如何解决node-oracledb连接AWS RDS Oracle时的NJS-505 TLS连接错误

问题现象 #

使用orapki创建Oracle钱包并导入信任库证书后，通过node-oracledb连接AWS RDS Oracle数据库时出现以下错误：

[2024-11-07T13:31:04.692] [ERROR] oracleDBWrapper - Error: NJS-505: unable to initiate TLS connection. Please check if wallet credentials are valid
    at Object.throwErr (/home/node/node_modules/oracledb/lib/errors.js:603:10)
    at NTTCP.connect (/home/node/node_modules/oracledb/lib/thin/sqlnet/ntTcp.js:237:18)
    at async NetworkSession.transportConnect (/home/node/node_modules/oracledb/lib/thin/sqlnet/networkSession.js:173:5)
    at async NetworkSession.connect2 (/home/node/node_modules/oracledb/lib/thin/sqlnet/networkSession.js:211:7)
    at async NetworkSession.connect1 (/home/node/node_modules/oracledb/lib/thin/sqlnet/networkSession.js:314:23)
    at async NetworkSession.connect (/home/node/node_modules/oracledb/lib/thin/sqlnet/networkSession.js:530:5)
    at async ThinConnectionImpl.connect (/home/node/node_modules/oracledb/lib/thin/connection.js:628:5)
    at async ThinPoolImpl.bgThreadFunc (/home/node/node_modules/oracledb/lib/thin/pool.js:420:11) {
  code: 'NJS-505'
}

但使用同一钱包通过sqlplus可正常连接，说明钱包本身无问题。给ntTcp.js添加日志后，发现底层错误为：

Error: error:0909006C:PEM routines:get_name:no start line
    at setKey (node:internal/tls/secure-context:92:11)
    at configSecureContext (node:internal/tls/secure-context:174:7)
    at Object.createSecureContext (node:_tls_common:121:3)
    at NTTCP.connect 

解决方案 #

• 升级node-oracledb版本：旧版本的thin模式在处理Oracle Wallet时可能存在兼容性问题，升级到最新稳定版可修复部分格式解析bug
• 转换钱包格式：Oracle Wallet默认可能是SSO格式，node-oracledb的thin模式对PKCS#12格式的支持更稳定。使用orapki转换格式：

  orapki wallet convert -wallet /path/to/your/wallet -to pkcs12 -pwd your_wallet_password
  

  转换后在连接配置中指定PKCS#12文件路径，并添加密码参数：

  const connection = await oracledb.getConnection({
    user: 'your_user',
    password: 'your_password',
    connectString: 'your_rds_connect_string',
    walletLocation: '/path/to/converted/wallet.p12',
    walletPassword: 'your_wallet_password'
  });
  

• 验证证书格式：检查导入钱包的证书是否为PEM格式。如果是DER格式，先转换为PEM再重新导入：

  openssl x509 -inform der -in cert.cer -out cert.pem
  

  再用orapki将PEM证书导入钱包：

  orapki wallet add -wallet /path/to/wallet -trusted_cert -cert cert.pem -pwd your_wallet_password
  

• 检查连接配置：确保walletLocation指向正确的钱包目录（或PKCS#12文件），路径无权限问题，node进程能读取该路径下的文件

内容的提问来源于stack exchange，提问作者morrrowgi