Replacing Expired OpenSSL Certificates on Oracle Exadata Cloud@Customer (ExaCC) Virtual Machines

Oracle Exadata Cloud@Customer (ExaCC) relies on OpenSSL certificates to enable secure communication between the Exadata infrastructure and the Oracle Database Cloud Service (DCS) components. If your organization's Security team identifies that the OpenSSL certificates on the Exadata virtual machines (DomU VMs) are approaching expiration or have already expired, you should raise a Service Request (SR) with Oracle Support to obtain the latest replacement certificates.

After Oracle Support provides the updated certificate files, they must be installed on each affected virtual machine by replacing the existing certificates, validating file ownership and permissions, and restarting the required DCS services.

This blog provides a step-by-step guide for replacing OpenSSL certificates on a two-node Oracle Exadata Cloud@Customer (ExaCC) cluster. The procedures described in this guide were successfully performed on the following cluster:

[grid@node01 ~]$ $GRID_HOME/bin/olsnodes -n
node01    1
node02    2

High-Level Steps:

1. Download the updated OpenSSL certificate files provided by Oracle Support and copy them to the /tmp directory on each VM.
2. Create a backup directory for the existing certificate files.
3. Back up the current certificates located under /opt/oracle/dcs/auth.
4. Move the existing dbcsagent_truststore.pfx file to the backup directory.
5. Copy the new certificate files received from Oracle Support into the /opt/oracle/dcs/auth directory.
6. Verify that the ownership, group ownership, and file permissions of the new certificate files match those of the original files.
7. Restart the dcsagent and dbcsadmin services.
8. Verify that both services are running successfully and listening on the required network ports.
9. Repeat the same procedure on the remaining node in the ExaCC cluster.

This guide helps Exadata administrators safely replace expired OpenSSL certificates with minimal service interruption while ensuring continued secure communication between Exadata Cloud@Customer components.

1. Download the updated OpenSSL certificate files provided by Oracle Support and copy them to the /tmp directory on each VM.

2. Create a backup directory for the existing certificate files.
[root@node01 ~]# mkdir -p /root/dcs_cert_bkp

3. Back up the current certificates located under /opt/oracle/dcs/auth.
[root@node01 ~]# cp -p /opt/oracle/dcs/auth/dbcsagent.pfx /root/dcs_cert_bkp
[root@node01 ~]# ls -ltr /root/dcs_cert_bkp
total 4
-rw------- 1 opc opc 2661 Dec 4 2024 dbcsagent.pfx

4. Move the existing dbcsagent_truststore.pfx file to the backup directory.
[root@node01 ~]# mv /opt/oracle/dcs/auth/dbcsagent_truststore.pfx /root/dcs_cert_bkp
[root@node01 ~]# ls -ltr /root/dcs_cert_bkp
total 4
-rw------- 1 opc opc 2661 Dec 4 2024 dbcsagent.pfx
-rw------- 1 opc opc 1446 Dec 4 2024 dbcsagent_truststore.pfx

5. Copy the new certificate files received from Oracle Support into the /opt/oracle/dcs/auth directory.
[root@node01 ~]# cp /tmp/dbcsagent_new.pfx /opt/oracle/dcs/auth/dbcsagent.pfx
cp: overwrite '/opt/oracle/dcs/auth/dbcsagent.pfx'? yes
[root@node01 ~]# cp /tmp/dbcsagent_truststore_new.pfx /opt/oracle/dcs/auth/dbcsagent_truststore.pfx
[root@node01 ~]# cp /tmp/dbcsagent_new.pfx /opt/oracle/dcs/auth/dbcsagent_keystore.pfx
cp: overwrite '/opt/oracle/dcs/auth/dbcsagent_keystore.pfx'? yes
[root@node01 ~]#

6. Verify that the ownership,group ownership and file permissions of the new certificates match those of the original files.
[root@node01 ~]# chown opc:opc /opt/oracle/dcs/auth/dbcsagent.pfx
[root@node01 ~]# chmod 600 /opt/oracle/dcs/auth/dbcsagent.pfx
[root@node01 ~]# chown opc:opc /opt/oracle/dcs/auth/dbcsagent_truststore.pfx
[root@node01 ~]# chmod 600 /opt/oracle/dcs/auth/dbcsagent_truststore.pfx
[root@node01 ~]# chown opc:opc /opt/oracle/dcs/auth/dbcsagent_keystore.pfx
[root@node01 ~]# chmod 600 /opt/oracle/dcs/auth/dbcsagent_keystore.pfx

7. Restart the dcsagent and dbcsadmin services
[root@node01 ~]# sudo systemctl status dbcsagent
● dbcsagent.service
Loaded: loaded (/usr/lib/systemd/system/dbcsagent.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2025-12-21 17:47:48 UTC; 6 days ago
Main PID: 29407 (bash)
Tasks: 76 (limit: 319999)
Memory: 368.8M
CGroup: /system.slice/dbcsagent.service
├─29407 /bin/bash -c umask 077; /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx256m -X>
└─41430 /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx256m -Xss512k -XX:MetaspaceSize>

Dec 22 11:40:39 node01 sudo[55161]: opc : PWD=/ ; USER=root ; COMMAND=/bin/chmod 600 /tmp/readFile7078262664136876947tmp
Dec 22 11:40:39 node01 sudo[55189]: opc : PWD=/ ; USER=root ; COMMAND=/bin/rm -f /tmp/readFile7078262664136876947tmp
Dec 22 11:41:32 node01 sudo[60354]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsadmin
Dec 22 11:41:38 node01 sudo[60880]: opc : PWD=/ ; USER=root ; COMMAND=/bin/find /u02/oracle.ahf/data/telemetry_adapter/output/cef_events/metrics_41>
Dec 22 11:41:38 node01 sudo[60888]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/sha256sum /u02/oracle.ahf/data/telemetry_adapter/output/cef_events/m>
Dec 22 11:41:38 node01 sudo[60894]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/setfacl -m u:oracle:rw,u:grid:rw,u:opc:rw /tmp/readFile4103528454658>
Dec 22 11:41:38 node01 sudo[60899]: opc : PWD=/ ; USER=root ; COMMAND=/bin/cp /u02/oracle.ahf/data/telemetry_adapter/output/cef_events/metrics_41.j>
Dec 22 11:41:38 node01 sudo[60904]: opc : PWD=/ ; USER=root ; COMMAND=/bin/chown opc:opc /tmp/readFile4103528454658269295tmp
Dec 22 11:41:38 node01 sudo[60908]: opc : PWD=/ ; USER=root ; COMMAND=/bin/chmod 600 /tmp/readFile4103528454658269295tmp
Dec 22 11:41:38 node01 sudo[60915]: opc : PWD=/ ; USER=root ; COMMAND=/bin/rm -f /tmp/readFile4103528454658269295tmp

[root@node01 ~]# sudo systemctl status dbcsadmin
● dbcsadmin.service
Loaded: loaded (/usr/lib/systemd/system/dbcsadmin.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2025-12-21 17:47:48 UTC; 6 days ago
Main PID: 29405 (bash)
Tasks: 50 (limit: 319999)
Memory: 244.9M
CGroup: /system.slice/dbcsadmin.service
├─29405 /bin/bash -c umask 077; /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx200m -X>
└─41429 /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx200m -Xss512k -XX:MetaspaceSize>

Dec 22 11:23:31 node01 sudo[344756]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:25:31 node01 sudo[363303]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:27:31 node01 sudo[376351]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:29:31 node01 sudo[387655]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:31:31 node01 sudo[342]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:33:31 node01 sudo[12268]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:35:31 node01 sudo[24894]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:37:31 node01 sudo[36490]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:39:31 node01 sudo[47790]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:41:32 node01 sudo[60353]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent

[root@node01 ~]# sudo systemctl restart dbcsagent
[root@node01 ~]# sudo systemctl restart dbcsadmin
[root@node01 ~]# sudo systemctl status dbcsagent
● dbcsagent.service
Loaded: loaded (/usr/lib/systemd/system/dbcsagent.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2026-04-28 11:43:01 UTC; 17s ago
Process: 68147 ExecStopPost=/bin/bash -c kill -9 `ps -fu opc |grep "java.*dbcs-agent.*jar" |awk '{print $2}' ` (code=killed, signal=KILL)
Main PID: 68157 (bash)
Tasks: 79 (limit: 319999)
Memory: 180.2M
CGroup: /system.slice/dbcsagent.service
├─68157 /bin/bash -c umask 077; /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx256m -X>
├─68158 /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx256m -Xss512k -XX:MetaspaceSize>
└─69080 /bin/sh -c export LC_ALL=en_US.UTF-8;/usr/bin/sudo -u root /var/opt/oracle/dbaascli/dbaascli cswlib download --imageTag cloudvm_artifact>

Dec 22 11:43:03 node01 sudo[68270]: opc : PWD=/ ; USER=root ; COMMAND=/bin/chmod 1777 /var/opt/oracle/dbaas_acfs/tmp/
Dec 22 11:43:04 node01 sudo[68345]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i common_nat_fileserver= /var/opt/oracle/cprops/cprops.ini
Dec 22 11:43:04 node01 sudo[68370]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i common_nat_fileserver= /var/opt/oracle/cprops/cprops.ini
Dec 22 11:43:04 node01 sudo[68392]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i common_nat_fileserver_port= /var/opt/oracle/cprops/cprops.ini
Dec 22 11:43:04 node01 sudo[68397]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i common_fedramp= /var/opt/oracle/cprops/cprops.ini
Dec 22 11:43:04 node01 sudo[68402]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/curl -k http://169.254.200.13:2080/registerevent?type=startup&host_n>
Dec 22 11:43:14 node01 sudo[69091]: opc : PWD=/ ; USER=root ; COMMAND=/var/opt/oracle/dbaascli/dbaascli cswlib download --imageTag cloudvm_artifact>
Dec 22 11:43:14 node01 sudo[69231]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsadmin
Dec 22 11:43:14 node01 sudo[69235]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i atp_enabled /var/opt/oracle/cprops/cprops.ini
Dec 22 11:43:14 node01 sudo[69339]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i atp_enabled /var/opt/oracle/cprops/cprops.ini

[root@node01 ~]# sudo systemctl status dbcsadmin
● dbcsadmin.service
Loaded: loaded (/usr/lib/systemd/system/dbcsadmin.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2026-04-28 11:43:11 UTC; 17s ago
Process: 68688 ExecStopPost=/bin/bash -c kill -9 `ps -fu opc |grep "java.*dbcs-admin.*jar" |awk '{print $2}' ` (code=killed, signal=KILL)
Main PID: 68700 (bash)
Tasks: 49 (limit: 319999)
Memory: 166.8M
CGroup: /system.slice/dbcsadmin.service
├─68700 /bin/bash -c umask 077; /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx200m -X>
├─68701 /u01/oracle.dbcsagent/graalvm-jre-23.1.9/bin/java --add-opens=java.base/java.util=ALL-UNNAMED -Xms50m -Xmx200m -Xss512k -XX:MetaspaceSize>
└─72975 /bin/sh -c export LC_ALL=en_US.UTF-8;/usr/bin/sudo -u root /var/opt/oracle/dbaascli/dbaascli cswlib download --imageTag cloudvm_artifact>

Dec 22 11:43:11 node01 systemd[1]: Started dbcsadmin.service.
Dec 22 11:43:13 node01 sudo[68804]: opc : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl is-active dbcsagent
Dec 22 11:43:13 node01 sudo[68805]: opc : PWD=/ ; USER=root ; COMMAND=/bin/grep -i common_nat_fileserver= /var/opt/oracle/cprops/cprops.ini
Dec 22 11:43:23 node01 sudo[72978]: opc : PWD=/ ; USER=root ; COMMAND=/var/opt/oracle/dbaascli/dbaascli cswlib download --imageTag cloudvm_artifact>

8. Verify that both services are running successfully and listening on the required network ports.
[root@node01 ~]# netstat -tunlp |grep 7060
tcp 0 0 :7060 0.0.0.0:* LISTEN 41429/java
tcp 0 0 :7060 0.0.0.0:* LISTEN 41429/java
[root@node01 ~]# netstat -tunlp |grep 7070
tcp 0 0 :7070 0.0.0.0:* LISTEN 41430/java
tcp 0 0 :7070 0.0.0.0:* LISTEN 41430/java
tcp 0 0 :7070 0.0.0.0:* LISTEN 41430/java

9. Execute the above steps on all nodes in the cluster.