You're correct that 9.x uses JDBC to connect to the database rather than the OCI client as in previous versions.  Unfortunately, at this time, the JDBC connection string is is hard coded and can't be configured with the options necessary to enable encryption.  Please consider creating an idea in this community to suggest adding this feature.

Mark

Wow! I can't believe there isn't an option to encrypt the connection. In 2016 with all of the security breaches every org has to worry about, this seems more like a defect than an opportunity for enhancement.

That's interesting to hear - did you have to add a certificate on the client side Java or configure an Oracle wallet?

Mark

Martin Rosenbauer that's really helpful thank you!  

I've just tested this and it does look like setting the options on the server creates an encrypted connection.  I used the Oracle Net Manager on the server to set the encryption state to requested, provided a seed and chose an algorithm.  Using tcpdump on a Linux server with AR 9.1 I captured the traffic to the database and could see plain text data.  I then restarted AR and checked again and now the data is no longer plain text.

I had not appreciated the different Oracle encryption options and thought that you had to configure SSL to achieve the above, which would require changes to the JDBC connect string.  This seems a more straightforward option for just network packet payload encryption.

I'm going to do a bit more digging and I'll write this up as a knowledge base article/communities blog post.

Thanks again for taking the time to update this thread with the information.

Mark

Martin Rosenbauer thank you again for the update on this topic when you found out how to enable encryption.  I've created a blog post that details how to do this so others become aware of the feature.  There's also a KB linking to the blog to help more people find it.

Trending in Support: Encrypting Data Between AR Servers and Oracle Databases

Mark