

- Enable Administration Service : true
- Administration Service Port : 16005
- Enable Distribution Service : true
- Distribution Service Port : 16006
- Enable Receiver Service : true
- Receiver Service Port : 16007
- Enable Monitoring : true
- Metrics Service port : 16008
- Critical Service : false
- Metrics Service DataStore type : BDB
- Metrics Service DataStore home : /opt/app/ogg/deployments/orcl04/metricdb
- Enable Remote Metrics for the Deployment : true
- Remote Metrics StatsD Host : 192.168.1.95
- Remote Metrics StatsD Port : 8125
--------------------------------------------------------------------------------
Configuration Service
--------------------------------------------------------------------------------

- Enable Configuration Service : false
--------------------------------------------------------------------------------
Plugin Service
--------------------------------------------------------------------------------

- Enable Plugin Service : false
--------------------------------------------------------------------------------
Replication Settings
--------------------------------------------------------------------------------

- Replication Schema : GGADMIN
--------------------------------------------------------------------------------

Validate the Configuration

TLS handshake verification

$ openssl s_client -connect ogglab:16000 -servername ogglab -CAfile /opt/app/ogg/security/sm01/rootCA_cert.pem -verify_return_error -verify_hostname ogglab -tls1_3

Connecting to 192.168.1.95
CONNECTED(00000003)
depth=1 CN=RootCA
verify return:1
depth=0 C=ES, O=OGGLab, CN=ogglab
verify return:1
---
Certificate chain
....
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    ...
    Verify return code: 0 (ok)

HTTPS endpoint validation

curl --cacert /opt/app/ogg/security/sm01/rootCA_cert.pem https://ogglab:16000
<!doctype html>...
</html>

Conclusion

In this lab, we installed and configured Oracle GoldenGate 26ai Microservices Architecture on an on-premises Oracle Linux 9 server, with one Service Manager and two deployments (ORCL01 and ORCL04).

We generated a local Certificate Authority (CA), created server and client certificates, and configured GoldenGate services to use TLS 1.3 for secure communication.

The next steps are to configure database credentials, create Extract and Replicat processes, and establish secure Distribution Paths between deployments to test end-to-end data replication.

This setup provides a foundation for experimenting with Oracle GoldenGate Microservices Architecture in a TLS-secured lab environment.