Skip to main content

Orapki Quick Reference and Usage with wallets

Orapki Quick Reference and Usage with wallets




In this post, I am going to share about orapki which is a command-line tool. You can also use Oracle Wallet Manager(owm) as well, but that is not the scope of this post.

Oracle Wallets:
Wallet is a password-protected container used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL. The wallets it creates can be read by Oracle Database, Oracle Application Servers (OHS) used commonly in EBS when enabling SSL , and the Oracle Identity Management infrastructure.

In Oracle mostly there will be 3 types of wallets

1.Password protected - ewallet.p12
Required password for all operations like display, add,delete

2.Password protected with autologin- ewallet.p12 and  cwallet.sso

Required password for the only add, delete not for display. It can be read by oracle products without a password.

3.Auto_login_only - cwallet.sso

Doesn’t require a password for any operations.



Useful Commands Quick Reference.

Make sure the environment sourced is correct.

Creating and Viewing Oracle Wallets with orapki:

1.password-protected wallet creation:
orapki wallet create -wallet wallet_location

This command will prompt you to enter and re-enter a wallet password. It creates a wallet in the location specified for -wallet.

If you see a command as below 

orapki wallet create -wallet .

This means the wallets files would be created in your present working directly.


2.Password-Protected with auto-login enabled
This command creates a wallet with auto-login enabled, or it can also be used to enable auto-login on an existing wallet. If the wallet_location already contains a wallet, then auto-login will be enabled for it. To disable the auto-login feature, delete cwallet.sso.For wallets with the auto-login feature enabled, you are prompted for a password only for operations that modify the wallet, such as add


3. Autologin wallets:
To create an auto-login wallet (cwallet.sso) that does not need a password, use the following command:
orapki wallet create -wallet wallet_location -auto_login_only

This command creates an auto-login wallet (cwallet.sso) that does not need a password to open. You can also modify or delete the wallet without using a password. File system permissions provide the necessary security for such auto-login wallets.

Example:
orapki wallet create -wallet . -auto_login -pwd apps123

pwd : is a password for wallet

4.To view an Oracle wallet:

orapki wallet display -wallet wallet_location

or 

orapki wallet display -wallet .


5.Modifying the Password for a Wallet:

To change the wallet password, use the following command:

orapki wallet change_pwd -wallet wallet_location [-oldpwd password ] [-newpwd password]

6.How to add private key and certificates generated using openssl?

a.Create Wallet using openssl:

openssl pkcs12 -export -in jaydba_blogspot_com_cert.cer -inkey jaydba_blogspot_com.key -cerfile jaydba_blogspot_com_interm.cer -out ewallet.p12

b.Enable auto login:

orapki wallet create -wallet . -auto_login

7.How to Convert JKS to wallet:

a.create a password protected Oracle wallet with autologin:

orapki wallet create -wallet . -pwd password  -auto_login

b.Migrate the JKS keystore entries to the wallet:

orapki wallet jks_to_pkcs12 -wallet . -pwd password -keystore ./ewallet.jks -jkspwd password

8. Create a self signed certificate and export it

 orapki wallet add -wallet . -pwd apps123  -dn "CN=`hostname`, OU=Example Department, O=Example Company, L=NewYork, ST=US, C=US"  -keysize 2048 -self_signed -validity 365
  
  orapki wallet export -wallet . -dn "CN=`hostname`, OU=Example Department, O=Example Company, L=NewYork, ST=US, C=US" -cert /private/user/orapki_use/root/b64certificate.txt
  
9.  Export a certificate Request from an Oracle wallet:

orapki wallet export -wallet .-dn "CN=`hostname`, OU=Example Department, O=Example Company, L=NewYork, ST=US, C=US"  -request export_cert_server.txt -pwd apps123

10. Export a certificate from an Oracle wallet:

orapki wallet export -wallet . -dn "CN=`hostname`, OU=Example Department, O=Example Company, L=NewYork, ST=US, C=US"  -cert certificate_filename

11. View a certificate

orapki cert display -cert /private/user/orapki_use/server/cert.txt -complete

12. Add a trusted certificate to the wallet

orapki wallet add -wallet . -trusted_cert -cert /private/user/orapki_use/root/b64certificate.txt

13. Add a user certificate to the wallet

orapki wallet add -wallet . -user_cert -cert /private/user/orapki_use/server/cert.txt





If you like please follow and comment
Labels:

Comments

Post a Comment

Popular posts from this blog

WebLogic migration to OCI using WDT tool

WebLogic migration to OCI using WDT tool Oracle WebLogic Deploy Tool (WDT) is an open-source project designed to simplify and streamline the management of Oracle WebLogic Server domains. With WDT, you can export configuration and application files from one WebLogic Server domain and import them into another, making it a highly effective tool for tasks like migrating on-premises WebLogic configurations to Oracle Cloud. This blog outlines a detailed step-by-step process for using WDT to migrate WebLogic resources and configurations. Supported WLS versions Why Use WDT for Migration? When moving Oracle WebLogic resources from an on-premises environment to Oracle Cloud (or another WebLogic Server), WDT provides an efficient and reliable approach to: Discover and export domain configurations and application binaries. Create reusable models and archives for deployment in a target domain. Key Pre-Requisites Source System: An Oracle WebLogic Server with pre-configured resources such as: Applica...
Post a Comment
Read more

How to Validate TDE Wallet Password in Oracle Database

How to Validate TDE Wallet Password in Oracle Database Validating the Transparent Data Encryption (TDE) wallet password is crucial, especially when ensuring that the password is correct without using the OPEN or CLOSE commands in the database. This blog post explains a straightforward method to validate the TDE password using the mkstore utility. Steps to Validate TDE Wallet Password Follow these steps to validate the TDE wallet password: Step 1: Copy the Keystore/Wallet File Navigate to your existing TDE wallet directory. Copy only the ewallet.p12 file to a new directory. If a cwallet.sso file exists, do not copy it . The absence of cwallet.sso ensures that the wallet does not use auto-login, forcing the utility to prompt for the password. Step 2: Validate Using mkstore Use the mkstore utility to check the contents of the wallet file. The mkstore utility will prompt you for the TDE wallet password, allowing you to validate its correctness. Command Syntax To display the conten...
Post a Comment
Read more

Rename a PDB in Oracle Database Multitenant Architecture in TDE and Non TDE Environment

Rename a PDB in Oracle Database Multitenant Architecture I am sharing a step-by-step guide to help you rename a PDB. This approach uses SQL commands. Without TDE or encryption Wallet Initial Check Check the Current Database Name and Open Mode: SQL > SELECT NAME, OPEN_MODE FROM V$DATABASE; NAME OPEN_MODE --------- -------------------- BEECDB READ WRITE List Current PDBs: SQL > SHOW PDBS; CON_ID CON_NAME OPEN MODE RESTRICTED ---------- ------------------------------ ---------- ---------- 2 PDB$SEED READ ONLY NO 3 FUAT READ WRITE NO We need to RENAME FUAT to BEE  Steps to Rename the PDB Step 1: Export ORACLE_SID Set the Oracle SID to the Container Database (CDB): export ORACLE_SID=BEECDB Step 2: Verify Target PDB Name Availability If the target PDB name is different from the current PDB name, ensure no service exists with the target PDB name. Run SQL to Check Exi...
Post a Comment
Read more