Oracle Wallet Search Order

Oracle Database provides several routes for finding the wallet on a server in a Transport Layer Security (TLS) environment.

The Oracle Database server retrieves the wallet by searching in these locations, in the following order:

1. Per-PDB wallet under WALLET_ROOT in the init.ora file

   Note that WALLET_ROOT/tls for the CDB root, WALLET_ROOT/pdb_ID/tls for PDB

2. Per-PDB wallet under WALLET_LOCATION in the sqlnet.ora file

   Note that WALLET_LOCATION/tls for the CDB root, WALLET_LOCATION/pdb_ID/tls for PDB

3. WALLET_LOCATION in the sqlnet.ora file

4. $TNS_ADMIN environment variable setting

5. Default wallet location:

   • Linux: /etc/ORACLE/WALLETS/user_name

   • Windows: C:\Users\user_name\ORACLE\WALLETS

The TNS listener retrieves the wallet location by searching in these locations, in the following order:

1. WALLET_LOCATION in the listener.ora file

2. $TNS_ADMIN environment variable setting

3. Default wallet location:

   • Linux: /etc/ORACLE/WALLETS/user_name

   • Windows: C:\Users\user_name\ORACLE\WALLETS

Oracle Database Client retrieves the wallet by searching in these locations, in the following order:

1. Connect string

2. WALLET_LOCATION in the sqlnet.ora file

3. $TNS_ADMIN environment variable setting

4. Default wallet location:

   • Linux: /etc/ORACLE/WALLETS/user_name

   • Windows: C:\Users\user_name\ORACLE\WALLETS

5. System wallets located in the certificate store location. The default certificate store location depends on the platform. For Windows, it is in the Microsoft Certificate Store for Microsoft Windows. For Linux, its locations are as follows:

   • RHEL/Oracle Linux: /etc/pki/tls/cert.pem

   • Debian/Ubuntu/Gentoo: /etc/ssl/certs/ca-certificates.crt

   • Fedora/RHEL: /etc/pki/tls/certs/ca-bundle.crt

   • OpenSUSE: /etc/ssl/ca-bundle.pem

   • OpenELEC: /etc/pki/tls/cacert.pem

   • CentOS/RHEL7: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

   • Alpine Linux: /etc/ssl/cert.pem