Configure encryption for source database connections
Stay organized with collections
Save and categorize content based on your preferences.
The following sections provide steps you need to perform to configure SSL/TLS
encryption for your source network connections.
Encrypt connections to self-hosted Oracle databases
The following sections contain details to help you configure SSL/TLS
encryption for connections to self-hosted Oracle sources.
Use TLS variant
To use TLS encryption for connections to a self-hosted source, do the following:
Obtain an SSL/TLS certificate signed by a trusted Certificate Authority
(CA). Consult your organization policies to make sure you use the right
channels to get the certificate. Make sure you save the x509 PEM-encoded
root CA certificate that signs your server certificate. You need to provide
it for the source connection profile in Database Migration Service.
It is possible to use self-signed certificates for this purpose
(for example generated with the
openssl command line tool), but we don't recommend
them for production use. Your security systems might flag self-signed
certificates as a vulnerability.
In the Source CA certificate section, click Browse and
upload the x509 PEM-encoded root CA certificate that signs your server
certificate.
Encrypt connections to Amazon RDS for Oracle
The following sections contain details to help you configure SSL/TLS
encryption for connections to Amazon RDS for Oracle sources.
Use TLS variant
To use TLS encryption for connections to Amazon RDS for Oracle,
do the following:
Enable the Oracle SSL encryption option on your Amazon RDS Oracle
source database. For more information, see
Using SSL with an RDS for Oracle DB instance in the
Amazon RDS documentation.
Download the x509 PEM-encoded root CA certificate that signs your server
certificate. This certificate is included in the certificate bundles
provided by AWS. For more information, see
Download certificate bundles in the Amazon RDS documentation.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[],[],null,["# Configure encryption for source database connections\n\nThe following sections provide steps you need to perform to configure SSL/TLS\nencryption for your source network connections.\n| **Tip:** Remember that with regards to [network connectivity](/database-migration/docs/oracle-to-postgresql/networking-overview), Database Migration Service is considered the **client** and your source database is the **server**.\n\nEncrypt connections to self-hosted Oracle databases\n---------------------------------------------------\n\nThe following sections contain details to help you configure SSL/TLS\nencryption for connections to self-hosted Oracle sources.\n\n### Use TLS variant\n\nTo use TLS encryption for connections to a self-hosted source, do the following:\n\n1. Obtain an SSL/TLS certificate signed by a trusted Certificate Authority\n (CA). Consult your organization policies to make sure you use the right\n channels to get the certificate. Make sure you save the x509 PEM-encoded\n root CA certificate that signs your server certificate. You need to provide\n it for the source connection profile in Database Migration Service.\n\n It is possible to use self-signed certificates for this purpose\n (for example generated with the\n [`openssl` command line tool](https://docs.openssl.org/master/man1/openssl/)), but we don't recommend\n them for production use. Your security systems might flag self-signed\n certificates as a vulnerability.\n2. Configure TLS authentication on your source Oracle database. For more information, see [Configuring a Transport Layer Security Connection\n without a Client Wallet](https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-secure-sockets-layer-authentication.html#DBSEG-GUID-28A27D34-D642-45AB-BA0F-F20D4494FB38) in the Oracle documentation.\n3. At a later stage, when you [create the source connection profile](/database-migration/docs/oracle-to-postgresql/create-source-connection-profile), do the following:\n 1. Select **TLS** for the encryption type.\n 2. In the **Source CA certificate** section, click **Browse** and upload the x509 PEM-encoded root CA certificate that signs your server certificate.\n\nEncrypt connections to Amazon RDS for Oracle\n--------------------------------------------\n\nThe following sections contain details to help you configure SSL/TLS\nencryption for connections to Amazon RDS for Oracle sources.\n\n### Use TLS variant\n\nTo use TLS encryption for connections to Amazon RDS for Oracle,\ndo the following:\n\n1. Enable the Oracle SSL encryption option on your Amazon RDS Oracle source database. For more information, see [Using SSL with an RDS for Oracle DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Oracle.Concepts.SSL.html) in the Amazon RDS documentation.\n2. Download the x509 PEM-encoded root CA certificate that signs your server certificate. This certificate is included in the certificate bundles provided by AWS. For more information, see [Download certificate bundles](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesDownload) in the Amazon RDS documentation.\n3. At a later stage, when you [create the source connection profile](/database-migration/docs/oracle-to-postgresql/create-source-connection-profile), do the following:\n 1. Select **TLS** for the encryption type.\n 2. In the **Source CA certificate** section, click **Browse** and upload the x509 PEM-encoded root CA certificate you downloaded in the certificate bundle."]]
