Wednesday, July 8, 2026

How to Connect Oracle AI Private Agent Factory to Oracle EBS Using SQLcl MCP Server over SSE

Over the past few weeks, I have been hands-on with Oracle AI Private Agent Factory (PAF) on OCI, and one of the most interesting challenges I faced was connecting PAF to a classic Oracle EBS (E-Business Suite) database that sits on a private subnet. There was no documentation that covered this end-to-end, and I had to piece things together through trial, error, and a fair amount of troubleshooting.

In this blog, I am going to walk you through everything I did — from installing SQLcl on Oracle Linux 9.7, understanding why a bridge is needed between SQLcl MCP and PAF, dealing with SELinux, cross-VCN networking on OCI, and finally getting PAF to talk to your EBS database through the MCP server. If you are doing something similar, this is the guide I wish I had.

Understanding the Architecture

Before we dive into commands, let me explain what we are building and why each component exists. This is the flow:

PAF (VCN 1, Private Subnet) → SQLcl MCP VM (VCN 2, Private Subnet) → EBS Database (VCN 2, Private Subnet)

Oracle AI Private Agent Factory is an agentic AI platform that orchestrates AI agents to perform tasks — including querying databases. It communicates with external tools using the Model Context Protocol (MCP), but it expects MCP servers to be reachable over HTTP/SSE (Server-Sent Events).

SQLcl is Oracle's command-line interface for Oracle Database. From version 25.2 onwards, it ships with a built-in MCP server that you can activate with a single flag — sql -mcp. However, SQLcl's MCP server speaks stdio (standard input/output), not HTTP. This is the core challenge.

💡 PAF speaks HTTP/SSE. SQLcl MCP speaks stdio. You need a bridge between them — that bridge is mcp-proxy running on the same VM as SQLcl.

The mcp-proxy tool (Python) wraps the SQLcl stdio process and exposes it as an HTTP/SSE endpoint on port 8080. Once that endpoint is live, PAF can discover and call all five SQLcl MCP tools as if they were a native HTTP service.

The following are the OS details in my OCI environment,

OS - Oracle Linux 9.7 (OL9) OR Oracle Linux

Architecture - x86_64

RAM - Minimum 4 GB

Disk - Boot volume at least 100 GB

Network - Private subnet

User - oracle user with sudo access

Software Prerequisites

● Java 17 or higher (JRE/JDK) — SQLcl is Java-based

● SQLcl 25.2 or higher — includes the built-in MCP server

● Python 3.11 or higher — required for mcp-proxy

● mcp-proxy Python package — the stdio-to-SSE bridge

Section 1: Installing Java 17 on Oracle Linux 9

The first thing you need is Java 17 or higher. Do not touch the system Python or any system-managed Java — install a clean version alongside what is already on the system.

# Install OpenJDK 17

sudo dnf install java-17-openjdk -y

# Set JAVA_HOME

echo 'export JAVA_HOME=/usr/lib/jvm/java-17-openjdk' >> ~/.bashrc

echo 'export PATH=$JAVA_HOME/bin:$PATH' >> ~/.bashrc

source ~/.bashrc

# Verify

java -version

💡 On OL9, OpenJDK 17 is available directly from the default dnf repositories — no third-party repo needed.

Section 2: Installing SQLcl

Download SQLcl 25.2 or later from Oracle's official download page (requires an Oracle account). Once you have the zip file, extract it to a standard location.

# Create the install directory

mkdir -p /home/oracle/sqlcl

# Unzip (replace with your actual downloaded filename)

unzip sqlcl-25.x.x.zip -d /home/oracle/sqlcl/

# The binary is called 'sql' — not 'sqlcl'

# This is a common gotcha!

export PATH=/home/oracle/sqlcl/bin:$PATH

# Verify

sql -version

💡 The binary is named 'sql', not 'sqlcl'. This trips up almost everyone the first time. All commands going forward use 'sql', including sql -mcp.

Section 3: Saving the EBS Database Connection

The SQLcl MCP server relies on connections saved in its credential store at ~/.dbtools. You must save your EBS connection with the -savepwd flag before the MCP server can auto-connect to it.

# Launch SQLcl

/home/oracle/sqlcl/bin/sql /nolog

# Inside SQLcl — save EBS connection with password

SQL> conn -save ebs_mcp -savepwd apps/yourpassword@//ebs-db-hostname:1521/EBSDB

# Verify it saved correctly

SQL> connmgr list

SQL> exit

If your EBS database uses a tnsnames.ora entry, set TNS_ADMIN first:

export TNS_ADMIN=/home/oracle/network/admin

sql /nolog

SQL> conn -save ebs_mcp -savepwd apps/yourpassword@EBSDB

Section 4: Installing Python 3.11 and mcp-proxy

Your Oracle Linux 9 ships with Python 3.9, which is tied to system tools like dnf. Do not upgrade or replace it. Instead, install Python 3.11 alongside it — they coexist cleanly on OL9.

# Install Python 3.11

sudo dnf install python3.11 python3.11-pip -y

# Verify

python3.11 --version

# Install mcp-proxy using Python 3.11

python3.11 -m pip install --user mcp-proxy

# Add local bin to PATH

echo 'export PATH=$HOME/.local/bin:$PATH' >> ~/.bashrc

source ~/.bashrc

# Verify

mcp-proxy --version

💡 mcp-proxy requires Python 3.10 or higher. If you try to install it with the system Python 3.9, it will fail with 'No matching distribution found'. Always use python3.11 -m pip install for this package.

Why mcp-proxy and What It Does

Let me explain this clearly because I got confused about this myself. There are several bridge tools in the MCP ecosystem — mcp-remote, mcp-proxy, supergateway — and they all sound similar but do different things.

For our use case — wrapping SQLcl MCP (stdio) and exposing it as HTTP/SSE for PAF — mcp-proxy (Python) is the correct tool. It spawns sql -mcp as a child process, handles stdio communication internally, and exposes a clean SSE endpoint on port 8080 that PAF can register and call.

Section 5: Creating the Wrapper Script and systemd Service

The Wrapper Script

Create a shell script that sets all required environment variables and launches mcp-proxy with the correct arguments. Pay attention to using absolute paths — systemd does not load your .bashrc, so relative paths and ~ expansions will not work.

cat > /usr/local/bin/sqlmcpserver.sh << 'EOF'

#!/bin/bash

export JAVA_HOME=/usr/lib/jvm/java-17-openjdk

export TNS_ADMIN=/home/oracle/network/admin

export PATH=/home/oracle/.local/bin:/usr/lib/jvm/java-17-openjdk/bin:/home/oracle/sqlcl/bin:$PATH

exec /home/oracle/.local/bin/mcp-proxy \

--port=8080 \

--host=0.0.0.0 \

-- /home/oracle/sqlcl/bin/sql -mcp

EOF

chmod +x /usr/local/bin/sqlmcpserver.sh

💡 Keep your scripts in /usr/local/bin rather than /home/oracle. Oracle Linux 9 runs SELinux in Enforcing mode by default, and scripts in home directories carry the user_home_t context which systemd refuses to execute (you get status=203/EXEC). Scripts in /usr/local/bin automatically get the bin_t context that systemd accepts.

The systemd Service

Create a systemd unit file to manage the service lifecycle — auto-start on boot, auto-restart on crash, and proper logging via journald.

sudo vi /etc/systemd/system/sqlcl-mcp.service

[Unit]

Description=SQLcl MCP HTTP/SSE Server for PAF

After=network.target

[Service]

Type=simple

User=oracle

ExecStart=/usr/local/bin/sqlmcpserver.sh

Restart=always

RestartSec=5

StandardOutput=journal

StandardError=journal

[Install]

WantedBy=multi-user.target

sudo systemctl daemon-reload

sudo systemctl enable sqlcl-mcp

sudo systemctl start sqlcl-mcp

sudo systemctl status sqlcl-mcp

A healthy service output looks like this:

Active: active (running) since Wed 2026-07-01 06:20:07 GMT

Main PID: 318054 (mcp-proxy)

INFO: Uvicorn running on http://0.0.0.0:8080

INFO: Application startup complete.

💡 Watch for 'http://0.0.0.0:8080' specifically. If you see '127.0.0.1:8080', add --host=0.0.0.0 to your mcp-proxy command — otherwise PAF cannot reach it from outside the VM.

Section 6: SELinux — The Silent Blocker

This deserves its own section because it cost me a significant amount of troubleshooting time. Oracle Linux 9 runs SELinux in Enforcing mode by default. If your script is in /home/oracle, systemd will refuse to execute it with status=203/EXEC — even if the file has execute permissions and a valid shebang.

The quick way to diagnose this:

getenforce

# Enforcing

ls -lZ /home/oracle/sqlmcpserver.sh

# -rwxr-xr-x. oracle oinstall unconfined_u:object_r:user_home_t:s0

The context user_home_t is the problem. The solution is simply to move your script to /usr/local/bin where it automatically gets the bin_t context that systemd trusts. Alternatively, if you must keep it in the home directory, you can relabel it:

sudo dnf install policycoreutils-python-utils -y

sudo semanage fcontext -a -t bin_t "/home/oracle/sqlmcpserver.sh"

sudo restorecon -v /home/oracle/sqlmcpserver.sh

💡 Never disable SELinux permanently to work around this. It is there for a reason — especially on a VM that holds database credentials. Fix the context, not the policy.

OS Firewall on SQLcl VM

sudo firewall-cmd --permanent --add-port=8080/tcp

sudo firewall-cmd --reload

sudo firewall-cmd --list-ports

Verify Connectivity End-to-End

# From SQLcl VM — confirm EBS DB is reachable

nc -zv <ebs-db-private-ip> 1521

# From PAF VM — confirm SQLcl MCP SSE endpoint is reachable

curl -N http://<sqlcl-vm-private-ip>:8080/sse

Section 7: Registering SQLcl MCP in Oracle AI Private Agent Factory

Once the SSE endpoint is confirmed reachable from the PAF VM, registering it in PAF is straightforward.

● Open PAF UI → Settings → MCP Servers → Add

● Name: SQLcl-EBS-MCP

● Endpoint URL: http://<sqlcl-vm-private-ip>:8080/sse

● Transport: SSE

● Authentication: None (for private subnet deployments)

● Click Connect — status should change to Connected

Once connected, PAF will automatically discover all five SQLcl MCP tools:

Thanks & Regards,

Chandan Tanwani

Saturday, April 11, 2026

Why I Couldn’t SSH Into My OCI VM Using Mobile Hotspot (And How I Finally Fixed It)

There are moments in cloud troubleshooting where everything looks perfectly configured… and yet, nothing works. This was one of those moments.

I had set up an Oracle Cloud (OCI) virtual machine, configured the networking correctly, added my public IP to the security list, and confidently tried to SSH into the server.

And then… it failed. Not once. Not twice. Every single time.

If you’ve ever faced a similar issue while working on a mobile hotspot, this article will save you hours of confusion.

🔍 The Setup — Everything Looked Correct

Let me first explain the setup so you can relate.

I had:

A compute instance in OCI with a public IP

A security rule allowing SSH (port 22) from my IP

My laptop connected via a mobile hotspot

From a configuration standpoint, this is textbook correct. In a typical home or office broadband setup, this should work instantly.

But here’s the catch — mobile networks behave very differently.

🧪 The First Suspicion — IP Mismatch

When SSH didn’t work, I did what most of us do — I verified my IP address. From the browser, I checked using an IP lookup website.

Then from terminal, I ran: curl ifconfig.me

To my surprise, both showed different results. At first glance, this might look like a minor inconsistency. But in reality, this is the starting point of the entire problem.

⚠️ Understanding the Real Problem

After digging deeper, I discovered that two things were happening simultaneously — and both are very common when using mobile hotspots.

🌐 1. IPv6 vs IPv4 Mismatch

The IP returned from the terminal looked something like:

2509:50c2:104d:df9b:9e6b:732d:a081:d7e2

This is clearly an IPv6 address. However, most OCI environments (unless explicitly configured) operate using IPv4:

Public IP assigned to VM → IPv4

Security rules → IPv4 CIDR ranges

SSH access → typically IPv4

So what was happening?

👉 My laptop was trying to connect using IPv6

👉 My OCI VM was expecting IPv4 traffic

These two simply don’t talk to each other unless specifically configured.

📡 2. Carrier-Grade NAT (CGNAT)

Now comes the second and more subtle issue.

Mobile network providers don’t assign a unique public IPv4 address to every user. Instead, they use something called Carrier-Grade NAT (CGNAT).

Let me simplify this.

Instead of:

Your Laptop → Internet → OCI VM

The actual flow looks like:

Your Laptop → Mobile Network NAT → Shared Public IP → OCI VM

This means:

Your device does not directly own a public IPv4 address
Multiple users share the same external IP
The IP you see may not be the one OCI sees
The IP can change frequently

So even if you whitelist an IP in OCI, the request might come from a completely different IP.

🚫 Why SSH Failed Despite Correct Configuration

At this point, everything started to make sense.

I had configured:

Source: <my-ip>/32

Port: 22

But OCI evaluates the actual incoming IP, not what I think my IP is. Due to CGNAT and IPv6 behavior:

My outgoing request did not match the whitelisted IP. OCI security rules blocked the connection.

Result → SSH timeout

This is why the issue feels so confusing — because the configuration is technically correct, but the network behavior breaks the assumption.

🧪 Confirming the Diagnosis

To validate this, I ran:

curl ifconfig.me

curl -4 ifconfig.me

curl -6 ifconfig.me

At this point, it was clear that this was not an OCI issue — it was a network limitation.

✅ What Actually Works (Practical Solutions)

Once you understand the root cause, the solution becomes much clearer.

🥇 Solution 1 — Use OCI Bastion (Recommended Approach)

The most effective and professional way to handle this is by using

OCI Bastion

Instead of exposing your VM directly to the internet, Bastion acts as a secure entry point.

Why this works so well:

It does not rely on your public IP being stable
It works even if your IP changes frequently
It eliminates the need to open SSH to the world
It aligns with security best practices

In simple terms, you connect to Bastion, and Bastion connects to your VM internally. This completely avoids the problems caused by CGNAT and IP mismatch.

🥈 Solution 2 — Forcing IPv4 (Temporary Workaround)

If you still want to try direct SSH, you can attempt to force IPv4:

curl -4 ifconfig.me

If you get a valid IPv4 address:

Add that IP in OCI security rules

Use ssh -4 to force IPv4 connection

However, this is not reliable because:

The IP may change at any time
CGNAT may still interfere
You may lose access intermittently

This is more of a quick test rather than a long-term solution.

Conclusion

This issue wasn’t really about OCI configuration — it was about how mobile networks behave. With CGNAT, dynamic IPs, and IPv6 in play, the IP you whitelist is often not the one OCI actually sees, which leads to SSH failures.

Instead of trying to chase changing IPs, the better approach is to use solutions designed for such environments, like OCI Bastion or OCI Cloud Shell.

👉 The key takeaway: when working from a mobile hotspot, don’t rely on IP-based access — use network-independent access methods for a stable and secure connection.

Thanks & Regards,

Chandan Tanwani

Friday, February 13, 2026

Shrinking Storage in Shared Autonomous Database on OCI

In one of our projects, we had deleted a huge volume of historical data from our Autonomous Database. Naturally, the expectation was simple:

Data is deleted → storage should reduce → cloud cost should go down.

But when we checked OCI metrics, the storage size was still the same. This created confusion in the team and raised an important question: “If the data is gone, why is storage still allocated?” If you have faced this, you are not alone. This is one of the most common and misunderstood behaviours in the Shared Autonomous Database on OCI.

This exact scenario is something I see very often across customers and projects using Shared Autonomous Database on OCI.

First, Let’s Understand How Storage Works in Autonomous Database

One of the biggest advantages of Autonomous Database is automatic storage scaling.

This means:

-> As your data grows → storage automatically increases.

-> You never need to worry about provisioning disks.

-> Performance remains consistent.

However, here is the important part many people don’t realize: When data is deleted, storage does NOT shrink automatically.

Yes — that surprises many people.

Why Storage Does Not Automatically Reduce

This behavior is actually by design.Oracle keeps the allocated storage to ensure:

-> Stable performance

-> No frequent resizing overhead

-> Faster future data growth handling

So when you delete data:

✔ The space becomes free inside the database

❌ But OCI still considers it allocated storage

And that means you continue paying for that storage unless you reclaim it. This is why understanding storage shrinking is very important for cloud cost optimization.

When Should You Shrink Storage?

Based on my real project experience, you should consider shrinking storage after:

Large data purging activities
Archiving historical records
Cleaning up staging tables
Dropping big tables or partitions
Post-migration cleanup
Temporary ETL data removal

Basically, whenever a significant amount of data is removed.

Check Before Shrinking Storage

One important point to understand is that Oracle Autonomous Database does not add multiple datafiles to the DATA tablespace. Instead, it uses a single large datafile (bigfile tablespace) and automatically increases its size of that big datafile as storage grows.

Because of this architecture, shrinking storage can take significant time, since the database must reorganize and reclaim space within a very large datafile.

Run the following query to assess the potential storage savings before initiating the shrink operation. All columns in the output are expressed in MB.

select file_name,

ceil( (nvl(hwm,1)*&&blksize)/1024/1024 ) sm,

ceil( blocks*&&blksize/1024/1024) currsize,

ceil( blocks*&&blksize/1024/1024) -

ceil( (nvl(hwm,1)*&&blksize)/1024/1024 ) savings

from dba_data_files a,

( select file_id, max(block_id+blocks-1) hwm

from dba_extents where tablespace_name='DATA'

group by file_id ) b

where a.file_id = b.file_id(+) and a.tablespace_name='DATA';

You should proceed with storage shrinking only when the savings column indicates a significant amount of reclaimable space. If the expected savings are minimal, it is not recommended to run this operation, as it is time-consuming and resource-intensive with limited practical benefit.

Steps to Shrink Storage in Autonomous Database

Step 1 — Log in to the OCI Console

Navigate to:

OCI Console → Autonomous Database → Select your database

Step 2 — Open Resource Allocation

Click the More actions drop-down menu and select Manage resource allocation.

Step 3 — Review Storage Details

In the Storage section, review:

"Allocated storage" — Total storage currently reserved

"Approximate used storage" — Actual space consumed by data

You can also run the query below to identify space usage by schemas/objects.

select file_name,

ceil( (nvl(hwm,1)*&&blksize)/1024/1024 ) sm,

ceil( blocks*&&blksize/1024/1024) currsize,

ceil( blocks*&&blksize/1024/1024) -

ceil( (nvl(hwm,1)*&&blksize)/1024/1024 ) savings

from dba_data_files a,

( select file_id, max(block_id+blocks-1) hwm

from dba_extents

group by file_id ) b

where a.file_id = b.file_id(+)

If you observe a significant difference between allocated and used storage, you may be able to reclaim space. For example, in my case there was approximately 4 TB of reclaimable storage between allocated and actual usage.

Step 4 — Click the "Shrink" Button

Click Shrink to initiate the storage reduction process.

Preconditions for Shrink Operation

The Shrink option is available only when all of the following conditions are met:

- Storage auto-scaling is enabled

- Allocated storage is greater than base (minimum) storage

- Allocated storage − Used storage > 100 GB

If these conditions are not satisfied and you click Shrink, Autonomous Database displays an “Action unavailable” message.

Considerations and Challenges with the Shrinking Process

There are a few important aspects to be aware of before initiating storage shrink:

1. No visible progress indicator

Once the shrinking process starts, there is no direct way in the console or database views to monitor its progress. The only practical approach is to raise an SR with Oracle Support and request periodic updates on the completion percentage.

2. Potentially long execution time

The duration largely depends on the size of the data file.

In my case, the data file was about 9 TB, and the shrink process took more than 28 hours to complete.

NOTE:

👉 The shrink operation runs an alter table... move online operation hence it is taking long time to complete it.

👉 Once your data deletion operation is complete, wait at least 1–2 hours before initiating the shrink process. Autonomous Database needs time to recalculate storage usage, and the updated values may take some time to appear in the OCI Console.

Because of this delay, the Shrink operation may occasionally be unavailable or fail immediately after large deletions, as the console has not yet reflected the updated storage metrics.

3. ECPU allocation impacts duration

The time required for shrinking also depends on the number of ECPUs allocated to the Autonomous Database. Higher ECPU allocation provides more processing power for the reorganization work.

👉 Therefore, it is recommended to scale up ECPUs before starting the shrink operation.

This helps in two ways:

-> Reduces overall shrink duration

-> Minimizes impact on your ongoing workload

My final conclusion

👉 Storage will NOT shrink automatically

👉 You must reclaim it manually via console

This small step can save significant cloud costs.

Thanks & Regards,

Chandan Tanwani

Friday, December 26, 2025

HR_OPERATING_UNITS Returns No Data in SQL Developer — The Hidden NLS Language Issue in Oracle Apps

Recently, while working with a custom user/schema in Oracle E-Business Suite (EBS), I hit an unexpected issue. I executed the following simple queries:

select count(*) from apps.hr_operating_units;

select count(*) from hr_operating_units;

To my surprise, both queries returned zero rows.

I knew very well that the HR Operating Units were already defined in the system, and other users could see the data. So why was my SQL Developer session not returning anything?

After a bit of investigation, I discovered the real culprit — NLS Language settings in SQL Developer.

🧩 Understanding the Problem

1. HR_OPERATING_UNITS is not a simple table

This object is a view owned by the APPS schema. It pulls data from multiple HR and FND tables:

HR_ALL_ORGANIZATION_UNITS

HR_OPERATING_UNITS

FND_LOOKUP_VALUES

and other HR-related lookup tables

These underlying tables often use lookup codes and meanings that are language dependent in EBS.

2. SQL Developer session language matters

When you connect using SQL Developer, it sets certain environment parameters automatically, including:

NLS_LANGUAGE

NLS_TERRITORY

NLS_DATE_FORMAT

If NLS_LANGUAGE does not match the base language installed in Oracle EBS (typically AMERICAN), then any HR or FND lookup join that depends on translated values may fail to match — which results in no rows returned.

This is exactly what happened with the HR_OPERATING_UNITS query.

The Fix: Set NLS_LANGUAGE to AMERICAN

Once I changed the NLS settings in SQL Developer, everything started working correctly.

Steps to Fix in SQL Developer

Go to

Tools → Settings → Database → NLS

Set the following:

NLS_LANGUAGE = AMERICAN

NLS_TERRITORY = AMERICA

Reconnect your database session.

Rerun the query:

SELECT COUNT(*) FROM apps.hr_operating_units;

Most Oracle EBS installations use AMERICAN as the base language.The HR and FND lookup tables store the translations for AMERICAN only. So when SQL Developer requested data using another language like:

ENGLISH

INDIA

FRENCH

GERMAN

or any other locale

The view internally filtered out rows because there were no lookup translations for that language.

Switching to AMERICAN ensured lookup matches were found.

This prevents issues with:

- Value sets not showing correct meanings

- HR views returning no rows

- Date conversion errors

- Responsibility-based security failing

- Incorrect FND lookup behavior

Thanks & Regards,

Chandan Tanwani

Friday, December 19, 2025

Fixing OCI Load Balancer Error: “Invalid SSL Configuration – Certificate Alias Required”

Recently, while creating a Load Balancer in OCI using the new UI, I ran into a strange SSL error that took me a good amount of time to troubleshoot. Since I didn’t find anything useful on Google or Oracle MOS, I am documenting my experience here so it can help others facing the same issue.

This article explains the issue, what causes it, and the exact workaround that finally fixed it.

💥 The Error Message

During Load Balancer creation, at the Configure Listener step, I selected:

Load Balancer Managed Certificate
Uploaded SSL Certificate
Uploaded CA Certificate
Uploaded Private Key

As soon as I clicked Submit, OCI returned this error:

1 problem occurred:

Load balancer

Invalid SSL configuration: [Constraint listener:listener_lb_2025-1202-1553 violation: Invalid listener ssl configuration.

* Constraint sslConfiguration violation: Certificate alias or certificateIds / trustedCertificateAuthorityIds required ]

This was confusing because all required certificate components were uploaded correctly.

🔍 Root Cause (New OCI UI Issue)

I spent a lot of time searching for the root cause:

No information on Google

No Oracle blogs

No Oracle MOS note

Nothing in developer forums

This pointed to one thing — a UI-level issue in the new OCI Console (2025 release).

Although the SSL certificate was uploaded, the new interface fails to map the certificate to the listener being created. OCI internally expects:

certificateAlias

certificateIds

trustedCertificateAuthorityIds

Because the new UI does not pass these values correctly, the listener creation fails.

🛠️ Working Solution (Workaround)

The fix is very simple:

➡️ Do NOT upload an SSL certificate during Load Balancer creation.

Instead:

Create the Load Balancer without SSL

After creation, manually upload your certificate

Once you follow this sequence, everything works perfectly.

📌 After Load Balancer Creation — Two Ways to Add Certificates

OCI gives you two options to add SSL certificates after LB creation:

1️⃣ Certificate Service Managed Certificates (Recommended)

Steps to Upload Certificate into OCI Certificate Service

Click on the three horizontal lines (☰) in the top-left corner
Navigate to Identity & Security
Under Certificates, click Certificates
Choose the correct compartment
Click the Add Certificate button
Upload your certificate details
Save

Once uploaded:

Go to your Load Balancer
Open Certificate & Ciphers
Under Certificate service managed certificates, click Assign Certificate
Select the certificate you uploaded
Update the listener

2️⃣ Load Balancer Managed Certificates (Manual Upload)

Use this if you want to upload certificates directly to the Load Balancer.

Steps:

Open your Load Balancer

Go to Certificate & Ciphers
Scroll to Load balancer managed certificates
Click Add Certificate
Upload:

SSL Certificate
CA Certificate
Private Key

Save

Update the Listener to use this certificate

This approach is straightforward and works perfectly with the new UI.

Thanks & Regards,

Chandan Tanwani

Thursday, November 27, 2025

ORA-12545: Connect failed because target host or object does not exist

Fixing ORA-12545: When Your Oracle Binary Goes Missing

Recently, while connecting to one of my test database instances, I ran into a frustrating error:

ORA-12545: Connect failed because target host or object does not exist

At first glance, this looks like a typical network issue — host unreachable, wrong IP, DNS mismatch, etc. But in my case, the root cause was completely different.

Digging Into the Error

After searching across a few forums and documents, I landed on the Oracle Support Note KB167814 – Troubleshooting guide for ORA-12545 / TNS-12545.
This document outlines three common problem categories along with causes and solutions.

From those, one scenario matched my situation exactly.

The Actual Problem

Problem:
You are trying to connect locally on the server without using the listener (using BEQ protocol). Such connections can fail with ORA-12545.

Cause:
The Oracle binary is missing from the $ORACLE_HOME/bin directory.

Diagnosis

To verify, I ran a quick check:


$ cd $ORACLE_HOME/bin
$ ls -l oracle

The result confirmed the problem — the oracle binary was missing.

And without this binary, the database simply cannot function.

What You Lose Without the Oracle Binary

You cannot start the database
You cannot mount or open the DB
You cannot connect as SYSDBA locally
You cannot use sqlplus / as sysdba

Why?

Because the oracle binary is the actual database engine. Without it, the entire Oracle stack becomes unusable.

Resolution Options

At this point, I had three practical solutions:

Raise an SR with Oracle Support and involve the DB Install team
Reinstall the Oracle Home (only the software, not the database)
Copy the oracle binary from another server

I chose the 3rd option, but with extreme caution.

Copying the Oracle Binary: Not as Simple as It Sounds

The oracle executable is not a simple file that you can copy from any system.
It relies on:

✔ Exact OS version
✔ Exact Kernel version
✔ Exact glibc & system libraries
✔ Exact Oracle patch level (RU/RUR)
✔ Identical ORACLE_HOME structure
✔ Identical linking options used during installation

If any of these differ, the copied binary will fail — or worse, cause unpredictable issues.

Fortunately, in my case, the source server matched my environment exactly.
I copied the binary, set the correct permissions, and—good news—my database started successfully.

Conclusion

The ORA-12545 error is often mistaken as just a networking issue. But sometimes the cause lies deeper inside the Oracle Home itself.
If you're connecting using BEQ and getting ORA-12545, don't forget to check whether your oracle binary actually exists.

A missing binary is rare, but when it happens, knowing the right direction saves enormous troubleshooting time.

Thanks & Regards,

Chandan Tanwani

Wednesday, November 26, 2025

How to Transfer Files Between an OCI VM (Compute Instance) and Object Storage (Part - 3)

Check out Part -1 - Install OCI CLI, pre-requisite

Check out Part -2 - Upload files to Object storage

In this article, let’s take the reverse approach:

downloading a file from an OCI Object Storage bucket into a VM that lives in a private subnet.

This is a common scenario — your production VMs are usually in private subnets with no public IP, and you still need to move files in and out efficiently.

Let me explain the simplest way to do it.

🔹 Key Challenge

A private-subnet VM cannot reach the internet directly.

But the good news,

👉 OCI CLI works perfectly inside private subnets via the Service Gateway, as long as it's properly configured.

If your subnet is connected to:

✔️ Service Gateway

AND

✔️ Object Storage Public Endpoint allowed

…you can directly download objects from Object Storage using CLI.

If your subnet isn't configured this way, you can still use the OCI Bastion Service to connect securely and run CLI commands.

Step 1: Confirm Network Access to Object Storage

From the private VM, run:

#> oci os ns get

If you get a valid namespace response, you're connected to Object Storage.

If it fails, ensure:

-> Subnet has Service Gateway attached

-> Route table has: 0.0.0.0/0 → Service Gateway

-> No overly restrictive security lists

Step 2: Download a File from Object Storage

Use the oci os object get command.

Basic Download Command

oci os object get \

--bucket-name <bucket_name> \

--name <object_name> \

--file <output_file_name>

Example

Download db_backup.tar.gz from bucket my-backup-bucket:

oci os object get \

--bucket-name my-backup-bucket \

--name db_backup.tar.gz \

--file db_backup.tar.gz

This saves the file in your current working directory.

Download Large Files

If you're dealing with multi-GB backups:

oci os object get \

--bucket-name my-backup-bucket \

--name largefile.gz \

--file largefile.gz \

--multipart-download-threshold 64 \

--part-size 64

Step 3: Verify the File

After download:

ls -lh

and optionally check checksum:

md5sum db_backup.tar.gz

If SSH is disabled or restricted, Access Private VM via OCI Bastion

Click here to know more how to access Private VM via OCI Bastion service

Once you're inside the bastion session, the exact same download commands work.

🎉 That's It!

Thanks & Regards,

Chandan Tanwani

How to Transfer Files Between an OCI VM (Compute Instance) and Object Storage (Part - 2)

Transferring a file from an OCI Compute Instance (VM) to Object Storage is one of the simplest and most reliable ways to store, archive, or share data.

Once your OCI CLI is installed and configured (as explained in Part - 1), you're ready for the next step.

Step 1: Verify You Have Access to the Bucket

Before uploading anything, check that:

- The bucket exists

- You have the right permissions (via IAM policy)

- Your CLI is configured for the correct region

- List the buckets in your compartment:

oci os bucket list --compartment-id <compartment_ocid>

If the bucket you want appears, you're good to go.

Step 2: Upload a File

Use the oci os object put command to upload a file.

Basic Upload Command

oci os object put \

--bucket-name <bucket_name> \

--file <local_file_path>

Example

Suppose your file is /u01/backups/db_backup.tar.gz and your bucket is my-backup-bucket:

oci os object put \

--bucket-name my-backup-bucket \

--file /u01/backups/db_backup.tar.gz

What Happens Here?

-> OCI CLI uploads the file

-> The object appears inside the bucket with the same filename

-> If the object already exists, it will be overwritten unless you disable overwrite

If you want to specify a different object name:

Example:

oci os object put \

--bucket-name my-backup-bucket \

--file db_backup.tar.gz \

--name MY_Backup_26Nov2025.tar.gz

Bulk Upload files using below command

Example:

oci os object bulk-upload \

-bn my-backup-bucket \

--src-dir /u01/RMANBackup26Nov2025 \

--include "*.bkp" \

--prefix rman/

Upload Large Files

For large files (GBs or TB-scale), use the --part-size option.

Example:

oci os object put \

--bucket-name my-backup-bucket \

--file db_backup.tar.gz \

--part-size 64

Step 3: Verify Upload

List objects inside the bucket:

oci os object list --bucket-name my-backup-bucket

To confirm size or metadata:

oci os object head \

--bucket-name my-backup-bucket \

--name db_backup.tar.gz

🎉 That's It!

You’ve now successfully uploaded files from a VM to Object Storage using OCI CLI.

This is the method I use daily for backups and log transfers.

In the next article, we will go the opposite direction — downloading files from Object Storage to a private subnet VM, even when it has no public internet access.

Thanks & Regards,

Chandan Tanwani

How to Transfer Files Between an OCI VM (Compute Instance) and Object Storage (Part - 1)

I’m writing a small series of articles where I walk you through one of the most common tasks we perform on Oracle Cloud Infrastructure (OCI):

moving files between a VM and an Object Storage bucket.

Whether you want to upload backups from your VM or download files into a private subnet, the process becomes extremely simple once your OCI CLI is set up correctly.

In this article, I’ll cover three clear steps, just the way I explain it to anyone who asks me:

1) Install and configure OCI CLI - (This only)

2) Upload files from a Public-Subnet VM to Object Storage

3) Download files from Object Storage to a Private-Subnet VM

Let’s begin!

1) Installing and Configuring OCI CLI

The very first prerequisite is simple:

👉 Your VM must have OCI CLI installed.

I personally logged in using the oracle user (which was created during VM setup), and ran the installation from there.

Step 1: Install the OCI CLI

Run the following command:

curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh | bash

This script handles everything—from downloading the CLI to setting up environment variables.

[oracle@vm-test-1 ~]$ curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh | bash

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 17155 100 17155 0 0 186k 0 --:--:-- --:--:-- --:--:-- 188k

WARNING: Some interactive prompts may not function correctly if this script is piped into bash (e.g. 'curl "https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh" | bash)'

WARNING: Script should either be downloaded and invoked directly, or be run with the following command: bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)"

******************************************************************************

You have started the OCI CLI Installer in interactive mode. If you do not wish

to run this in interactive mode, please include the --accept-all-defaults option.

If you have the script locally and would like to know more about

input options for this script, then you can run:

./install.sh -h

If you would like to know more about input options for this script, refer to:

https://github.com/oracle/oci-cli/blob/master/scripts/install/README.rst

******************************************************************************

Downloading Oracle Cloud Infrastructure CLI install script from https://raw.githubusercontent.com/oracle/oci-cli/v3.68.1/scripts/install/install.py to /tmp/oci_cli_install_tmp_zdp8.

######################################################################## 100.0%

Running install script.

python3 /tmp/oci_cli_install_tmp_zdp8

-- Verifying Python version.

-- Python version 3.6.8 okay.

===> In what directory would you like to place the install? (leave blank to use '/home/oracle/lib/oracle-cli'):

-- Creating directory '/home/oracle/lib/oracle-cli'.

-- We will install at '/home/oracle/lib/oracle-cli'.

===> In what directory would you like to place the 'oci' executable? (leave blank to use '/home/oracle/bin'):

-- Creating directory '/home/oracle/bin'.

-- The executable will be in '/home/oracle/bin'.

===> In what directory would you like to place the OCI scripts? (leave blank to use '/home/oracle/bin/oci-cli-scripts'):

-- Creating directory '/home/oracle/bin/oci-cli-scripts'.

-- The scripts will be in '/home/oracle/bin/oci-cli-scripts'.

===> Currently supported optional packages are: ['db (will install cx_Oracle)']

What optional CLI packages would you like to be installed (comma separated names; press enter if you don't need any optional packages)?:

-- The optional packages installed will be ''.

-- Trying to use python3 venv.

-- Executing: ['/bin/python3', '-m', 'venv', '/home/oracle/lib/oracle-cli']

-- Executing: ['/home/oracle/lib/oracle-cli/bin/pip', 'install', '--upgrade', 'pip']

Collecting pip

Downloading https://files.pythonhosted.org/packages/a4/6d/6463d49a933f547439d6b5b98b46af8742cc03ae83543e4d7688c2420f8b/pip-21.3.1-py3-none-any.whl (1.7MB)

100% |████████████████████████████████| 1.7MB 1.1MB/s

Installing collected packages: pip

Found existing installation: pip 9.0.3

Uninstalling pip-9.0.3:

Successfully uninstalled pip-9.0.3

Successfully installed pip-21.3.1

You are using pip version 21.3.1, however version 25.3 is available.

You should consider upgrading via the 'pip install --upgrade pip' command.

-- Executing: ['/home/oracle/lib/oracle-cli/bin/pip', 'install', '--cache-dir', '/tmp/tmpr32ini5k', 'wheel', '--upgrade']

Collecting wheel

Downloading wheel-0.37.1-py2.py3-none-any.whl (35 kB)

Installing collected packages: wheel

Successfully installed wheel-0.37.1

-- Executing: ['/home/oracle/lib/oracle-cli/bin/pip', 'install', '--cache-dir', '/tmp/tmpr32ini5k', 'oci_cli', '--upgrade']

Collecting oci_cli

Downloading oci_cli-3.71.0-py3-none-any.whl (25.2 MB)

|████████████████████████████████| 25.2 MB 40.6 MB/s

Collecting six>=1.15.0

Downloading six-1.17.0-py2.py3-none-any.whl (11 kB)

Collecting click==8.0.4

Downloading click-8.0.4-py3-none-any.whl (97 kB)

|████████████████████████████████| 97 kB 13.4 MB/s

Collecting jmespath==0.10.0

Downloading jmespath-0.10.0-py2.py3-none-any.whl (24 kB)

Collecting certifi>=2025.1.31

Downloading certifi-2025.4.26-py3-none-any.whl (159 kB)

|████████████████████████████████| 159 kB 97.5 MB/s

Collecting pyOpenSSL<=25.1.0,>=17.5.0

Downloading pyOpenSSL-23.2.0-py3-none-any.whl (59 kB)

|████████████████████████████████| 59 kB 13.1 MB/s

Collecting arrow>=1.0.0

Downloading arrow-1.2.3-py3-none-any.whl (66 kB)

|████████████████████████████████| 66 kB 10.9 MB/s

Collecting pytz>=2016.10

Downloading pytz-2025.2-py2.py3-none-any.whl (509 kB)

|████████████████████████████████| 509 kB 87.1 MB/s

Collecting terminaltables==3.1.10

Downloading terminaltables-3.1.10-py2.py3-none-any.whl (15 kB)

Collecting oci==2.164.0

Downloading oci-2.164.0-py3-none-any.whl (33.0 MB)

|████████████████████████████████| 33.0 MB 86.1 MB/s

Collecting prompt-toolkit==3.0.29

Downloading prompt_toolkit-3.0.29-py3-none-any.whl (381 kB)

|████████████████████████████████| 381 kB 36.3 MB/s

Collecting cryptography<46.0.0,>=3.2.1

Downloading cryptography-40.0.2-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (3.7 MB)

|████████████████████████████████| 3.7 MB 83.2 MB/s

Collecting PyYAML<=6.0.2,>=5.4

Downloading PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (677 kB)

|████████████████████████████████| 677 kB 90.0 MB/s

Collecting python-dateutil<3.0.0,>=2.5.3

Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl (229 kB)

|████████████████████████████████| 229 kB 94.4 MB/s

Collecting importlib-metadata

Downloading importlib_metadata-4.8.3-py3-none-any.whl (17 kB)

Collecting circuitbreaker<2.0.0,>=1.3.1

Downloading circuitbreaker-1.4.0.tar.gz (9.7 kB)

Preparing metadata (setup.py) ... done

Collecting wcwidth

Downloading wcwidth-0.2.14-py2.py3-none-any.whl (37 kB)

Collecting typing-extensions

Downloading typing_extensions-4.1.1-py3-none-any.whl (26 kB)

Collecting cffi>=1.12

Downloading cffi-1.15.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl (402 kB)

|████████████████████████████████| 402 kB 81.5 MB/s

Collecting pycparser

Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB)

|████████████████████████████████| 118 kB 82.6 MB/s

Collecting zipp>=0.5

Downloading zipp-3.6.0-py3-none-any.whl (5.3 kB)

Building wheels for collected packages: circuitbreaker

Building wheel for circuitbreaker (setup.py) ... done

Created wheel for circuitbreaker: filename=circuitbreaker-1.4.0-py3-none-any.whl size=7506 sha256=7e604a258e20a46edfdfd999605faec6d0a4ed5652229a140b4bec6b07f3c2eb

Stored in directory: /tmp/tmpr32ini5k/wheels/46/17/98/db2eb826e4a98da672cffe66ec16838182cde0cf19ad2c0c70

Successfully built circuitbreaker

Installing collected packages: pycparser, cffi, zipp, typing-extensions, six, cryptography, wcwidth, pytz, python-dateutil, pyOpenSSL, importlib-metadata, circuitbreaker, certifi, terminaltables, PyYAML, prompt-toolkit, oci, jmespath, click, arrow, oci-cli

Successfully installed PyYAML-6.0.1 arrow-1.2.3 certifi-2025.4.26 cffi-1.15.1 circuitbreaker-1.4.0 click-8.0.4 cryptography-40.0.2 importlib-metadata-4.8.3 jmespath-0.10.0 oci-2.164.0 oci-cli-3.71.0 prompt-toolkit-3.0.29 pyOpenSSL-23.2.0 pycparser-2.21 python-dateutil-2.9.0.post0 pytz-2025.2 six-1.17.0 terminaltables-3.1.10 typing-extensions-4.1.1 wcwidth-0.2.14 zipp-3.6.0

===> Modify profile to update your $PATH and enable shell/tab completion now? (Y/n):

===> Enter a path to an rc file to update (file will be created if it does not exist) (leave blank to use '/home/oracle/.bashrc'):

-- Backed up '/home/oracle/.bashrc' to '/home/oracle/.bashrc.backup'

-- Tab completion set up complete.

-- If tab completion is not activated, verify that '/home/oracle/.bashrc' is sourced by your shell.

-- ** Run `exec -l $SHELL` to restart your shell. **

-- Installation successful.

Announcement

============

1. Interactive mode now available in CLI

Have you tried the new interactive features in OCI CLI yet? You can get started by typing `oci -i`.

Learn more by watching our informative video on YouTube -> https://www.youtube.com/watch?v=lX29Xw1Te54&ab_channel=OracleLearning

Also see https://docs.oracle.com/iaas/Content/API/SDKDocs/cliusing_topic-Using_Interactive_Mode.htm

============

-- Run the CLI with /home/oracle/bin/oci --help

[oracle@vm-test-1 ~]$

After installation, verify it:

oci --version

If you see the version printed, your CLI is installed successfully.

[oracle@vm-test-bl-ebs-1 ~]$ oci --version

/home/oracle/lib/oracle-cli/lib64/python3.6/site-packages/oci/_vendor/httpsig_cffi/sign.py:10: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.6.

from cryptography.hazmat.backends import default_backend # noqa: F401

3.71.0

[oracle@vm-test-bl-ebs-1 ~]$

Step 2: Configure the OCI CLI

Next, we need to configure it with your OCI credentials.

Run: oci setup config

The CLI will ask for:

User OCID

Tenancy OCID

Region

Directory for storing API keys

Passphrase for the private key

[oracle@vm-test-1 ~]$ oci setup config

from cryptography.hazmat.backends import default_backend # noqa: F401

This command provides a walkthrough of creating a valid CLI config file.

The following links explain where to find the information required by this

script:

User API Signing Key, OCID and Tenancy OCID:

https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm#Other

Region:

https://docs.cloud.oracle.com/Content/General/Concepts/regions.htm

General config documentation:

https://docs.cloud.oracle.com/Content/API/Concepts/sdkconfig.htm

Enter a location for your config [/home/oracle/.oci/config]:

Enter a user OCID: ocid1.user.oc1..aaaaaaaahtnchxxxxxxbbbbbbbccccccdddddddpumrcff4ja

Enter a tenancy OCID: ocid1.tenancy.oc1..aaaaaaaaq3kiaahtnchxxxxxxbbbbbbbccccccdddddddteja

Enter a region by index or name(e.g.

1: af-johannesburg-1, 2: ap-batam-1, 3: ap-chennai-1, 4: ap-chiyoda-1, 5: ap-chuncheon-1,

6: ap-chuncheon-2, 7: ap-dcc-canberra-1, 8: ap-dcc-gazipur-1, 9: ap-delhi-1, 10: ap-hyderabad-1,

11: ap-ibaraki-1, 12: ap-melbourne-1, 13: ap-mumbai-1, 14: ap-osaka-1, 15: ap-seoul-1,

16: ap-seoul-2, 17: ap-singapore-1, 18: ap-singapore-2, 19: ap-suwon-1, 20: ap-sydney-1,

21: ap-tokyo-1, 22: ca-montreal-1, 23: ca-toronto-1, 24: eu-amsterdam-1, 25: eu-budapest-1,

26: eu-crissier-1, 27: eu-dcc-dublin-1, 28: eu-dcc-dublin-2, 29: eu-dcc-milan-1, 30: eu-dcc-milan-2,

31: eu-dcc-rating-1, 32: eu-dcc-rating-2, 33: eu-dcc-zurich-1, 34: eu-frankfurt-1, 35: eu-frankfurt-2,

36: eu-jovanovac-1, 37: eu-madrid-1, 38: eu-madrid-2, 39: eu-madrid-3, 40: eu-marseille-1,

41: eu-milan-1, 42: eu-paris-1, 43: eu-stockholm-1, 44: eu-zurich-1, 45: il-jerusalem-1,

46: me-abudhabi-1, 47: me-abudhabi-2, 48: me-abudhabi-3, 49: me-abudhabi-4, 50: me-alain-1,

51: me-dcc-doha-1, 52: me-dcc-muscat-1, 53: me-dubai-1, 54: me-ibri-1, 55: me-jeddah-1,

56: me-riyadh-1, 57: mx-monterrey-1, 58: mx-queretaro-1, 59: sa-bogota-1, 60: sa-santiago-1,

61: sa-saopaulo-1, 62: sa-valparaiso-1, 63: sa-vinhedo-1, 64: uk-cardiff-1, 65: uk-gov-cardiff-1,

66: uk-gov-london-1, 67: uk-london-1, 68: us-ashburn-1, 69: us-ashburn-2, 70: us-chicago-1,

71: us-columbus-1, 72: us-gov-ashburn-1, 73: us-gov-chicago-1, 74: us-gov-phoenix-1, 75: us-langley-1,

76: us-luke-1, 77: us-newark-1, 78: us-phoenix-1, 79: us-saltlake-2, 80: us-sanjose-1,

81: us-somerset-1, 82: us-thames-1): 68

Do you want to generate a new API Signing RSA key pair? (If you decline you will be asked to supply the path to an existing key.) [Y/n]: y

Enter a directory for your keys to be created [/home/oracle/.oci]:

Enter a name for your key [oci_api_key]:

Public key written to: /home/oracle/.oci/oci_api_key_public.pem

Enter a passphrase for your private key ("N/A" for no passphrase):

Repeat for confirmation:

Private key written to: /home/oracle/.oci/oci_api_key.pem

Fingerprint: aa:3a:ff:d9:c5:10:7a:50:4f:ef:c0:f3:f4:b2:d2:72

Config written to /home/oracle/.oci/config

If you haven't already uploaded your API Signing public key through the

console, follow the instructions on the page linked below in the section

'How to upload the public key':

https://docs.cloud.oracle.com/Content/API/Concepts/apisigningkey.htm#How2

[oracle@vm-test-1 ~]$

Note:- In above code snippets I kept most of the things default. But you can change it according to your environment.

Once you enter these inputs, the CLI will generate the required keys and a config file.

Next, we need to configure it with your OCI credentials.

Step 3: Add the API Key in OCI Console

This part is important.

Now that your CLI generated a public key, you must register it in OCI:

Go to Tokens and Keys, Click on API Keys

Choose Add API Key

Upload the public key generated during the CLI setup

Once added, you will see a fingerprint — keep it noted; it confirms your key is active.

This completes the foundational setup.

Now your VM is ready to communicate with OCI Object Storage securely using the CLI.

In the next steps, I’ll show you how to upload from a public-subnet VM and download into a private-subnet VM using Bastion or direct CLI commands.

Thanks & Regards,

Chandan Tanwani