DB UPGRADE

*** 11.2.0.3.0 to 12.1.0.2**

INSTALL 12.1.0 software only
INSTALL EXAMPLES
unzip the time zone for for 12.1.0.2  ***********
check the preupdaig.sql
taken backup of INVALIDS **********
checked the tables spaces rqeutired size especailly temp table space**************
again execute the Preupdaig.sql *********
Executed Gather schema stat
Executed purge reciylce bin
checked the table dba_2pc_pending for distriubted jobs pending status.
check the 11gcompnent versions from dba_registry
upgraded apex from 4.1.0.2 to 4.6.0.2
checked the upgraded apex veresion form dba_registry
bring down the 11g database  ***************
sourced 12c.env
strated db with upgrade mode
executed catctl.pl from 12.1.0.2 HOME
executed utl12c.sql for the database upgrade process went fine or not
upgraded TIME ZONE Version 14 to 18
Applied LATEST CPU PATCH for 12.1.0.2
ADD entries for ASO and ANO
POST DB and APPLICATION CheckES


###STEP BY STEP PROCESS###

Contents

 

 

Upgrading Database from 12.1.0.2



Installation


Install the 12c software
















Install Examples cd :-
















Apply the following patches for environments without the In-Memory option enabled:

DST Version Validation


SQL> select VERSION from v$timezone_file;

   VERSION
----------
        14



SQL> select TZ_VERSION from registry$database;

TZ_VERSION
----------
        14
SQL> SELECT PROPERTY_NAME, SUBSTR(property_value, 1, 30) value FROM DATABASE_PROPERTIES WHERE PROPERTY_NAME LIKE 'DST_%' ORDER BY PROPERTY_NAME;

PROPERTY_NAME                            VALUE
---------------------------------------- ------------------------------
DST_PRIMARY_TT_VERSION                   14
DST_SECONDARY_TT_VERSION                 0
DST_UPGRADE_STATE                        NONE



Pre-Upgrade steps


Check the integrity of the source database

Run dbupdiag.sql
Ref: Note 556610.1  Script to Collect DB Upgrade/Migrate Diagnostic Information (dbupgdiag.sql)

Misc Pre-Upgrade Steps

  • Run the Pre-Upgrade Information Tool from the environment of the database that will be upgraded.
  • You must analyze your database before upgrading it to the new release.
  • Note that the database must be running in normal mode in the old release.



SQL> @preupgrd.sql


Loading Pre-Upgrade Package...



***************************************************************************
Executing Pre-Upgrade Checks in OAPCDL7...
***************************************************************************


      ************************************************************

                 ====>> ERRORS FOUND for OAPCDL7 <<====

 The following are *** ERROR LEVEL CONDITIONS *** that must be addressed
                    prior to attempting your upgrade.
            Failure to do so will result in a failed upgrade.

           You MUST resolve the above errors prior to upgrade

      ************************************************************

      ************************************************************
  ====>> PRE-UPGRADE RESULTS for OAPCDL7 <<====

ACTIONS REQUIRED:

1. Review results of the pre-upgrade checks:
 /oapcdl7/oracle/cfgtoollogs/oapcdl7/preupgrade/preupgrade.log

2. Execute in the SOURCE environment BEFORE upgrade:
 /oapcdl7/oracle/cfgtoollogs/oapcdl7/preupgrade/preupgrade_fixups.sql

 3. Execute in the NEW environment AFTER upgrade:
 /oapcdl7/oracle/cfgtoollogs/oapcdl7/preupgrade/postupgrade_fixups.sql

      ************************************************************

***************************************************************************
Pre-Upgrade Checks in OAPCDL7 Completed.
***************************************************************************

***************************************************************************
***************************************************************************

SQL> create pfile='/tmp/pfile11g.ora' from spfile;
SQL> exit

Emromemove- log placed in other file

Run utlrp



SQL> select count(*) from dba_2pc_pending;

  COUNT(*)
----------
         0


SQL> PURGE DBA_RECYCLEBIN
  2  ;

DBA Recyclebin purged.

Dependencies on Network Utility Packages 

SQL> set lines 200
SQL> set pages 2000
SQL> spool step_4.3_spool.log
SQL> SELECT * FROM DBA_DEPENDENCIES
WHERE referenced_name IN ('UTL_TCP','UTL_SMTP','UTL_MAIL','UTL_HTTP','UTL_
INADDR','DBMS_LDAP')
AND owner NOT IN ('SYS','PUBLIC','ORDPLUGINS')
  2    3    4    5  /

Database Links with Passwords from Earlier Releases

SQL> set pages 50000
SQL> spool db_links_bef_upg.spool
SQL>  SELECT 'CREATE '||DECODE(U.NAME,'PUBLIC','public ')||'DATABASE LINK '||CHR(10)
 ||DECODE(U.NAME,'PUBLIC',Null, 'SYS','',U.NAME||'.')|| L.NAME||chr(10)
 ||'CONNECT TO ' || L.USERID || ' IDENTIFIED BY "'||L.PASSWORD||'" USING
 '''||L.HOST||''''
  2    3    4    5  ||chr(10)||';' TEXT
FROM SYS.LINK$ L, SYS.USER$ U
WHERE L.OWNER# = U.USER#
/

Optimizer Statistics

$ sqlplus "/as sysdba"
SQL> EXEC DBMS_STATS.GATHER_DICTIONARY_STATS;
Already completed.

15:22:46 SQL> EXEC DBMS_STATS.GATHER_DICTIONARY_STATS;

PL/SQL procedure successfully completed.

15:25:58 SQL> exit

Verify That Materialized View Refreshes Have Completed Before Upgrading 

SQL> select s.obj#,o.obj#,s.containerobj#,lastrefreshdate,pflags,xpflags,o.name,o.owner#, bitand(s.mflags, 8) from obj$ o, sum$ s
where o.obj# = s.obj# and o.type# = 42 AND bitand(s.mflags, 8) = 8;  2

no rows selected

follow this note id – If you see any rows.( 1442457.1)

Ensure That No Files Need Media Recovery Before Upgrading

SQL> SELECT * FROM v$recover_file;

no rows selected

Ensure That No Files Are in Backup Mode Before Upgrading

SQL> SELECT * FROM v$backup WHERE status != 'NOT ACTIVE';

no rows selected

Resolve Outstanding Distributed Transactions Before Upgrading 

SQL> SELECT * FROM dba_2pc_pending;

no rows selected

Purge the Database Recycle Bin Before Upgrading

SQL> PURGE DBA_RECYCLEBIN ;

DBA Recyclebin purged.

Disable all batch and cron jobs

Verify SYS and SYSTEM Default tablespace

Ensure the users SYS and SYSTEM have 'SYSTEM' as their default tablespace.

SQL> SELECT username, default_tablespace
     FROM dba_users
     WHERE username in ('SYS','SYSTEM');  2    3

USERNAME                       DEFAULT_TABLESPACE
------------------------------ ------------------------------
SYSTEM                         SYSTEM
SYS                            SYSTEM

Check whether database has any externally authenticated SSL users

SQL> SELECT name FROM sys.user$
     WHERE ext_username IS NOT NULL
     AND password = 'GLOBAL';  2    3

no rows selected

Remove Enterprise Manager  Database Control repository

$ emctl status dbcontrol
Environment variable ORACLE_UNQNAME not defined. Please set ORACLE_UNQNAME to database unique name.

Note: Repository does not exist.

Check the XDB ACLs has start_date and end_date ACE attributes


SQL> select aclid, start_date, end_date from xds_ace where start_date is not null;

no rows selected


APEX upgrade:




SQL> select owner,object_name from dba_objects where object_name = 'WWV_FLOWS';

OWNER                OBJECT_NAME
-------------------- -----------------------------
APEX_030200          WWV_FLOWS


SQL> select count(*) from APEX_030200.WWV_FLOWS where id= 4000;

  COUNT(*)
----------
         1
If the query return 0, it is a runtime and apxtins.sql should be used for upgrade. If query returns  1 this is a development install and apexins.sql should be used.
Here our output is  1 so we need to execute apexins.sql

Download APEX from document id : 1088970.1


 sqlplus / as sysdba
SQL> @apexins SYSAUX SYSAUX TEMP /i/





Elapsed: 00:00:00.67
old   1: alter session set current_schema = ^APPUN
new   1: alter session set current_schema = APEX_040200

Session altered.

timing for: Complete Installation
Elapsed: 00:24:51.07

PL/SQL procedure successfully completed.


PL/SQL procedure successfully completed.


[ogorappmd1@ogppml3982dv apex]$ cp -r /orpppmd1/backup/staging/apex/apex/images .
[ogorappmd1@ogppml3982dv apex]$ pwd
/orpppmd1/oracle/11.2.0/apex
[ogorappmd1@ogppml3982dv apex]$



Sqlplus ‘/as sysdba’

SQL> @apxldimg.sql /orpppmd1/oracle/11.2.0

PL/SQL procedure successfully completed.


PL/SQL procedure successfully completed.

. Loading images directory: /orpppmd1/oracle/11.2.0/apex/images

Directory created.


PL/SQL procedure successfully completed.


PL/SQL procedure successfully completed.


PL/SQL procedure successfully completed.


Commit complete.


Directory dropped.

timing for: Load Images
Elapsed: 00:02:44.27
SQL> spool off;



SQL> column comp_name format a40
           column status format a10
           column version format a15
SQL> SQL> SQL>
SQL>
SQL>
SQL> select comp_name,status,version from dba_registry order by 1;

COMP_NAME                                STATUS     VERSION
---------------------------------------- ---------- ---------------
JServer JAVA Virtual Machine             VALID      11.2.0.3.0
OLAP Analytic Workspace                  VALID      11.2.0.3.0
OLAP Catalog                             VALID      11.2.0.3.0
OWB                                      VALID      11.2.0.3.0
Oracle Application Express               VALID      4.2.6.00.03
Oracle Database Catalog Views            VALID      11.2.0.3.0
Oracle Database Java Packages            VALID      11.2.0.3.0
Oracle Database Packages and Types       VALID      11.2.0.3.0
Oracle Expression Filter                 VALID      11.2.0.3.0
Oracle Multimedia                        VALID      11.2.0.3.0
Oracle OLAP API                          VALID      11.2.0.3.0

COMP_NAME                                STATUS     VERSION
---------------------------------------- ---------- ---------------
Oracle Rules Manager                     VALID      11.2.0.3.0
Oracle Text                              VALID      11.2.0.3.0
Oracle Workspace Manager                 VALID      11.2.0.3.0
Oracle XDK                               VALID      11.2.0.3.0
Oracle XML Database                      VALID      11.2.0.3.0
Spatial                                  VALID      11.2.0.3.0

17 rows selected.




Remove or comment out obsolete and deprecated initialization parameters

> *.sec_case_sensitive_logon=FALSE

Removed SEC_CASE_SENSITIVE_LOGON parameter as per recommended.
Cluster_database is set to FALSE.

Shutdown source database


SQL> shut immediate
Database closed.
Database dismounted.
ORACLE instance shut down.

Set environment variables

Before Upgrade make sure  you have added more temporary tablespace to avoid errors during the upgrade process

Upgrading Database to 12cR1


SQL> startup upgrade pfile='/tmp/pfile.ora'
ORACLE instance started.

Total System Global Area 3154116608 bytes
Fixed Size                  2929352 bytes
Variable Size            1996492088 bytes
Database Buffers         1140850688 bytes
Redo Buffers               13844480 bytes
Database mounted.
Database opened.
SQL> select status from v$instance;

STATUS
----------------
OPEN MIGRATE





Run the catctl.pl script from the new Oracle home.
In this release, the new Upgrade Utility, catctl.pl, replaces catupgrd.sql.


[osapcdl7@ogerpl3914dv product]$ cd -
/oapcdl7/oracle/12.1.0.2/product/rdbms/admin
[osapcdl7@ogerpl3914dv admin]$ $ORACLE_HOME/perl/bin/perl catctl.pl -n  6 -l $ORACLE_HOME/diagnostics catupgrd.sql

Argument list for [catctl.pl]
SQL Process Count     n = 6
SQL PDB Process Count N = 0
Input Directory       d = 0
Phase Logging Table   t = 0
Log Dir               l = /oapcdl7/oracle/12.1.0.2/product/diagnostics
Script                s = 0
Serial Run            S = 0
Upgrade Mode active   M = 0
Start Phase           p = 0
End Phase             P = 0
Log Id                i = 0
Run in                c = 0
Do not run in         C = 0
Echo OFF              e = 1
No Post Upgrade       x = 0
Reverse Order         r = 0
Open Mode Normal      o = 0
Debug catcon.pm       z = 0
Debug catctl.pl       Z = 0
Display Phases        y = 0
Child Process         I = 0

catctl.pl version: 12.1.0.2.0
Oracle Base           = /oapcdl7/oracle

Analyzing file catupgrd.sql
Log files in /oapcdl7/oracle/12.1.0.2/product/diagnostics
catcon: ALL catcon-related output will be written to /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd_catcon_47591.lst
catcon: See /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd*.log files for output generated by scripts
catcon: See /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd_*.lst files for spool files, if any
Number of Cpus        = 4
SQL Process Count     = 6

------------------------------------------------------
Phases [0-73]
Serial   Phase #: 0 Files: 1     Time: 90s  
Serial   Phase #: 1 Files: 5     Time: 23s  
Restart  Phase #: 2 Files: 1     Time: 0s   
Parallel Phase #: 3 Files: 18    Time: 4s   
Restart  Phase #: 4 Files: 1     Time: 0s   
Serial   Phase #: 5 Files: 5     Time: 10s  
Serial   Phase #: 6 Files: 1     Time: 6s   
Serial   Phase #: 7 Files: 4     Time: 5s   
Restart  Phase #: 8 Files: 1     Time: 0s   
Parallel Phase #: 9 Files: 62    Time: 15s  
Restart  Phase #:10 Files: 1     Time: 0s   
Serial   Phase #:11 Files: 1     Time: 8s   
Restart  Phase #:12 Files: 1     Time: 0s   
Parallel Phase #:13 Files: 91    Time: 4s   
Restart  Phase #:14 Files: 1     Time: 0s   
Parallel Phase #:15 Files: 111   Time: 8s   
Restart  Phase #:16 Files: 1     Time: 0s   
Serial   Phase #:17 Files: 3     Time: 1s   
Restart  Phase #:18 Files: 1     Time: 0s   
Parallel Phase #:19 Files: 32    Time: 10s  
Restart  Phase #:20 Files: 1     Time: 0s   
Serial   Phase #:21 Files: 3     Time: 4s   
Restart  Phase #:22 Files: 1     Time: 0s   
Parallel Phase #:23 Files: 23    Time: 51s  
Restart  Phase #:24 Files: 1     Time: 0s   
Parallel Phase #:25 Files: 11    Time: 23s  
Restart  Phase #:26 Files: 1     Time: 0s   
Serial   Phase #:27 Files: 1     Time: 0s   
Restart  Phase #:28 Files: 1     Time: 0s   
Serial   Phase #:30 Files: 1     Time: 0s   
Serial   Phase #:31 Files: 257   Time: 15s  
Serial   Phase #:32 Files: 1     Time: 0s   
Restart  Phase #:33 Files: 1     Time: 0s   
Serial   Phase #:34 Files: 1     Time: 2s   
Restart  Phase #:35 Files: 1     Time: 0s   
Restart  Phase #:36 Files: 1     Time: 0s   
Serial   Phase #:37 Files: 4     Time: 33s  
Restart  Phase #:38 Files: 1     Time: 0s   
Parallel Phase #:39 Files: 13    Time: 32s  
Restart  Phase #:40 Files: 1     Time: 0s   
Parallel Phase #:41 Files: 10    Time: 4s   
Restart  Phase #:42 Files: 1     Time: 0s   
Serial   Phase #:43 Files: 1     Time: 5s   
Restart  Phase #:44 Files: 1     Time: 0s   
Serial   Phase #:45 Files: 1     Time: 3s   
Serial   Phase #:46 Files: 1     Time: 0s   
Restart  Phase #:47 Files: 1     Time: 0s   
Serial   Phase #:48 Files: 1     Time: 73s  
Restart  Phase #:49 Files: 1     Time: 0s   
Serial   Phase #:50 Files: 1     Time: 23s  
Restart  Phase #:51 Files: 1     Time: 0s   
Serial   Phase #:52 Files: 1     Time: 17s  
Restart  Phase #:53 Files: 1     Time: 0s   
Serial   Phase #:54 Files: 1     Time: 106s 
Restart  Phase #:55 Files: 1     Time: 0s   
Serial   Phase #:56 Files: 1     Time: 40s  
Restart  Phase #:57 Files: 1     Time: 0s   
Serial   Phase #:58 Files: 1     Time: 74s  
Restart  Phase #:59 Files: 1     Time: 0s   
Serial   Phase #:60 Files: 1     Time: 168s 
Restart  Phase #:61 Files: 1     Time: 0s   
Serial   Phase #:62 Files: 1     Time: 27s  
Restart  Phase #:63 Files: 1     Time: 0s   
Serial   Phase #:64 Files: 1     Time: 1s   
Serial   Phase #:65 Files: 1 Calling sqlpatch with LD_LIBRARY_PATH=/oapcdl7/oracle/12.1.0.2/product/lib; export LD_LIBRARY_PATH;/oapcdl7/oracle/12.1.0.2/product/perl/bin/perl -I /oapcdl7/oracle/12.1.0.2/product/rdbms/admin -I /oapcdl7/oracle/12.1.0.2/product/rdbms/admin/../../sqlpatch /oapcdl7/oracle/12.1.0.2/product/rdbms/admin/../../sqlpatch/sqlpatch.pl -verbose -upgrade_mode_only > /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd_datapatch_upgrade.log 2> /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd_datapatch_upgrade.err
returned from sqlpatch
    Time: 31s  
Serial   Phase #:66 Files: 1     Time: 28s  
Serial   Phase #:68 Files: 1     Time: 0s   
Serial   Phase #:69 Files: 1 Calling sqlpatch with LD_LIBRARY_PATH=/oapcdl7/oracle/12.1.0.2/product/lib; export LD_LIBRARY_PATH;/oapcdl7/oracle/12.1.0.2/product/perl/bin/perl -I /oapcdl7/oracle/12.1.0.2/product/rdbms/admin -I /oapcdl7/oracle/12.1.0.2/product/rdbms/admin/../../sqlpatch /oapcdl7/oracle/12.1.0.2/product/rdbms/admin/../../sqlpatch/sqlpatch.pl -verbose > /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd_datapatch_normal.log 2> /oapcdl7/oracle/12.1.0.2/product/diagnostics/catupgrd_datapatch_normal.err
returned from sqlpatch
    Time: 41s  
Serial   Phase #:70 Files: 1     Time: 67s  
Serial   Phase #:71 Files: 1     Time: 0s   
Serial   Phase #:72 Files: 1     Time: 0s   
Serial   Phase #:73 Files: 1     Time: 20s   

Grand Total Time: 1074s

LOG FILES: (catupgrd*.log)
Upgrade Summary Report Located in:
/oapcdl7/oracle/12.1.0.2/product/cfgtoollogs/oapcdl7/upgrade/upg_summary.log

Grand Total Upgrade Time:    [0d:0h:17m:54s]



Run utlu121s.sql to verify the upgrade process

SQL> spool utlu121s.log
SQL> @utlu121s.sql

PL/SQL procedure successfully completed.


PL/SQL procedure successfully completed.





CATCTL REPORT = /oapcdl7/oracle/12.1.0.2/product/cfgtoollogs/oapcdl7/upgrade/upg_summary.log

PL/SQL procedure successfully completed.






Oracle Database 12.1 Post-Upgrade Status Tool           05-03-2018 06:23:12

Component                               Current         Version  Elapsed Time
Name                                    Status          Number   HH:MM:SS

Oracle Server                          UPGRADED      12.1.0.2.0  00:05:55
JServer JAVA Virtual Machine              VALID      12.1.0.2.0  00:01:12
Oracle Workspace Manager                  VALID      12.1.0.2.0  00:00:32
OLAP Analytic Workspace                   VALID      12.1.0.2.0  00:00:16
OLAP Catalog                         OPTION OFF      11.2.0.3.0  00:00:00
Oracle OLAP API                           VALID      12.1.0.2.0  00:00:17
Oracle XDK                                VALID      12.1.0.2.0  00:00:22
Oracle Text                               VALID      12.1.0.2.0  00:00:30
Oracle XML Database                       VALID      12.1.0.2.0  00:01:14
Oracle Database Java Packages             VALID      12.1.0.2.0  00:00:08
Oracle Multimedia                         VALID      12.1.0.2.0  00:01:13
Spatial                                UPGRADED      12.1.0.2.0  00:02:47
Oracle Application Express                VALID     4.2.6.00.03  00:00:00
Final Actions                                                    00:00:57
Post Upgrade                                                     00:01:05
Total Upgrade Time: 00:16:45

PL/SQL procedure successfully completed.

SQL>
SQL> --
SQL> -- Update Summary Table with con_name and endtime.
SQL> --
SQL> UPDATE sys.registry$upg_summary SET reportname = :ReportName,
  2                                  con_name = SYS_CONTEXT('USERENV','CON_NAME'),
  3                                  endtime  = SYSDATE
  4         WHERE con_id = -1;

1 row updated.

SQL> commit;

Commit complete.

SQL>



Check for the integrity of the upgraded database by running dbupgdiag.sql script from the below article: 
Note 556610.1 Script to Collect DB Upgrade/Migrate Diagnostic Information (dbupgdiag.sql) 


Post Upgrade Steps


Environment Variables and oratab file




Modify initialization parameters

SQL> show parameter REMOTE_LOGIN_PASSWORDFILE

NAME                                 TYPE        VALUE
------------------------ ----------- ------------------------------
remote_login_passwordfile            string      EXCLUSIVE
SQL> show parameter COMPATIBLE

NAME                                 TYPE        VALUE
-------------------------- ----------- ------------------------------
compatible                           string      12.0.0




Upgrade the Time Zone File Version after Upgrading Oracle Database

SQL> @upg_tzv_check.sql
INFO: Starting with RDBMS DST update preparation.
INFO: NO actual RDBMS DST update will be done by this script.
INFO: If an ERROR occurs the script will EXIT sqlplus.
INFO: Doing checks for known issues ...
INFO: Database version is 12.1.0.2 .
INFO: Database RDBMS DST version is DSTv14 .
INFO: No known issues detected.
INFO: Now detecting new RDBMS DST version.
A prepare window has been successfully started.
INFO: Newest RDBMS DST version detected is DSTv18 .
INFO: Next step is checking all TSTZ data.
INFO: It might take a while before any further output is seen ...
A prepare window has been successfully ended.
INFO: A newer RDBMS DST version than the one currently used is found.
INFO: Note that NO DST update was yet done.
INFO: Now run upg_tzv_apply.sql to do the actual RDBMS DST update.
INFO: Note that the upg_tzv_apply.sql script will
INFO: restart the database 2 times WITHOUT any confirmation or prompt.
SQL>

SQL> @upg_tzv_apply.sql
INFO: If an ERROR occurs the script will EXIT sqlplus.
INFO: The database RDBMS DST version will be updated to DSTv18 .
WARNING: This script will restart the database 2 times
WARNING: WITHOUT asking ANY confirmation.
WARNING: Hit control-c NOW if this is not intended.
INFO: Restarting the database in UPGRADE mode to start the DST upgrade.
WARNING: WITHOUT asking ANY confirmation.
WARNING: Hit control-c NOW if this is not intended.
INFO: Restarting the database in UPGRADE mode to start the DST upgrade.
Database closed.
Database dismounted.
ORACLE instance shut down.
ORACLE instance started.

Total System Global Area 3154116608 bytes
Fixed Size                  2929352 bytes
Variable Size            1996492088 bytes
Database Buffers         1140850688 bytes
Redo Buffers               13844480 bytes
Database mounted.
Database opened.
INFO: Starting the RDBMS DST upgrade.
INFO: Upgrading all SYS owned TSTZ data.
INFO: It might take time before any further output is seen ...

Redo Buffers               13844480 bytes
Database mounted.
Database opened.
INFO: Upgrading all non-SYS TSTZ data.
INFO: It might take time before any further output is seen ...
INFO: Do NOT start any application yet that uses TSTZ data!
INFO: Next is a list of all upgraded tables:
Table list: "APEX_040200"."WWV_FLOW_WORKSHEET_NOTIFY"
Number of failures: 0
Table list: "APEX_040200"."WWV_FLOW_FEEDBACK_FOLLOWUP"
Number of failures: 0
Table list: "APEX_040200"."WWV_FLOW_FEEDBACK"
Number of failures: 0
Table list: "APEX_040200"."WWV_FLOW_DEBUG_MESSAGES2"
Number of failures: 0
Table list: "APEX_040200"."WWV_FLOW_DEBUG_MESSAGES"
Number of failures: 0
Table list: "GSMADMIN_INTERNAL"."AQ$_CHANGE_LOG_QUEUE_TABLE_S"
Number of failures: 0
Table list: "GSMADMIN_INTERNAL"."AQ$_CHANGE_LOG_QUEUE_TABLE_L"
Number of failures: 0
INFO: Total failures during update of TSTZ data: 0 .
An upgrade window has been successfully ended.
INFO: Your new Server RDBMS DST version is DSTv18 .
INFO: The RDBMS DST update is successfully finished.
INFO: Make sure to exit this sqlplus session.
INFO: Do not use it for timezone related selects.
SQL> SELECT version FROM v$timezone_file;

   VERSION
----------
        18

1 row selected.



Sanity Checks:

TimeZone Version:

SELECT PROPERTY_NAME, SUBSTR(property_value, 1, 30) value FROM DATABASE_PROPERTIES
WHERE PROPERTY_NAME LIKE 'DST_%' ORDER BY PROPERTY_NAME;

DB Components Version and Status:


SET PAUSE ON
SET PAUSE 'Press Return to Continue'
SET PAGESIZE 60
SET LINESIZE 300
SET VERIFY OFF

COL comp_name FOR a44 HEA 'Component'
COL version FOR a17 HEA 'Version'
COL status FOR a17 HEA 'Status'

SELECT comp_name, version, status FROM dba_registry
/

Ensure That No Files Need Media Recovery

SQL> SELECT * FROM v$recover_file;

no rows selected
Ensure That No Files Are in Backup Mode

SQL> SELECT * FROM v$backup WHERE status != 'NOT ACTIVE';

no rows selected

Alert log Verification:


ASO / ANO – Enabling:

Enable below option in sql net.ora:

[orauser@servername admin]$ cat sqlnet.ora
# sqlnet.ora Network Configuration File: /XXX/grcapp/11.2.0/network/admin/sqlnet.ora
# Generated by Oracle configuration tools.

#NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

#ADR_BASE = /XXX/grcapp

SQLNET.ALLOWED_LOGON_VERSION=8


SQLNET.ENCRYPTION_SERVER=REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER=(AES256, AES192, 3DES168, RC4_256, 3DES112)
SQLNET.CRYPTO_CHECKSUM_SERVER=REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER=(SHA1,MD5)

SQLNET.ENCRYPTION_CLIENT=REQUIRED
SQLNET.ENCRYPTION_TYPES_CLIENT=(AES256)

SQLNET.CRYPTO_CHECKSUM_CLIENT=REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT=(MD5)
You have new mail in /var/spool/mail/XXXX


SSL IMPLEMENTATION

1.Create a Wallet or Keystore
2.Generate a Certificate Signing Request (CSR)
3.Send the CSR to a Certificate Authority (CA)
4.CA Team will send 4 certificates based on requirement
5.Import the Trusted CA Certificate(s)
6.Import the Server Certificate
7.Modifications in ssl config file
8.Validation of ohs with ssl port
9.Port modification according to sso enabled port
10.Bounce application
11.Sanity checks.


Create a Wallet or Keystore:
[appluser1@ospdl87dv ohshome]$ $ORACLE_HOME/oracle_common/bin/orapki wallet create -wallet $ORACLE_HOME/wallet -auto_login
Oracle PKI Tool : Version 12.2.1.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Enter password:   
Enter password again:   
Operation is successfully completed.

Generate a Certificate Signing Request (CSR):

Export the Certificate Signing Request:

[appluser1@ospdl87dv wallet]$ $ORACLE_HOME/oracle_common/bin/orapki wallet export -wallet $ORACLE_HOME/wallet -dn 'CN=ospdl87dv.cloud.ge.com, OU=Enterprise SSL, O=General Electric Company, L=Boston, ST=MA, C=US' -request $ORACLE_HOME/wallet/server.csr -pwd Welcome1
Oracle PKI Tool : Version 12.2.1.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Operation is successfully completed.

Send server.csr to CA team for Certificatate signing

1.            Root: AddTrustExternalCARoot
2.            Intermediate 1: USERTrustRSAAddTrustCA
3.            Intermediate 2: TrustedSecureCertificateAuthority5
4.            Domain: ospdl87dv_cloud_ge_com
We have Received above 4 certificates from CA Team.

Import the Trusted Certificates into the Wallet:

[appluser1@ospdl87dv wallet]$ $ORACLE_HOME/oracle_common/bin/orapki wallet add -wallet $ORACLE_HOME/wallet -trusted_cert -cert $ORACLE_HOME/wallet/AddTrustExternalCARoot.ccc -pwd Welcome1
Oracle PKI Tool : Version 12.2.1.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Operation is successfully completed.
[appluser1@ospdl87dv wallet]$ $ORACLE_HOME/oracle_common/bin/orapki wallet add -wallet $ORACLE_HOME/wallet -trusted_cert -cert $ORACLE_HOME/wallet/USERTrustRSAAddTrustCA.ccc -pwd Welcome1
Oracle PKI Tool : Version 12.2.1.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Operation is successfully completed.
[appluser1@ospdl87dv wallet]$ $ORACLE_HOME/oracle_common/bin/orapki wallet add -wallet $ORACLE_HOME/wallet -trusted_cert -cert $ORACLE_HOME/wallet/TrustedSecureCertificateAuthority5.ccc -pwd Welcome1
Oracle PKI Tool : Version 12.2.1.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Operation is successfully completed.
[appluser1@ospdl87dv wallet]$ $ORACLE_HOME/oracle_common/bin/orapki wallet add -wallet $ORACLE_HOME/wallet -user_cert -cert $ORACLE_HOME/wallet/ospdl87dv_cloud_ge_com.ccc -pwd Welcome1
Oracle PKI Tool : Version 12.2.1.1.0
Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.

Operation is successfully completed.

Modifications in ssl config file:
Update the wallet path in ssl.conf 

<    #SSLWallet "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/keystores/default"
<     SSLWallet "/orpacgd1/grcapp/ohshome/wallet"   

The Wallet is now ready to use with Oracle HTTP Server (OHS):

Verify whether we are able to open ohs with ssl port upon completion of OHS bounce.


Modify the ssl port with sso enable port in ssl.conf file

[appluser1@ospdl87dv ohs1]$ diff ssl.conf ssl.conf-bkp12mar18
8c8
< Listen ospdl87dv.cloud.ge.com:8000
---
> Listen ospdl87dv.cloud.ge.com:8443
37c37
< <VirtualHost ospdl87dv.cloud.ge.com:8000> 
---
> <VirtualHost ospdl87dv.cloud.ge.com:8443>


Sanity checks:
Do full bounce of application which are running with OHS

open url https://ospdl87dv.cloud.ge.com:8000



####EXAMPLES###

Orapki utility manages the below two

1.wallet
2.crl
3.change jks keys to orawaet and vice versa


Here are a few examples of using orapki:

# Create root wallet (for example, CA wallet)
orapki wallet create -wallet ./root -pwd mypasswd
# Add a self-signed certificate (CA certificate) to the root wallet
orapki wallet add -wallet ./root -dn 'CN=root_test,C=US' -keysize 1024 -self_signed -validity 3650 -pwd mypasswd
# Export self-signed certificate from the wallet 
orapki wallet export -wallet ./root -dn 'CN=root_test,C=US' -cert ./root/b64certificate.txt -pwd mypasswd 
# Create a user wallet (for example, a customer wallet)
orapki wallet create -wallet ./user -pwd mypasswd
# Add a certificate request
orapki wallet add -wallet ./user -dn 'CN=user_test,C=US' -keysize 1024 -pwd mypasswd
# Export the certificate request 
orapki wallet export -wallet ./user -dn 'CN=user_test,C=US' -request ./user/creq.txt -pwd mypasswd
# Create a certificate (issued by CA)
orapki cert create -wallet ./root -request ./user/creq.txt -cert ./user/cert.txt -validity 3650 -pwd mypasswd
# Add a trusted certificate (CA certificate) to the wallet
orapki wallet add -wallet ./user -trusted_cert -cert ./root/b64certificate.txt -pwd mypasswd
# Add a user certificate
orapki wallet add -wallet ./user -user_cert -cert ./user/cert.txt -pwd mypasswd
# Display contents of wallet
orapki wallet display -wallet ./root -pwd mypasswd

##Converting JKS to Oracle Wallet

Use this command to migrate entries from JKS store to p12 wallet:

jks_to_pkcs12 -wallet wallet -pwd pwd -keystore keystore 
-jkspwd jkspwd [-aliases [alias:alias..]]

##creating a self-signed JKS keystore:

keytool -genkey -alias myalias -keyalg RSA -keysize 1024 -dname CN=root,C=US -validity 3650 -keystore ./ewallet.jks -storetype jks -storepass password 
-keypass password 


##Converting Oracle Wallet to JKS

Use this command to migrate entries from a p12 wallet to a JKS keystore:

pkcs12_to_jks -wallet p12wrl -pwd p12pwd 
[-jksKeyStoreLoc jksKSloc -jksKeyStorepwd jksKS_pwd][-jksTrustStoreLoc loc -jksTrustStorepwd pwd]
where the parameters are as follows:

CRL:

A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority

The problem with Certificate Revocation Lists, as with all blacklists, is that they are difficult to maintain and are an inefficient method of distributing critical information in real time. When a certificate authority receives a CRL request from a browser, it returns a complete list of all the revoked certificates that the CA manages. The browser must then parse the list to determine if the certificate of the requested site has been revoked. Although the CRL may be updated as often as hourly, this time gap could allow a revoked certificate to be accepted, particularly because CRLs are cached to avoid incurring the overhead involved with repeatedly downloading them. Also, if the CRL is unavailable, then any operations depending upon certificate acceptance will be prevented and that may create a denial of service.


H.2.6.3 orapki crl create

The following sections describe this command.

H.2.6.3.1 Purpose
Use this command to create a CRL.

H.2.6.3.2 Syntax
orapki crl create [-crl [url|filename]] 
[-wallet [cawallet]] 
[-nextupdate [days]] 
[-pwd pwd]
  • -crl is the location where the CRL will be created (for example ./nzcrl.txt)
  • -wallet is the cawallet, which contains self-signed certificate and corresponding private key
  • -nextupdate is the number of days until the next update
  • -pwd is the password of cawallet

H.2.6.4 orapki crl delete

The following sections describe this command.

H.2.6.4.1 Purpose
Use this command to delete CRLs from Oracle Internet Directory. Note that the user who deletes CRLs from the directory by using orapki must be a member of the CRLAdmins(cn=CRLAdmins,cn=groups,%s_OracleContextDN%) directory group.

H.2.6.4.2 Syntax
orapki crl delete -issuer issuer_name 
-ldap hostname:ssl_port -user username [-summary]
  • The -issuer parameter specifies the name of the certificate authority (CA) who issued the CRL.
  • The -ldap parameter specifies the hostname and SSL port for the directory in which the CRLs are to be deleted. Note that this must be a directory SSL port with no authentication. See Section H.2.5.2.2, "Uploading CRLs to Oracle Internet Directory" for more information about this port.
  • The -user parameter specifies the username of the directory user who has permission to delete CRLs from the CRL subtree in the directory.
  • The -summary parameter is optional. Using it causes the tool to print the CRL LDAP entry that was deleted.

H.2.6.5 orapki crl display

The following sections describe this command.

H.2.6.5.1 Purpose
Use this command to display specific CRLs that are stored in Oracle Internet Directory.

H.2.6.5.2 Syntax
orapki crl display -crl crl_location 
 [-wallet wallet_location] [-summary|-complete] 
  • The -crl parameter specifies the location of the CRL in the directory. It is convenient to paste the CRL location from the list that displays when you use the orapki crl list command. See Section H.2.6.7, "orapki crl list".
  • The -wallet parameter (optional) specifies the location of the wallet that contains the certificate of the certificate authority (CA) who issued the CRL. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior to displaying it.
  • Choosing either the -summary or the -complete parameters displays the following information:
    • -summary provides a listing that contains the CRL issuer's name and the CRL's validity period
    • -complete provides a list of all revoked certificates that the CRL contains. Note that this option may take a long time to display, depending on the size of the CRL.

H.2.6.6 orapki crl hash

The following sections describe this command.

H.2.6.6.1 Purpose
Use this command to generate a hash value of the certificate revocation list (CRL) issuer to identify the location of the CRL in your file system for certificate validation.

H.2.6.6.2 Syntax
orapki crl hash -crl crl_filename|URL 
 [-wallet wallet_location] [-symlink|-copy] crl_directory [-summary]
  • The -crl parameter specifies the filename that contains the CRL or the URL in which it can be found.
  • The -wallet parameter (optional) specifies the location of the wallet that contains the certificate of the certificate authority (CA) who issued the CRL. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory.
  • Depending on your operating system, use either the -symlink or the -copy parameter:
    • On UNIX: Use -symlink to create a symbolic link to the CRL at the crl_directory location
    • On Windows: Use -copy to create a copy of the CRL at the crl_directory location
  • The -summary parameter (optional) causes the tool to display the CRL issuer's name.

H.2.6.7 orapki crl list

The following sections describe this command.

H.2.6.7.1 Purpose
Use this command to display a list of CRLs stored in Oracle Internet Directory. This is useful for browsing to locate a particular CRL to view or download to your local file system.

H.2.6.7.2 Syntax
orapki crl list -ldap hostname:ssl_port
The -ldap parameter specifies the hostname and SSL port for the directory server from which you want to list CRLs. Note that this must be a directory SSL port with no authentication. See Section H.2.5.2.2, "Uploading CRLs to Oracle Internet Directory" for more information about this port.

H.2.6.8 orapki crl revoke

The following sections describe this command.

H.2.6.8.1 Purpose
Use this command to revoke a certificate.

H.2.6.8.2 Syntax
orapki crl revoke [-crl [url|filename]] 
[-wallet [cawallet]] 
[-cert [revokecert]] 
[-pwd pwd]
where:
  • -crl specifies the CRL as either a URL or a filename
  • -wallet is the cawallet, which contains self-signed certificate and corresponding private key
  • -cert: certificate to be revoked
  • -pwd is the password of cawallet.

H.2.6.9 orapki crl status

The following sections describe this command.

H.2.6.9.1 Purpose
Use this command to check if a certificate is revoked in a CRL.

H.2.6.9.2 Syntax
orapki crl status [-crl [url|filename]] 
 [-cert [cert]]
  • -crl specifies the CRL as either a URL or a filename
  • -cert is the CA's certificate

H.2.6.10 orapki crl upload

The following sections describe this command.

H.2.6.10.1 Purpose
Use this command to upload certificate revocation lists (CRLs) to the CRL subtree in Oracle Internet Directory. Note that you must be a member of the directory administrative group CRLAdmins(cn=CRLAdmins,cn=groups,%s_OracleContextDN%) to upload CRLs to the directory.

H.2.6.10.2 Syntax
orapki crl upload -crl crl_location 
 -ldap hostname:ssl_port -user username 
 [-wallet wallet_location] [-summary]
  • The -crl parameter specifies the directory location or the URL of the CRL that you are uploading to the directory.
  • The -ldap parameter specifies the hostname and SSL port for the directory to which you are uploading the CRLs. Note that this must be a directory SSL port with no authentication. See Section H.2.5.2.2, "Uploading CRLs to Oracle Internet Directory" for more information about this port.
  • The -user parameter specifies the username of the directory user who has permission to add CRLs to the CRL subtree in the directory.
  • The -wallet parameter specifies the location of the wallet that contains the certificate of the certificate authority (CA) who issued the CRL. This is an optional parameter. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory.
  • The -summary parameter is also optional. Using it causes the tool to display the CRL issuer's name and the LDAP entry in which the CRL is stored in the directory.

H.2.6.11 orapki crl verify

The following sections describe this command.

H.2.6.11.1 Purpose
Use this command to verify a CRL signature.

H.2.6.11.2 Syntax
orapki crl verify [-crl [url|filename]] 
[-cert [cacert]]
where:
  • -crl specifies the CRL as either a URL or a filename
  • -cert specifies the certificate to be checked

Certificate Validation (CRL and OCSP) orapki only supports crl

Two methods of checking for revoked certificates:
  • Certificate Revocation List (CRL) - A CRL is a list of revoked certificates that is downloaded from the Certificate Authority (CA).
  • Online Certificate Status Protocol (OCSP) - OCSP is a protocol for checking revocation of a single certificate interactively using an online service called an OCSP responder.
CRL and OCSP validation are two different ways to achieve the same result: denying access to any user whose certificate is revoked. In a web browser, OCSP is generally considered superior because a browser is usually dealing with many different Certificate Authorities (CAs), and having to download an entire CRL to check one web site is inefficient.

#####ORACLE DOC ##
https://docs.oracle.com/cd/E28280_01/core.1111/e10105/walletmgr.htm#ASADM10624

a few examples of using orapki:

# Create root wallet (for example, CA wallet)
orapki wallet create -wallet ./root -pwd mypasswd
# Add a self-signed certificate (CA certificate) to the root wallet
orapki wallet add -wallet ./root -dn 'CN=root_test,C=US' -keysize 1024 -self_signed -validity 3650 -pwd mypasswd
# Export self-signed certificate from the wallet 
orapki wallet export -wallet ./root -dn 'CN=root_test,C=US' -cert ./root/b64certificate.txt -pwd mypasswd 
# Create a user wallet (for example, a customer wallet)
orapki wallet create -wallet ./user -pwd mypasswd
# Add a certificate request
orapki wallet add -wallet ./user -dn 'CN=user_test,C=US' -keysize 1024 -pwd mypasswd
# Export the certificate request 
orapki wallet export -wallet ./user -dn 'CN=user_test,C=US' -request ./user/creq.txt -pwd mypasswd
# Create a certificate (issued by CA)
orapki cert create -wallet ./root -request ./user/creq.txt -cert ./user/cert.txt -validity 3650 -pwd mypasswd
# Add a trusted certificate (CA certificate) to the wallet
orapki wallet add -wallet ./user -trusted_cert -cert ./root/b64certificate.txt -pwd mypasswd
# Add a user certificate
orapki wallet add -wallet ./user -user_cert -cert ./user/cert.txt -pwd mypasswd
# Display contents of wallet
orapki wallet display -wallet ./root -pwd mypasswd

###Converting JKS to Oracle Wallet

Use this command to migrate entries from JKS store to p12 wallet:

jks_to_pkcs12 -wallet wallet -pwd pwd -keystore keystore 
-jkspwd jkspwd [-aliases [alias:alias..]]
where the parameters are as follows:

wallet is the wallet location; entries from the JKS keystore will be migrated to this wallet.

pwd is the wallet password.

keystore is the keystore location; this JKS will be migrated to the p12 wallet.

jkspwd is the JKS password.

aliases are optional. If specified, only entries corresponding to the specified alias are mig