Upgrade Oracle Grid from 12c to 19c:12C (12.1.0.2) to 19C (19.7.0) :

 Steps to upgrade Grid

1.Review the pre-upgrade checklist.

2.Download 19c Grid software.

3.Run the Orachk readiness assessment.

4.Apply mandatory 19c patches.

5.Run the cluster verification utility.

6.Dry-run upgrade.

7.Upgrade Grid.

8.Verify Grid upgrade.

1.Review the pre-upgrade checklist.

According to the Oracle Document 2539751.1, you must apply the 28553832 patch in the 12C Grid home directory as a prerequisite:

[grid@norlathrac01 OPatch]$ ./opatch lsinventory |grep -i 28553832

28553832, 20883009, 21678268

2.Download 19c Grid software.

You can download the 19c Grid software from the following link:

https://www.oracle.com/database/technologies/oracle19c-linux-downloads.html

Create a directory on both the RAC (Real Application Cluster) nodes:

mkdir -p /u01/app/grid/product/19.3.0/grid

Copy the 19c grid software to the first node of RAC and unzip it.:

cd /u01/app/grid/product/19.3.0/grid

unzip -q <19c Grid Software location >

3.Run the Orachk readiness assessment.

According to Oracle document 1457357.1, the user that owns Grid needs to run the Orachk tool.

Make sure to download the latest version of Orachk from document 1457357.1 , then run the following commands:

cd /u01/app/grid/product/19.3.0/grid/suptools/orachk

export GRID_HOME= /u01/app/grid/product/19.3.0/grid

export RAT_PROMPT_WAIT_TIMEOUT=15

export RAT_ORACLE_HOME=/u01/app/grid/12.1.0

export RAT_DB=12.1.0.2.0

cd /u01/app/grid/product/19.3.0/grid/suptools/orachk

./orachk -u -o pre -profile clusterware,asm

This process generates an HTML report.Make sure to review the report for all failed, critical, and warning checks and resolve them before you move to the next step.

4.Apply mandatory 19c patches.

You need to apply the mandatory patch 30899722 in the 19c home directory, as recommended by this Oracle Documant:

[grid@norlathrac01 grid]$ pwd

/u01/app/grid/product/19.3.0/grid

[grid@norlathrac01 grid]$ ./gridSetup.sh -silent -applyRU

Execute the following command on node [norlathrac01] as root:

/u01/app/grid/product/19.3.0/grid/root.sh 

Successfully Setup Software.

Finally, it asks to run root.sh. Do not run the script yet because you need to run it at the end of the upgrade.

After applying the patch, run the following command and make sure the command shows as supported:

[grid@norlathrac01 bin]$ pwd

/u01/app/grid/product/19.3.0/grid/usm/install/Oracle/EL7UEK/x86_64/4.1.12-112.16.4/4.1.12-112.16.4-x86_64/bin

[grid@norlathrac01 bin]$ ./acfsdriverstate -orahome /u01/app/grid/product/19.3.0/grid supported

ACFS-9200: Supported

5.Run the cluster verification utility.

Log in as the Grid OS owner user and run the following commands:

[grid@norlathrac01 ~]$ cd /u01/app/grid/product/19.3.0/grid/

[grid@norlathrac01 grid]$ ./runcluvfy.sh stage -pre crsinst -upgrade -rolling -src_crshome /u01/app/grid/12.1.0 -dest_crshome /u01/app/grid/product/19.3.0/grid -dest_version 19.0.0.0.0 -fixup -verbose

This operation should pass all the following checks:

Verifying node application existence ...PASSED

Verifying check incorrectly sized ASM disks ...PASSED

Verifying ASM disk group free space ...PASSED

Verifying network configuration consistency checks ...PASSED

Verifying file system mount options for path GI_HOME ...PASSED

Verifying /boot mount ...PASSED

Verifying OLR Integrity ...PASSED

Verifying Verify that the ASM instance was configured using an existing ASM parameter file. ...PASSED

Verifying User Equivalence ...PASSED

Verifying RPM Package Manager database ...INFORMATION (PRVG-11250)

Verifying Network interface bonding status of private interconnect network interfaces ...PASSED

Verifying /dev/shm mounted as temporary file system ...PASSED

Verifying file system mount options for path /var ...PASSED

Verifying DefaultTasksMax parameter ...PASSED

Verifying zeroconf check ...PASSED

Verifying ASM filter driver configuration ...PASSED

verifying Systemd login manager IPC parameter ...PASSED

Verifying Kernel retpoline support ...PASSED

6.Dry-run upgrade.

As mentioned earlier, Oracle introduced this new feature in 19c Grid. You can execute a dry-run upgrade before the actual upgrade. Dry-run upgrades verify all the steps similar to a real upgrade without making any real changes. Run the following commands:

unset ORACLE_BASE

unset ORACLE_HOME

unset ORACLE_SID

cd /u01/app/grid/product/19.3.0/grid 

gridsetup.sh -dryRunForUpgrade 

Finally, the process prompts you to run rootupgrade.sh. Run this on only a local node.

7.Upgrade Grid.

In the earlier step, our dry-run upgrade was a success. Now, you can go for the real upgrade.

Before starting the real upgrade, run the following command to bring down the Grid services and ensure that the remaining services are running on the cluster servers. Make sure cluster upgrade status is normal:

[grid@norlathrac01 bin]$ ./crsctl query crs activeversion -f

Oracle Clusterware active version on the cluster is [12.1.0.2.0]. The cluster upgrade

state is [NORMAL]. The cluster active patch level is [2653232555].

cd /u01/app/grid/product/19.3.0/grid

unset ORACLE_BASE

 unset ORACLE_HOME

 unset ORACLE_SID 

./gridSetup.sh 

Run rootupgrade.sh first on the local node and then on the remote node.

At this point, the process upgrades Grid to 19c, and all the cluster services are running.

8.Verify Grid upgrade.

Atter Grid upgrades, run the following commands to verify the upgraded version of Grid:

[grid@norlathrac01 bin]$ crsctl query crs activeversion

Oracle clusterware active version on the cluster is [19.0.0.0.0]

[grid@norlathrac01 bin]$

[grid@norlathrac01 bin]$ ./crsctl query crs softwareversion

Oracle Clusterware version on node [norlathrac03] is [19.0.0.0.0]

Verify all the CRS services are running on both the cluster nodes:

[grid@norlathrac01 bin]$ crsctl check crs

CRS-4638: Oracle high availability services is online

CRS-4537: Cluster ready services is online

CRS-4529: Cluster synchronization services is online

CRS-4533: Event manager is online

Refrence:

https://docs.rackspace.com/blog/upgrade-oracle-grid-from-12c-to-19c/

https://docs.oracle.com/en/database/oracle/oracle-database/19/cwsol/applying-patches-during-oracle-grid-infrastructure-install-or-upgrade.html#GUID-D10C7B8D-A120-48A2-8237-36809D0DB21E

Enabling SSL or TLS in Oracle E-Business Suite Release 12.2

 The main steps for setting up SSL on the application tier are outlined below:

3.1 Set Your Environment

3.2 Create a Wallet

3.3 Create a Certificate Request

3.4 Submit the Certificate Request to a Certificate Authority

3.5 Import Server Certificate to the Wallet

3.6 Modify the Oracle HTTP Server Wallet

3.7 Modify the OPMN Wallet

3.8 Fusion Middleware Control Console

3.9 Update the JDK Cacerts File

3.10 Update the Context File and Config Files

3.11 Run AutoConfig

3.12 Customizations (Optional)

3.13 Restart the Application Tier Services

3.14 Synchronization Between Run and Patch File System

3.15 Renewing Revoked or Expired Certificates

Enable SSL for EBS R12.1:

1.Create New Wallet

2.Create a Certificate Request

3.Upload Certificate to Wallet

4.Modify the OPMN wallet

5.Import certs to cacerts

6.Update the Context File

7.Settings for DB Tier

What is SSL certificates?

SSL stands for Secure Sockets Layer, 

It refers to a protocol for encrypting and securing communications that take place on the Internet.

SSL was replaced by an updated protocol called TLS (Transport Layer Security) 

The main use case for SSL/TLS is securing communications between a client and a server, but it can also secure email, VoIP, and other communications over unsecured networks.

TLS vs SSL

Both TLS and SSL are protocols. help in securely authenticate and transport data on the Internet. 

TLS, short for Transport Layer Security, and SSL, short for Secure Socket Layers, are both cryptographic protocols that encrypt data and authenticate a connection when moving data on the Internet.

The main difference between Secure Socket Layer and Transport Layer Security is that, in SSL (Secure Socket Layer), the Message digest is used to create a master secret and It provides the basic security services which are Authentication and confidentiality. while In TLS (Transport Layer Security), a Pseudo-random function is used to create a master secret. 

 TLS is actually just a more recent version of SSL. It fixes some security vulnerabilities in the earlier SSL protocols.

How Do TLS and SSL Work to Secure Data?

Here’s the high-level process for how both SSL and TLS work.

When you install an SSL/TLS certificate on your web server (often just called an “SSL certificate), it includes a public key and a private key that authenticate your server and let your server encrypt and decrypt data.

When a visitor goes to your site, their web browser will look for your site’s SSL/TLS certificate. Then, the browser will perform a “handshake” to check the validity of your certificate and authenticate your server. If the SSL certificate is not valid, your users may be faced with the “your connection is not private” error, which could cause them to leave your website.

Once a visitor’s browser determines that your certificate is valid and authenticates your server, it essentially creates an encrypted link between it and your server to securely transport data.

This is also where HTTPS comes in (HTTPS stands for “HTTP over SSL/TLS”).

HTTP, and the more recent HTTP/2, are application protocols that play an essential role in transferring information over the Internet.

With plain HTTP, that information is vulnerable to attacks. But when you use HTTP over SSL or TLS (HTTPS), you encrypt and authenticate that data during transport, which makes it secure.

This is why you can safely process credit card details over HTTPS but not over HTTP, and also why Google Chrome is pushing so hard for HTTPS adoption..

Why the SSL certificate is required for Oracle EBS R12 what impact he does business

How to implement / configure SSL on Oracle EBS R12 (Server DMZ, HTTP Server etc.,)

What are the pre-requisites and studies required for SSL Certication

How to replace the SSL Certification expiring in force with a New Server DMZ

Refrences:

https://balajiabhi.blogspot.com/2009/08/configuring-ssl-in-1211-step-by-step.html

https://www.funoracleapps.com/2013/03/enable-ssl-for-ebs-r121.html

http://dbafix.blogspot.com/2019/08/enabling-ssl-or-tls-in-oracle-e.html

Enabling SSL or TLS in Oracle E-Business Suite Release 12.2 (Doc ID 2143101.1)

Enabling TLS in Oracle E-Business Suite Release 12.1 (Doc ID 376700.1)

Enabling TLS in Oracle E-Business Suite Release 12.2 (Doc ID 1367293.1)

How to Create a New Wallet and Add a Signed Certficate Using orapki (Doc ID 331092.1)

DMZ setup on Oracle EBS R12

Highlighted steps :

1. Copy the Application to the DMZ server

2. Clone the Application Tier using adcfgclone.pl

3. Run the txkChangeProfH.sql under FND_TOP/patch/115/sql

@txkChangeProfH.sql SERVRESP

4. Run the Autoconfig all nodes

1. Database.

2. DMZ.

3. Internal Application server.

5. Change the profile Node Trust Level at the Server level to "External".

6. Change the profile Responsibility Trust Level at the desired responsibility level to "External".

7. Test both the DMZ and Internal URL's.

1.Pre-Clone Steps on Internal Server:

Run adpreclone.pl on MINEJand MINEZ with applcrp3 and oracrp3 users.

Take a backup of /d21/applcrp/CRP3 folder on MINEJ

Restore the Backup into MINE8 server under /d21 mount point.

Setup Host File:

Put the following entries in the Hosts File (/etc/hosts).

Change the owner Ship of /d21/oracrp3 folder and the file under it to applcrp3

Creating External Web Tier:

Create XML file for External Server:

Run adpreclone.pl to add the MINE8 server as a node to CRP3:

CONTEXT_FILE configuration:

Modify the following CONTEXT_FILE parameters:

s_applcsf

s_applptmp

s_appltmp

s_formshost

s_chronosURL

s_external_url

s_webentryhost

s_login_page

Run AutoConfig on al l the Nodes(Database,DMZ,Internal Application server.).

Configuring MINE8 for DMZ

Run the script txkChangeProfH.sql for the Profile option setup:

@$FND_TOP/patch/115/sql/txkChangeProfH.sql SERVRESP

Update Node Trust Level

Set the value of this profile option to External at the server level. The site level value should remain set to Normal.

Update List of Responsibility:

To change the value of the Responsibility Trust Level profile option at the responsibility level for a particular responsibility, 

Environment Name: VISPRD

Machine: 

Database/Conc/Admin Node: dbprd

Internal web/Form Node: appintprd

External Web Node: appextprd

Pre-Clone Steps on Internal Server

Run adpreclone.pl on appintprdand dbprd with applVISPRD and oraVISPRD users.

As oraVISPRD user:

cd $ORACLE_HOME/appsutil/scripts/VISPRD_dbprd

perl adpreclone.pl dbTier

As applVISPRD user:

cd $ADMIN_SCRIPTS_HOME

perl adpreclone.pl appsTier

Take a backup of /u01/applcrp/VISPRD folder on appintprd

Restore the Backup into appextprd server under /u01 mount point.

Setup Host File:

Put the following entries in the Hosts File (/etc/hosts)

10.211.16.92            dbprd.sonapglobal.com dbprd

10.223.18.72           appintprd.bn.sonap.net appintprd.bn

Change the owner Ship of /u01/oraVISPRD folder and the file under it to applVISPRD

cd /u01

chown –R oraVISPRD:dba oraVISPRD

Creating External Web Tier

Note:          Your steps should be more specific than the examples shown.

Create XML file for External Server:

su – applVISPRD

cd /u01/applVISPRD/VISPRD/apps/apps_st/comn/clone/bin

perl adclonectx.pl contextfile=/u01/applVISPRD/VISPRD/inst/apps/VISPRD_appintprd/appl/admin/VISPRD_appintprd.xml

Enter the APPS password: sonapVISPRD

Target System Hostname (virtual or normal) [appextprd]:

Do you want the inputs to be validated (y/n) [n]? :

Target System Database SID: VISPRD

Target System Database Server Node [appextprd]: dbprd

Target System Base Directory: /u01/oraVISPRD/VISPRD

Target System Forms ORACLE_HOME Directory [/u01/oraVISPRD/VISPRD/apps/tech_st/10.1.2]:

Target System Web ORACLE_HOME Directory [/u01/oraVISPRD/VISPRD/apps/tech_st/10.1.3]:

Target System APPL_TOP Mountpoint [/u01/oraVISPRD/VISPRD/apps/apps_st/appl]:

Target System COMMON_TOP Directory [/u01/oraVISPRD/VISPRD/apps/apps_st/comn]:

Target System Instance Home Directory [/u01/oraVISPRD/VISPRD/inst]:

Username for the Applications File System Owner [applVISPRD]:

Group for the Applications File System Owner [dba]:

Target System Root Service [enabled]:

Target System Web Entry Point Services [enabled]:

Target System Web Application Services [enabled]:

Target System Batch Processing Services [disabled]:

Target System Other Services [enabled]:

Do you want to preserve the Display [appintprd:0.0] (y/n)? : n

Target System Display [appextprd:0.0]:

Do you want the the target system to have the same port values as the source system (y/n) [y]? : n

Target System Port Pool [0-99]: 1

Choose a value which will be set as APPLPTMP value on the target node [1]: 2

New context path and file name [/u01/oraVISPRD/VISPRD/inst/apps/VISPRD_appextprd/appl/admin/VISPRD_appextprd.xml]:

Cross Check if the Context File generated is correct or not, check with following command if the respective components are enabled on appextprd:

grep –i status $CONTEXT_FILE

Run adpreclone.pl to add the appextprd server as a node to VISPRD:

su - applVISPRD

cd /u01/applVISPRD/VISPRD/apps/apps_st/comn/clone/bin

perl adcfgclone.pl appsTier /u01/applVISPRD/VISPRD/inst/apps/VISPRD_appextprd/appl/admin/VISPRD_appextprd.xml

Enter the APPS password:

Check the logfile for any error.

 CONTEXT_FILE configuration:

Modify the following CONTEXT_FILE parameters:

Context File Variable

Existing Value

New Value

s_applcsf

/u01/applVISPRD/VISPRD/inst/apps/VISPRD_appextprd/logs/appl/conc

/u01/applVISPRD/VISPRD/conc

s_appltmp

/u01/applVISPRD/VISPRD/inst/apps/VISPRD_appextprd/temp

/VISPRD_appltmp

s_applptmp

/u01/applVISPRD/VISPRD/inst/apps/VISPRD_appextprd/ptemp

/VISPRD_applptmp

s_formshost

appextprd

VISPRDext

s_chronosURL

http://appextprd.sonapglobal.com:8001/oracle_smp_chronos/oracle_smp_chronos_sdk.gif

http://VISPRDext.sonapglobal.com:8001/oracle_smp_chronos/oracle_smp_chronos_sdk.gif

s_external_url

http://appextprd.sonapglobal.com:8001

http://VISPRDext.sonapglobal.com:8001

s_webentryhost

appextprd

VISPRDext

s_login_page

http://appextprd.sonapglobal.com:8001/OA_HTML/AppsLogin

http://VISPRDext.sonapglobal.com:8001/OA_HTML/AppsLogin

Run AutoConfig on al l the Nodes.

Configuring appextprd for DMZ  

Run the script txkChangeProfH.sql for the Profile option setup:

# sonapssh dbprd

$ su – applVISPRD

$ sqlplus appUpdate Hierarchy Types/sonapVISPRD @$FND_TOP/patch/115/sql/txkChangeProfH.sql SERVRESP

Run AutoConfig on all nodes.

q   Update Node Trust Level

To change the value of the Node Trust Level profile option value to External for a particular node, perform the following steps:

1.       Login to Oracle E-Bsonapness Suite as sysadmin user sonapng the internal URL

2.       Select the System Administrator Responsibility

3.       Select Profile / System

4.       From the 'Find system profile option Values' window, select the server and get the valie appextprd into it.

5.       Query for %NODE%TRUST%. You will see a profile option named 'Node Trust Level'. The value for this profile option at the site level will be Normal. Leave this setting unchanged.

6.       Set the value of this profile option to External at the server level. The site level value should remain set to Normal

q   Update List of Responsibility

To change the value of the Responsibility Trust Level profile option at the responsibility level for a particular responsibility, perform the following steps:

7.       Login to Oracle E-Bsonapness Suite as sysadmin user sonapng the internal URL

8.       Select System Administrator Responsibility

9.       Select Profile / System

10.    From the 'Find system profile option Values' window, select the responsibility that you want to make available to users logging in via the external web tier

11.    Query for %RESP%TRUST%. You will see a profile option named 'Responsibility trust level'. The value for this profile option at site level will be Normal.  Leave this setting unchanged.

12.    Set the value of this profile option for the chosen responsibility to External at the responsibility level. The site-level value should remain Normal.

13.    Repeat for all responsibilities that you want to make available from the external web tier.

List of Responsibilities which can be enabled on External Server is as followed:

Product Name

Externally Accessible Responsibilites

Additional Profile Options

iSupplier

POS Supplier Guest User

Plan to Pay Supplier View

Plan, Source, Pay Supplier View

Source to Pay Supplier View

Supplier Profile Manager

Procure to Pay Supplier View

POS: External URL

POS: Internal URL

Oracle Sourcing

Sourcing Supplier

PON: External Applications Framework Agent

PON: External login URL

Oracle iProcurement

Self Registered Employee Default Responsibility

Self Registered New User Default Responsibility 

q   Enable Oracle E-Business Suite Application Server Security

1.       Set the value of Application Server Security Authentication (s_appserverid_authentication) to SECURE, in the CONTEXT_FILE on all the nodes.

2.       Run AutoConfig on each Applications middle tier to complete the configuration.

3.       After AutoConfig completes successfully, restart Oracle HTTP Server and OC4J processe

q   Increase JVM Size

Change the following JVM parameter in the CONTEXT_FILE as mentioned in the below table:

Note: Take a backup of Context File before Changing.

Variable

Exisiting Value

New Value

s_oacore_jvm_start_options

-server -verbose:gc -Xmx512M -Xms128M -XX:MaxPermSize=160M

-server -verbose:gc –Xmx1024M –Xms521M -XX:MaxPermSize=256M

q   Run Autoconfig

Run AutoConfig from ADMIN_SCRIPTS_HOME sonapng adautocfg.sh.

Enable SSL Login

Note:Include a subset of test steps that will confirm that the customization has been installed properly.

Reference

Metalink Document: “Oracle E-Bsonapness Suite R12 Configuration in a DMZ” Document ID: 380490.1

http://knoworacleappsdba.blogspot.com/2012/04/dmz-setup-on-oracle-ebs-r12.html