Oracle 19c: establish encryption-in-transit plan (SSL/TCPS 2484 vs NNE) — binding advertises ssl_required on plaintext 1521

[wz-gsa]

Part of the Oracle 19c epic (#519). Raised in PR #537 review (@cweibel): the Oracle binding returns port: 1521, ssl_required: true, and 1521 is the non-SSL port.

Problem

On RDS for Oracle, 1521 is the clear-text TCP listener — it is not encrypted by itself. TLS requires a separate TCPS listener port (conventionally 2484) that only exists when the SSL option is added to an option group. Our Oracle option group is currently empty/not provisioned (#526), so an instance today offers only plaintext 1521. That makes the binding's ssl_required=true on port 1521 incoherent/misleading (SC-8 encryption-in-transit signaling defect): a client honoring ssl_required and attempting TCPS against 1521 fails; a client ignoring it connects in the clear believing it's encrypted. We do not yet have a plan for Oracle encryption-in-transit — this issue establishes one.

Findings (verified against AWS docs)

• 1521 = plaintext; RDS uses a second port for SSL. SSL option docs
• SSL option ⇒ TCPS listener; operator sets Port (AWS example uses 2484), SQLNET.SSL_VERSION=1.2, FedRAMP-compliant SQLNET.CIPHER_SUITE, optional FIPS.SSLFIPS_140=TRUE. Adding the SSL option
• NATIVE_NETWORK_ENCRYPTION (NNE) ⇒ encrypts over 1521, no server cert/DN identity; cannot coexist with SSL. NNE docs
• TLS clients need the RDS GovCloud CA (truststore.pki.us-gov-west-1.rds.amazonaws.com), a PROTOCOL=TCPS URL, and (recommended) oracle.net.ssl_server_dn_match=TRUE. Default RDS CA is rds-ca-rsa2048-g1; RSA CAs are incompatible with ECDSA-only cipher suites. Using SSL/TLS
• cloud.gov already requires SSL for PostgreSQL 15+, so a TLS-first Oracle posture is consistent.

Options

• A (recommended): SSL/TLS on TCPS. Provision the SSL option (Port=2484, TLS 1.2, FedRAMP cipher, FIPS on); publish port: 2484, ssl_required: true; ship CA + DN-match guidance. Real X.509 identity + TLS; matches the PG15+ bar. Depends on the option-group work (WS6 — Oracle 19c: option-group baseline #526). Highest client complexity.
• B: Native Network Encryption on 1521. Encrypts over 1521, simplest client, but no server-cert identity and ssl_required would be a misnomer.
• C: Both. Not permitted by AWS — reject.

Recommendation

Adopt Option A. Until the option group is provisioned, do NOT ship ssl_required=true on 1521 — it is incoherent. Interim: either set ssl_required=false and document plaintext-only for dev, or block the plan from customer visibility until A lands.

Acceptance criteria

• Oracle option group provisioned with SSL option (Port=2484, SQLNET.SSL_VERSION=1.2, FedRAMP-compliant cipher, FIPS.SSLFIPS_140=TRUE) — depends on WS6 — Oracle 19c: option-group baseline #526.
• Instance RDS CA + cipher suite verified compatible (RSA CA ⇒ RSA/ECDHE_RSA suites).
• Binding returns port: 2484 + ssl_required: true consistently; plaintext 1521 ingress closed where feasible.
• Binding/docs include the RDS GovCloud CA bundle + a TCPS example (JDBC + SQL*Plus, ssl_server_dn_match=TRUE).
• Negative test: a client honoring ssl_required cannot establish a clear-text session; a TCPS client succeeds.
• Interim: the shipped binding is not misleading (no ssl_required=true on a plaintext port).

Blocks a customer-facing encryption-in-transit claim; related to #526 (option group).