How to connect to LDAP over Secure Port 636 from Oracle

What is SID = ORCL?

Please try this:

• Verify that the LDAP server has a valid SSL/TLS certificate issued by a trusted Certificate Authority (CA). If it's using a self-signed certificate, import the certificate into Oracle database's wallet to trust it.
• Check that the SSL/TLS protocols and cipher suites configured on the LDAP server match what Oracle supports. You may need to enable additional ciphers on the LDAP side.
• Confirm there are no intermediary devices like firewalls or proxies that could be terminating the SSL connection before it reaches the LDAP server.
• Check the LDAP server logs to see if there are any SSL-related errors logged when the Oracle database attempts to connect. Enable SSL debug logging.
• Validate that the TNSNAMES.ORA entry used from Oracle is correctly specifying SSL usage and the LDAP server's hostname matches the certificate. For example:

ORCL = 
  (DESCRIPTION = 
    (ADDRESS_LIST = 
      (ADDRESS = (PROTOCOL = TCPS)(HOST = ldapserver.example.com)(PORT = 636)) 
    )
    (CONNECT_DATA =
      (SID = ORCL)
    )
  )

• Test connectivity using OpenSSL client on DB server to isolate the problem:

openssl s_client -connect ldapserver.example.com:636

This should allow you to verify if SSL handshake works outside of Oracle, or fails there too indicating a server-side or network issue.

How to import ssl certificate of ldap server into oracle wallet? please guide.
we need to go on oracle db server and do this?

After performing below steps getting error as
DECLARE
  l_session DBMS_LDAP.session;
  retval         PLS_INTEGER;
BEGIN
  l_session := DBMS_LDAP.init('ldap.example.com', 636);
  retval := DBMS_LDAP.open_ssl(l_session,'file:/u01/app/oracle/LDAP_WALLET/','pwd',2);
  retval := DBMS_LDAP.SIMPLE_BIND_S(l_session,'domain\username','pwd');
END;
/

unable to open wallet
please suggest what more needs to be done

To connect to LDAP over the secure port 636 from Oracle, you need to ensure that the necessary configurations are in place. Here are the steps you can follow:

1. Verify SSL/TLS Configuration: Ensure that the SSL/TLS configuration is correctly set up on both the LDAP server and the Oracle database server. Check if the SSL certificate is valid and trusted by the Oracle server.

2. Import SSL Certificate: Import the SSL certificate of the LDAP server into the Oracle Wallet. The Oracle Wallet is a secure container that stores SSL certificates and keys used for secure connections. You can use the orapki utility to import the certificate.

3. Configure Oracle Wallet: Configure the Oracle Wallet to use the imported SSL certificate. This involves setting the SSL_CLIENT_AUTHENTICATION parameter in the sqlnet.ora file to TRUE and specifying the location of the wallet.

4. Test Connection: Test the connection to the LDAP server over port 636 using the DBMS_LDAP package. Here's an example of how to use the package to connect:

DECLARE
  l_session DBMS_LDAP.session;
BEGIN
  l_session := DBMS_LDAP.init('ldap.example.com', 636);
  -- Perform LDAP operations using the session
  DBMS_LDAP.unbind_s(l_session);
END;

Make sure to replace 'ldap.example.com' with the actual LDAP server hostname or IP address.

• Troubleshoot Errors: If you encounter any errors, such as the ORA-31202: DBMS_LDAP: LDAP client/server error: SSL handshake failed error you mentioned, check the Oracle database server logs and the LDAP server logs for more information. Ensure that the SSL/TLS configurations match on both sides and that the necessary firewall rules are in place.