Create a keystore certificate when client authentication is enabled in the Oracle server. You must create a keystore certificate that contains all the client certificates to establish an Oracle connection.
1Download and install the Oracle client from the Oracle website.
2To create an Oracle wallet, run the following command:
orapki wallet create -wallet <Path where wallet is to be created> -auto_login -pwd <wallet password>
Example:
C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet create -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -auto_login -pwd oracle4u
3To create a self-signed client certificate to the Oracle wallet, run the following command:
orapki wallet add -wallet <Path where wallet is to be created> -dn "CN=<common name>, OU=<organization unit>, O=<organization>, L=<locality>, ST=<state>, C=<country>" -keysize <key size in bits> -self_signed-validity <number of days> -pwd <wallet password>
The command runs and creates the pkcs12 certificate at the specified location.
You must specify the values from the server certificate for CN, OU, O, L, ST, C, keysize, self signed -validity, and pwd.
Example:
C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet add -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -dn "CN=inw1pc07_kriti, OU=DEV, O=infa,L=blr, ST=ka, C=IN" -keysize 2048 -self_signed -validity 3650 -pwd oracle4u
The ewallet.p12 certificate is created in the following location: C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet
4To export the self-signed client certificate, run the following orapki command:
orapki wallet export -wallet <wallet path> -dn "CN=<common name>, OU=<organization unit>, O=<organization>, L=<locality>, ST=<state>, C=<country>" -cert <Name of the exported certificate with path>
The -dn command identifies the client certificate uniquely since the server wallet contains multiple installed client certificates.
Example:
C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet export -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -dn "CN=inw1pc07_kriti, OU=DEV, O=infa,L=blr, ST=ka, C=IN" -cert C:\Users\ksuwalka\Desktop\client_inw1pc07.cert
5Install the self-signed client certificate in the server's Oracle wallet.
Note: The client authentication fails if you do not add the self-signed client certificate to the server database Oracle wallet.
6To add the server certificate as a trusted certificate to the Oracle wallet, run the following command:
orapki wallet add -wallet <wallet path> -trusted_cert -cert <Name of the server certificate with path> -pwd <wallet password>
Note: You must use the same wallet password for all orapki commands.
Example:
C:\app\client\ksuwalka\product\12.1.0\client_1\BIN>orapki wallet add -wallet C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet -trusted_cert -cert C:\SSL\oracle\oratls_server.cert -pwd oracle4u
This enables you to use the keystore C:\app\client\ksuwalka\product\12.1.0\client_1\owm\wallet\ewallet.p12 with keystore password oracle4u.
7To extract the keys from the ewallet.p12 file generated in Step 6, run the following command:
openssl pkcs12 -in ewallet.p12 -nocerts -nodes -out keys.pem -passin pass:<password>
8To extract the certs from the ewallet.p12 file, run the following command:
openssl pkcs12 -in ewallet.p12 -nokeys -out certs.pem -passin pass:<password>
9To combine the keys and certs files into single file named keystore.p12, run the following command:
openssl pkcs12 -export -in certs.pem -inkey keys.pem -out keystore.p12 -name "<aliasName>" -passout pass:<password>
Note: You can use this keystore.p12 file with either the Progress DataDirect Oracle JDBC or Native Oracle JDBC driver.