DEV Community

umzzil nng
umzzil nng

Posted on Originally published at oraerror.com

Oracle ORA-12650 Error: Causes and Solutions Complete Guide

#oracle #database #dba #sql

ORA-12650: No Common Encryption or Data Integrity Algorithm

ORA-12650 occurs when Oracle Net cannot find a mutually supported encryption or data integrity algorithm between the client and server during the connection negotiation phase. This error is most commonly seen in environments using Oracle Advanced Security Option (ASO) where sqlnet.ora configurations on either side are out of sync. It often surfaces suddenly after a security policy change, Oracle patch, or version upgrade.

Top 3 Causes and Fixes

Cause 1: Mismatched Algorithm Lists in sqlnet.ora

The client and server sqlnet.ora files specify different, non-overlapping algorithm lists, making negotiation impossible.

Server-side sqlnet.ora fix:

-- Server sqlnet.ora
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128)
SQLNET.ENCRYPTION_SERVER = REQUESTED

SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256, SHA1)
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUESTED
Enter fullscreen mode Exit fullscreen mode

Client-side sqlnet.ora fix:

-- Client sqlnet.ora
SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256, AES192, AES128)
SQLNET.ENCRYPTION_CLIENT = REQUESTED

SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256, SHA1)
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUESTED
Enter fullscreen mode Exit fullscreen mode

Verify active session encryption after fix:

-- Check encryption status for the current session
SELECT sid,
       network_service_banner
FROM   v$session_connect_info
WHERE  sid = SYS_CONTEXT('USERENV', 'SID');
Enter fullscreen mode Exit fullscreen mode

Cause 2: REQUIRED vs. REJECTED Parameter Conflict

If one side sets encryption to REQUIRED and the other to REJECTED, the handshake fails immediately. Use REQUESTED or ACCEPTED to allow flexible negotiation.

-- Safe server-side setting
SQLNET.ENCRYPTION_SERVER = ACCEPTED
SQLNET.CRYPTO_CHECKSUM_SERVER = ACCEPTED

-- Safe client-side setting
SQLNET.ENCRYPTION_CLIENT = REQUESTED
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUESTED
Enter fullscreen mode Exit fullscreen mode

Quick compatibility reference:

Server Client Result
REQUIRED REJECTED ❌ Fail
REQUIRED ACCEPTED ✅ Pass
REQUESTED REJECTED ✅ Pass
ACCEPTED REQUESTED ✅ Pass

Cause 3: Legacy Client vs. Modern Server Algorithm Support

Oracle 19c and later deprecated older algorithms (DES, 3DES, MD5). An older client (e.g., 11g) connecting to a modern server may only offer algorithms the server no longer supports.

-- Temporarily add legacy algorithms on server (use as short-term fix only)
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128, 3DES168)
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256, SHA1)

-- Identify outdated clients still connecting
SELECT DISTINCT client_version,
                COUNT(*) AS session_count
FROM   v$session
WHERE  client_version IS NOT NULL
GROUP  BY client_version
ORDER  BY session_count DESC;
Enter fullscreen mode Exit fullscreen mode

Quick Fix Checklist

  1. Compare SQLNET.ENCRYPTION_TYPES_SERVER and SQLNET.ENCRYPTION_TYPES_CLIENT — ensure overlap exists.
  2. Avoid REQUIRED on one side and REJECTED on the other.
  3. Restart the Oracle Listener after any sqlnet.ora change (lsnrctl stop && lsnrctl start).
  4. Upgrade legacy Oracle Clients (11g or older) to a supported version.

Prevention Tips

Standardize sqlnet.ora templates across all environments (dev, test, prod) and store them in version control. Any change must be peer-reviewed for algorithm compatibility before deployment.

Monitor session encryption regularly using the query below to catch unencrypted connections before they become a security incident:

-- Audit encrypted vs. unencrypted sessions
SELECT s.sid,
       s.username,
       s.machine,
       sci.network_service_banner
FROM   v$session s
JOIN   v$session_connect_info sci ON s.sid = sci.sid
WHERE  s.username IS NOT NULL
  AND  sci.network_service_banner LIKE '%Encryption%'
ORDER  BY s.sid;
Enter fullscreen mode Exit fullscreen mode

Related Errors

  • ORA-12660 – Incompatible encryption parameters; often appears alongside ORA-12650.
  • ORA-12659 – Error received from peer during protocol exchange; a downstream effect of failed negotiation.
  • ORA-28865 – SSL connection closed; related when using SSL/TLS-based encryption.

📖 Want a more detailed guide?
Check out the full in-depth version (Korean) on oraerror.com — includes detailed analysis, additional SQL examples, and prevention tips.

Top comments (0)