Enabling and Troubleshooting Enterprise Manager (EM) Express Console in Oracle Database on OCI

-

In Oracle Database releases including 12.1.0.2, 12.2.0.1, and 18c (18.1.0.0), the Oracle Enterprise Manager (EM) Express Console is not enabled by default. When running database workloads on Oracle Cloud Infrastructure (OCI)—such as Bare Metal, VM, or Exadata DB Systems—enabling EM Express requires configuration across multiple layers: database listener initialization, OS-level firewall updates, OCI Security List rules, and SSL wallet permission fixes. 

 In this guide, we will walk through the complete process of enabling EM Express at the Pluggable Database (PDB) level, configuring network routing on OCI, and fixing the common "Secure Connection Failed" HTTPS wallet error.


1. Network Architecture Flow in OCI

To understand how a client connects to EM Express running inside a Pluggable Database on OCI, examine the architectural packet flow below:

OCI Network Architecture Diagram for Oracle Database EM Express Console on Port 5500
Figure 1: End-to-end packet flow and security rules for accessing EM Express on an OCI DB System.

End-to-End Connection Path:

  • Client Request: The client connects over an approved network route (VPN, FastConnect, or Bastion host).

  • VCN Ingress Filtering: The OCI Security List evaluates incoming traffic on TCP port 5500.

  • OS Firewall: The Linux host-level firewall (firewalld or iptables) allows connection onto port 5500.

  • Oracle XML DB Servlet: Traffic reaches the Database Listener and is handed off to the internal XML DB HTTPS Listener on port 5500 to serve the EM Express Web Console.


2. Step 1: Configuring the Database HTTPS Port

To enable EM Express on a Container Database (CDB) or Pluggable Database (PDB), you must explicitly register the HTTPS port via DBMS_XDB_CONFIG.

Check Initial Listener Status

Log into the Database server as the oracle user and check if the Oracle Listener is listening on port 5500:

lsnrctl status

Initial output will show standard database services, but no entry for (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=...)(PORT=5500))...).





Enable the HTTPS Port at PDB Level

Connect to the target Pluggable Database via SQL*Plus as SYSDBA:

sqlplus / as sysdba



-- Switch to the target Pluggable Database

ALTER SESSION SET CONTAINER = pdb1;


-- Check current HTTPS port (Returns 0 if disabled)

SELECT DBMS_XDB_CONFIG.GETHTTPSPORT() FROM DUAL;


-- Set the HTTPS port to 5500

EXEC DBMS_XDB_CONFIG.SETHTTPSPORT(5500);


-- Confirm the new port assignment

SELECT DBMS_XDB_CONFIG.GETHTTPSPORT() FROM DUAL;


Confirm Listener Endpoint

Return to the terminal shell and verify the listener status:

lsnrctl status

Expected Output Snippet:

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=dbhost.sub00000000.vcn.oraclevcn.com)(PORT=1521)))

STATUS of the LISTENER

----------------------

...

Services Summary...

Service "pdb1.sub00000000.vcn.oraclevcn.com" has 1 instance(s).

  Instance "cdb1", status READY, has 1 handler(s) for this service...

Endpoint Summary...

  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=dbhost.sub00000000.vcn.oraclevcn.com)(PORT=5500))(FullServName)(Server=http/javax.xml.xdb.HTTPServer))

The command completed successfully


3. Step 2: Opening OS-Level Host Firewall Port

On OCI DB Systems, host-level security mechanisms (firewalld or iptables) block non-standard incoming ports by default.

For firewalld (RHEL 7 / Oracle Linux 7 & 8):

# Add port 5500 to the active firewall zone
sudo firewall-cmd --permanent --add-port=5500/tcp
sudo firewall-cmd --reload

# Verify port is open
sudo firewall-cmd --list-ports

For iptables (Oracle Linux 6 / Custom Images):

# Insert rule to allow incoming TCP traffic on port 5500
sudo iptables -I INPUT -p tcp --dport 5500 -j ACCEPT
sudo service iptables save



4. Step 3: Configuring OCI VCN Security List

Once the host firewall allows port 5500, you must permit traffic at the OCI Virtual Cloud Network (VCN) level.

  • Log into the Oracle Cloud Infrastructure Console.

  • Open the Navigation Menu -> Oracle Database -> Bare Metal, VM, and Exadata.

  • Select your Compartment and locate your target DB System.

  • Click on the DB System's Subnet link to navigate to the Subnet Details page.

  • Under Security Lists, click the active Security List associated with the subnet.

  • Click Add Ingress Rules and configure the rule

    • Source Type: CIDR

    • Source CIDR: Enter your client subnet CIDR block (e.g., 10.0.0.0/16 or approved VPN block). Avoid using 0.0.0.0/0 unless required for explicit public access.

    • IP Protocol: TCP

    • Destination Port Range: 5500

    • Description: Allow inbound EM Express HTTPS access

  • Click Add Ingress Rules.

5. Troubleshooting: Fixing "Secure Connection Failed" (Wallet Permissions)

In 1-node DB Systems on OCI, accessing EM Express via browser (https://<DB_HOST_IP>:5500/em) often returns a browser error: Secure Connection Failed or ERR_SSL_PROTOCOL_ERROR.

Root Cause

This occurs when the Oracle XML DB engine attempts to load the SSL/TLS Auto-Login Wallet from the database server directory, but strict OS file permissions prevent the Oracle process from reading the wallet files.

Step-by-Step Fix:

#1. Locate the XDB Encryption Wallet Directory:

Connect via SQL*Plus as SYSDBA to query the wallet path:

sqlplus / as sysdba

SELECT W.WALLET_LOCATION 
FROM V$ENCRYPTION_WALLET W;

Typically points to: /var/opt/oracle/dcs/common/dbs/ or $ORACLE_BASE/admin/$ORACLE_SID/xdb_wallet.


#2. Check Wallet Directory Permissions at OS Level:

Navigate to the directory as the oracle user:

cd /var/opt/oracle/dcs/common/dbs/xdb_wallet

ls -la


#3. Grant Correct Read Permissions:

Ensure the oracle OS user and oinstall group own the wallet files and possess read/write permissions:

# Change ownership to oracle:oinstall

sudo chown -R oracle:oinstall /var/opt/oracle/dcs/common/dbs/xdb_wallet


# Grant read/write permissions for the wallet

chmod 600 cwallet.sso p12wallet.pkcs12

chmod 700 /var/opt/oracle/dcs/common/dbs/xdb_wallet



#4. Bounce the Listener and Restart EM Express Port:

Restart the listener to reload the SSL wallet context:

lsnrctl reload


6. Verification & Access

  1. Open a web browser from a host connected to your approved network path (VPN/Bastion).

  2. Navigate to the EM Express URL:
    • https://<DB_System_IP_or_Hostname>:5500/em
  3. Enter your database credentials:

    1. Username: SYS (or SYSTEM)

    2. Password: <Your_SYS_Password>

    3. Container Name: pdb1 (or your target PDB name)


You should now successfully land on the Oracle Enterprise Manager Database Express dashboard.



References & Further Reading



****************************நன்றி****************************




Comments

Post a Comment

Popular posts from this blog

Common R12.2 adcfgclone Issues

-
ERROR: Failed to configure the target system – Failed to enable EBS_LOGON trigger The clone procedure for EBS R12.2 is quite different when compared with EBS R12.1. This post covers very generic   issues we may encounter while configuring the target server as a part of clone Process. ERROR : 1 Checking the port pool 6 done: Port Pool 6 is free Report file located at /u01/appl_PROD/PROD/fs2/inst/apps/PRODERP_erpnode3/admin/out/portpool.lst The new APPL_TOP context file has been created : /u01/appl_PROD/PROD/fs2/inst/apps/PRODERP_erpnode3/appl/admin/PRODERP_erpnode3.xml Check Clone Context logfile /u01/appl_PROD/PROD/fs1/EBSapps/comn/clone/bin/CloneContextPatch_0811105848.log for details. FMW Pre-requisite check log file location : /u01/appl_PROD/PROD/fs1/EBSapps/comn/clone/FMW/logs/prereqcheck.log Running: FMW pre-req check... ERROR: Run file system configuration has failed Check the logfile /u01/appl_PROD/PROD/fs1/inst/apps/PRODERP_erpnode3/admin/l...
Read more

REP-3000: Internal error starting Oracle Toolkit

-
Image
Resolving "REP-3000: Internal error starting Oracle Toolkit" in Oracle EBS (11i / R12) When running concurrent programs in Oracle E-Business Suite (EBS) that produce PDF , PostScript , or HTML  output, DBAs frequently encounter the infamous runtime exception: ' REP-3000: Internal error starting Oracle Toolkit' .   This issue is notorious for disrupting the Output Post-Processor (OPP)  and concurrent manager operations across both Linux and UNIX platforms. In this post, we will examine the architectural reason behind the REP-3000 error, walk through testing the OS-level X11 display environment, update the EBS Context File, and ensure persistent display settings across AutoConfig executions.  1. Understanding the Cause: Why Does Oracle Reports Need a DISPLAY Variable? The core engine responsible for generating character-based, PDF, or PostScript reports in legacy Oracle Developer / Oracle Reports (such as ' rwrun'  or ' rwserver' ) relies on Oracle Toolk...
Read more

Error 404 -- Not Found From RFC 2068 hypertext Transfer Protocol -- HTTP/1.1

-
Image
In my environment we are having EBS(12.2.5) running with 12.1.0.2 database. One day in our DEV Instance  Front-End is not opening and faced the below error. So I followed the below steps as a solution and it worked. First, generate the JAR files Next, reload the generated jar files to the respective database  Now compile the APPS schema to reduce the count of Invalid objects. Once everything completed, you can clear your browser cache and try to login to the application., but normally the above steps will be accompanied by clearing the middle tier cache. So I gave the below steps to clear the middle tier cache from backend. To clear the cache, follow the below steps. Stop the application services Navigate to $OA_HTML/cabo/images/cache Take a backup of contents of the folder cache and then clear all the contents inside that cache folder Navigate to $OA_HTML/cabo/styles/cache Take a backup of contents of the folder ca...
Read more