Download Oracle Patches using autoupgrade.jar

Downloading Oracle Patches with AutoUpgrade on Windows Behind a Proxy

Oracle AutoUpgrade continues to evolve with each new release, introducing powerful new features that simplify database maintenance tasks. While it doesn’t yet support rolling patching for RAC databases and Grid software, it’s a highly reliable tool for single-instance environments patch management. Oracle recommends that you use Oracle Fleet Patching and Provisioning to be able to obtain rolling patch maintenance for Oracle Real Application Clusters (Oracle RAC) environments. For a detailed walkthrough on implementing Fleet Patching, you may refer to my earlier blog posts: How to Patch Grid Using Fleet Patching and How to Patch Database Using Fleet Patching. You may also use Ansible playbooks for automating patching process.

In this blog post, I’ll walk you through a straightforward method for downloading Oracle patches using AutoUpgrade on a Windows host that connects to the internet through a proxy requiring username/password authentication. While the official documentation and most examples primarily focus on Linux environments, it’s important to note that although our database servers typically run on Linux, many administrators and clients work daily from Windows systems. This guide is intended to bridge that gap for such setups.

For environments without proxy requirements, downloading patches using autoupgrade.jar is typically seamless. In that case, I recommend referring to Rodrigo’s post: Downloading Oracle Patches using CLI with AutoUpgrade Patching.

Make sure that you have Java 8 or 11 installed on your client host. You may download them for links provided below.

In this example, insanedba is the proxy username, myproxypass is the corresponding password, myproxyserver.tr is the proxy server, and 8080 is the port used for the connection. From now on, we will work on command prompt (CMD), start CMD with admin privileges by running it as administrator.

If your https_proxy environment variable is configured correctly, you should be able to successfully download the latest version using the Command provided below. If the download fails at this stage, double-check that your https_proxy variable is set correctly and includes the proper credentials and format.

Alternatively, you can use curl command flags to specify proxy settings without directly setting the https_proxy environment variable. However, at later stages, you will still need to configure the https_proxy variable properly for autoupgrade.jar to successfully download the patches.

In this example, I will download the patches for the LINUX.X64 platform, even though I’m working on a Windows host. Pay close attention to the parameters used here. For the sole purpose of downloading patches, you do not need to specify a credentials directory (e.g., wincredential), a target Oracle SID (e.g., patch1.sid), or source/target Oracle Database homes (e.g., patch1.source_home, etc.). In fact, the simpler your setup, the better.

In this example, I will download the 19.27 Release Update, the Data Pump Bundle Patch, the Monthly Recommended Patch, the latest OPatch utility, the OJVM patch for 19.27, and a sample one-off patch (34672698).

Although AutoUpgrade can not patch Oracle Grid Infrastructure yet, it can still download the Oracle Clusterware (OCW) patch if the OCW option is included in the patch list.

You may also take a look at Marcus Vinicius’ AutoUpgrade Composer to help prepare your config file.

To allow your Java application (autoupgrade.jar) to trust an SSL connection (e.g., for HTTPS), you must import the necessary SSL certificates into the Java truststore.

For this reason, when downloading patches directly from My Oracle Support (MOS), the public root certificates of Certificate Authorities (CAs) should be added to the Java cacerts truststore. Otherwise you will get the error recorded below. You may also refer to Autoupgrade Patching Fails To Download Patches With Error “Unable To Find Valid Certification Path” (Doc ID 3082396.1)

To determine which certificates should be imported into the Java truststore, you can use a web browser such as Chrome or Edge. In my environment, when I navigate to https://updates.oracle.com and inspect the certificate, I see that my proxy server’s certificate appears as the root certificate. This indicates that I need to import my proxy server’s certificate into the Java truststore.

Alternatively, you can also use OpenSSL to inspect and retrieve the certificate chain from the server. I will use openssl client that ships with GIT Bash.

In this example, when accessing updates.oracle.com, the server’s certificate is displayed in the browser, but the root certificate is not explicitly shown. However, it is listed by its Common Name (CN). This certificate is actually available in the Windows Certificate Store, as it has been distributed via group policy.

Since this certificate is not available in the Java truststore, we need to export it from the Windows Certificate Store and then import it into the Java truststore. Below command is the one I used to export the certificate:

Now, we will import the certificate into the Java truststore. The storepass attribute provided here (changeit – default password) is the password for the Java truststore, make sure to remember it, as it will be required during the download step (Step 8).

The first time you use AutoUpgrade to download patches, you need to store your My Oracle Support (MOS) credentials in the AutoUpgrade keystore.

To do this, we will use the configuration file we prepared earlier in Step 5. This file must include the global.keystore parameter, which specifies the location where AutoUpgrade will store the keystore. After creating the config file, we will run autoupgrade.jar with the load_password flag. This command launches an interactive console that allows passwords to be securely loaded into AutoUpgrade’s keystore.

The first password we will provide is the keystore password, followed by our My Oracle Support (MOS) username and password.

You must set your https_proxy variable in advance, as mentioned in Step 2. Otherwise, the connection to My Oracle Support (MOS) will fail with Connection timed out: connect.
Additionally, ensure that your machine can access the following URLs without issues such as firewall restrictions.

If all is good. You may create autoupgrade keystore.

Our keystore is now ready, and our My Oracle Support (MOS) credentials have been securely stored within it.

If you encounter the following error while converting the AutoUpgrade patching keystore to auto-login; then proceed without converting by replying with NO.

The final step is to download the patches from Oracle. We’ll use the AutoUpgrade -mode download command as shown below.

Since we are behind a proxy server, we must include java trustStore parameters directly in the command. AutoUpgrade will download all patches listed in the patch section of your get-config.cfg file into the directory specified by patch1.folder.

At this stage, the command failed in my environment, even though everything had been done correctly.

The error logs indicated the following message: No enum constant oracle.commons.aru.search.patch_status.AVAİLABLE . This pointed to a possible language-related issue. Specifically, the uppercase ‘İ’ used in “AVAİLABLE” is a character from the Turkish alphabet and does not exist in English. Although autoupgrade.jar initially prints: Unsupported language [tr], defaulting to English, it still seems to struggle with character encoding behind the scenes. I will provide the workaround solution. Actually AutoUpgrade Never Fails, But When It does; you may also refer to Daniel’s post for guidance on how to prepare a diagnostic package for troubleshooting which will be used while opening an Service Request on My Oracle Support.

Workaround : Change your Windows Client display language to English.

The good news is that I reached out to Daniel Overby Hansen, Product Manager from Oracle’s Upgrade Team, and shared my findings with him. Impressively, it took the team less than 12 hours to reproduce the issue and prepare a fix. I have already tested the fix. This level of responsiveness was truly appreciated and the solution is expected to be included in the next release of autoupgrade.jar.

In my next post, I’ll demonstrate how to use AutoUpgrade for database upgrade patching in offline environments.

Hope it helps.


Discover More from Osman DİNÇ


Comments

Leave your comment