Managing Oracle AI Database Wallets and Certificates

You can use the orapki command line utility and sqlnet.ora parameters to manage public key infrastructure (PKI) elements.

Introduction to Oracle Database Wallets and Certificates

Oracle Database provides several types of public key infrastructure (PKI) elements (wallets and certificates), as well as tools to manage them.

About Oracle Database Wallets

An Oracle Database wallet is a password-protected container that stores authentication and signing credentials, including private keys and certificates that enable database clients to communicate across an Oracle Database network.

The authentication and signing credentials in a wallet are encrypted. Oracle Database clients can read and use wallets when the client connects to the database server. The database server can also read and use wallets when it connects with other services such as directory services. Before a wallet can be used, it must be “open”, that is, made accessible by the database server that must read and use the wallet. Depending on how the wallet is created, the wallet must be either opened manually by a database administrator or it can be opened automatically.

Oracle Database provides the following use cases for wallet use:

There are four types (or modes) of wallets: standard password-protected wallet (PKCS#12, which have the .p12 file extension), and three types of auto-login wallets.

All wallets that you create in this release of Oracle Database are in the PKCS#12 format. You can include the following security objects in a wallet:

Related Topics

About Oracle Database Certificates

An Oracle Database certificate (public key infrastructure (PKI) digital certificate) is a wallet component that validates the identity of an end entity in a public key or private key exchange that uses the wallet.

The certificate is an International Telecommunications Union (ITU) x.509 v3 standard data structure that securely binds an identity to a public key. It is created when the public key of an entity is signed by a trusted identity, a certificate authority (CA). The certificate ensures that information in the entity is correct, and that the public key belongs to that entity. A certificate contains the name of the entity, identifying information, expiration date, and a public key. It is also likely to contain a serial number and information about the rights, uses, and privileges associated with the certificate. Finally, it contains information about the CA that issued it.

Oracle Database enables you to configure and work with the following types of certificates:

Following are some of the PKI elements that are related to certificates:

Related Topics

About Certificate Authority (CA)

A certificate authority (CA) is a trusted third party that certifies that other entities-users, databases, administrators, clients, servers-are who they say they are.

When it certifies a user, the CA first seeks verification that the user is not on the certificate revocation list (CRL), then verifies the user’s identity and grants a certificate, signing it with the certificate authority’s private key. The CA has its own certificate and public key which it publishes. Servers and clients use these to verify signatures the certificate authority has made. A CA might be an external company that offers certificate services, or an internal organization such as a corporate management information systems (MIS) department. You must send the certificate request to this CA. The CA will send you a signed user certificate and its associated trusted certificate.

Tools Used to Manage Oracle AI Database Wallets and Certificates

Oracle AI Database provides different tools for managing wallets and certificates, depending on how the wallet will be used.

Related Topics

General Process of Managing Oracle Database Wallets and Certificates

Except for Transparent Data Encryption (TDE), you can use the orapki utility to create and manage Oracle Database wallets and certificates.

The general process is as follows:

  1. Use the orapki wallet create command to create the wallet.

    For example, to create the wallet in the $ORACLE_HOME/admin/db_unique_name/wallet directory:

    orapki wallet create -wallet $ORACLE_HOME/admin/db_unique_name/wallet

  2. Use the orapki wallet add command to generate a certificate request to associate with the wallet.

    For example, for a DN named CN=server_dn,C=US, using a key size of 2048 bits:

    orapki wallet add -wallet $ORACLE_HOME/admin/db_unique_name/wallet

-dn 'CN=server_dn,C=US'

-keySize 2048

  3. After the certificate request is generated, send it to the certificate authority (CA) that you want to use.

    You can export the certificate request to a file by using the orapki wallet export command, and share that file with CA to get a signed certificate.

    For example, to export a request called creq.txt:

    orapki wallet export -wallet $ORACLE_HOME/admin/db_unique_name/wallet

-dn 'CN=server_dn,C=US'

-request $ORACLE_HOME/admin/db_unique_name/wallet/creq.txt

  4. The CA generates your signed user certificate and its associated trusted certificate. At this stage, you are ready to start importing certificates into the wallet.

  5. Use the orapki wallet add command to import all the trusted certificates into the wallet.

    If you do not add all the trusted certificates, then the orapki add command will fail.

    For example, to add a trusted certificate trusted_cert.txt to the wallet:

    orapki wallet add -wallet $ORACLE_HOME/admin/db_unique_name/wallet

-trusted_cert -cert $ORACLE_HOME/wallet/trusted_cert.txt

  6. Use the orapki wallet add command to import the user certificate into the wallet.

    For example, to import a user certificate that is in the cert.txt file:

    orapki wallet add -wallet $ORACLE_HOME/admin/db_unique_name/wallet/ewallet.p12

-user_cert

-cert $ORACLE_HOME/wallet/cert.txt

Oracle Database Wallet Search Order

The search order that Oracle AI Database uses to find wallets depends on the feature for which the wallet was created, such as Transparent Data Encryption (TDE).

The Oracle AI Database listener uses the following search path for the wallet, in this order:

  1. WALLET_LOCATION parameter setting in connect string

  2. WALLET_LOCATION parameter setting in the sqlnet.ora file

  3. Wallet in the $TNS_ADMIN environment variable setting

The default wallet locations are as follows:

See the following topics for information about various search orders for wallets:

Managing Oracle Database Wallets and Certificates with the orapki Utility

The orapki command-line utility is installed by default with the Oracle Database server.

About Managing Oracle Database Wallets and Certificates with the orapki Utility

The orapki command-line utility enables you to create and manage wallets and certificates from the command line.

You can use orapki to perform the following tasks:

orapki enables you to automate these tasks by using scripts. Providing a way to incorporate the management of wallets, certificates, and certificate revocation lists (CRLs) into scripts makes it possible to automate many of the routine tasks of maintaining them.

You can use the orapki utility wallet module commands in scripts to automate the wallet creation process. For example, you can create password-protected wallets, auto-login wallets, auto-login-only wallets, or local auto-login wallets. You can create local auto-login wallets that are associated with PKCS#12 wallets that are local to the computer on which they were created and the user who created them. You can view wallets, import wallets, modify wallet passwords, and convert wallets to use the AES256 algorithm.

When you create a new wallet (any type), Oracle creates it as a version 6 wallet. If you modify an existing LSSO version 6 wallet, then orapki converts it to version 7. Oracle has introduced a new auto-login wallet version (7) with Oracle AI Database 26ai. Version 6 of the Oracle local auto-login wallet is deprecated.

Note: The -wallet parameter is mandatory for all wallet module commands.

Related Topics

orapki Utility Syntax

The orapki utility syntax provides ways to create and manage wallets and certificates.

The syntax of the orapki command-line utility is as follows:

orapki module command -parameter value

In this specification, module can be wallet (Oracle wallet), crl (certificate revocation list), cert (PKI digital certificate), or secretstore (secrets and credentials). The available commands depend on the module you are using.

For example, if you are working with a wallet, then you can add a certificate or a key to the wallet with the add command. The following example adds the user certificate located at /private/lhale/cert.txt to the wallet located at $ORACLE_HOME/admin/db_unique_name/wallet/ewallet.p12:

orapki wallet add -wallet $ORACLE_HOME/admin/db_unique_name/wallet/ewallet.p12 -user_cert -cert /private/lhale/cert.txt

Managing Oracle Database Wallets

The orapki command-line utility enables you to create and manage wallets before you add certificates to them.

Creating a PKCS#12 Wallet

You can use the orapki utility to create a PKCS#12 Oracle wallet.

To create an Oracle PKCS#12 wallet (ewallet.p12), use the orapki wallet create command.

<pre class="copy"><code>orapki wallet create -wallet wallet_file_directory [-pwd password]</code></pre>

In this specification:

Importing a PKCS#12 Wallet

You can use the orapki utility to import a PKCS#12 file into an existing wallet.

To import an Oracle PKCS#12 wallet (ewallet.p12), use the orapki wallet import_pkcs12 command.

<pre class="copy"><code>orapki wallet import_pkcs12 -wallet wallet_file_directory [[-pwd password] | [-auto_login_only]] [-pkcs12file pkcs12_location] [-pkcs12pwd pkcs12_password]</code></pre>

In this specification:

Creating an Auto-Login-Only Wallet

You can use the orapki utility to create an auto-login only wallet.

To create an auto-login only wallet (cwallet.sso), which does not need a password to open the wallet, use the orapki wallet create command.

<pre class="copy"><code>orapki wallet create -wallet wallet_file_directory -auto_login_only</code></pre>

Note the following:

Creating a Local Auto-Login Wallet

The orapki utility can create a local auto-login wallet.

Oracle has introduced a new auto-login wallet version (7) with Oracle AI Database 26ai. Version 6 of the Oracle local auto-login wallet is deprecated.

To create a local auto-login wallet that is local to both the computer on which it is created and the user who created it, use the orapki wallet create command.

<pre class="copy"><code>orapki wallet create -wallet wallet_file_directory -auto_login_local [-pwd wallet_password]</code></pre>

In this specification, pwd is the password that was created when the PKCS#12 wallet was created. If no password is provided, then you are prompted to enter and reenter the new password. For better security, enter the password at the prompt instead of entering it at the command line.

This command does the following:

Creating an Auto-Login Wallet That Is Associated with a PKCS#12 Wallet

You can create an auto-login wallet that is associated with a PKCS#12 wallet.

To create an auto-login wallet (cwallet.sso) that is associated with a PKCS#12 wallet (ewallet.p12), use the orapki wallet create command.

orapki wallet create -wallet wallet_file_directory -auto_login [-pwd wallet_password]

In this specification,

Note that the auto-login wallet does not need a password to open; it automatically uses the password of its associated PKCS#12 wallet. Therefore, you must supply the password for the associated PKCS#12 wallet to modify or delete the auto-login wallet. Any update to the PKCS#12 wallet also updates the associated auto-login wallet.

Viewing a Wallet

You can use the orapki utility to view a wallet.

This command displays the certificate requests, user certificates, trusted certificates, secret store entries, and credentials that are contained in the wallet.

To view an Oracle wallet, use the orapki wallet display command.

orapki wallet display -wallet wallet_file_directory

Output similar to the following appears:

Requested Certificates:
User Certificates:
Trusted Certificates:

Modifying the Password for a Wallet

You can use the orapki utility to modify the password of a wallet.

When you change the password of an auto-login wallet, and if that wallet is version 6, then Oracle Database automatically updates the wallet to version 7.

  1. Use the orapki wallet change_pwd command to change the password.

    orapki wallet change_pwd -wallet wallet_file_directory [-oldpwd wallet_password ] [-newpwd wallet_password]

    This command changes the current wallet password to the new password. The command prompts you for the old and new passwords if no password is supplied at the command line. Change the password using the following requirements:

    • Use no fewer than 8 characters. The maximum length is unlimited.

    • Use mixed alphanumeric characters.

  2. If this wallet uses an auto-login only wallet, then regenerate the auto-login only wallet.

    orapki wallet create -wallet wallet_file_directory -auto_login_only

Converting an Oracle Wallet to Use the AES256 Algorithm

By default, an Oracle wallet that was created with the ADMINISTER KEY MANAGEMENT or ALTER SYSTEM statement is encrypted with AES256.

If you are using an older wallet that is encrypted with 3DES instead of AES256, then you can use the orapki convert command to convert the wallet to use the AES256 algorithm, which is stronger than 3DES. Oracle wallets that are created with orapki are created with the AES256 algorithm by default.

Be aware that though the AES256 algorithm is stronger than 3DES, there will be some degradation in orapki operations if you use AES256.

To change the wallet algorithm from 3DES to AES256, use the orapki wallet convert command.

orapki wallet convert -wallet wallet_file_directory [-pwd wallet_password] -compat_v12

In this specification:

You can check if the wallet has been converted from 3DES to AES356 by running the openssl pkcs12 command. For example:

openssl pkcs12 -in sample/ewallet.p12 -info
Enter Import Password: password

Output similar to the following appears. The AES-256-CBC value in the last line confirms that the wallet is encrypted with AES256.

MAC: sha1, Iteration 10000
MAC length: 20, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 10000, PRF hmacWithSHA256

Copying a Wallet to an ASM Disk Group

You can store an Oracle wallet in an Oracle Automatic Storage Management (Oracle ASM) disk group.

  1. Create the wallet using one of the preceding methods.

  2. Start the Automatic Storage Management Command-Line (ASMCMD).

    asmcmd

  3. Copy the wallet files to the ASM disk group. For example:

    kscopy /home/oracle/wallets/tls_wallet/cwallet.sso +HMDG/TLS

Deleting a Wallet

You can delete wallets, but be cautious when doing so. Deleting a wallet that is in use can problems with the Oracle Database environment.

  1. Check the wallet contents to ensure that it is safe to delete it.

    It is important to check a wallet’s contents because some wallets may have additional information that you were not aware of that is being used by the database. Use the following orapki command to check the contents of the wallet:

    orapki wallet display -wallet wallet_file_directory

  2. Back up the wallet in case you may need it again.

    You should be able to easily recreate the wallet if it is needed again.

  3. Delete the wallet.

    The following example deletes a password-protected wallet:

    orapki wallet delete -wallet $ORACLE_HOME/admin/db_unique_name/wallet
Enter password: wallet_password

    To delete an auto-login wallet, include the -sso parameter:

    orapki wallet delete -wallet $ORACLE_HOME/admin/db_unique_name/wallet -sso
Enter password: wallet_password

If you want to delete Transparent Data Encryption keystores, then see Oracle AI Database Advanced Security Guide for information about the dangers of deleting keystores.

Managing Oracle Database Certificates

After you create a wallet, you can associate certificates with it to validate the identities of entities that are associated with the wallet.

Certificate Store Location for System Wallets

System wallets are located in the certificate store location.

The default certificate store location depends on the platform. For Microsoft Windows, it is in the Microsoft Certificate Store for Microsoft Windows. For Linux, its locations are as follows:

If the certificate authority (CA) is not in any of these locations, then you can create a symlink /etc/pki/tls/cert.pem pointing to the CA certificate file. Only PEM-formatted certificates are supported in all of the system certificate store locations.

Adding a Certificate Request to an Oracle Wallet

You can use the orapki utility to add certificate requests to Oracle wallets.

To add a certificate request to an Oracle wallet, use the orapki wallet add command.

<pre class="copy"><code>orapki wallet add -wallet wallet_file_directory -dn user_dn -keySize 512\|768\|1024\|2048\|4096\|8192\|16384</code></pre>

In this specification:

Parameter Description
wallet Specifies the location of the wallet to which you want to add a certificate request.
dn Specifies the distinguished name of the certificate to add.
keySize This parameter only applies to certificates with the asym_alg parameter set to RSA. Specifies the key size in bits for the certificate. The size that you enter indicates the strength of security for the certificate. Values are as follows: 512: Included for backward compatibility and is supported in non-FIPS mode
768: Supported in non-FIPS mode
1024: Current default for non-FIPS certificate keys and is supported in non-FIPS mode
2048: Current default for FIPS certificate keys
4096: As needed per your site’s requirements
8192: As needed per your site’s requirements
16384: As needed per your site’s requirements

To sign the request, export it with the orapki wallet export command.

Related Topics

Creating Signed Certificates

The orapki utility provides a way to sign user certificate requests by an intermediate or root key.

In most cases, this command is used to create a signed certificate for testing purposes, but it can be used for other reasons as well. It creates a signed certificate from the certificate request. A self-signed certificate is not issued or signed by a Certificate Authority (CA).

To create a signed certificate, use the orapki cert create command.

orapki cert create [-wallet wallet_file_directory] -request certificate_request_location -cert certificate_file -validity number_of_days [-pwd wallet_password] [-cert_validation_mode strict|non-strict]

In this specification:

Creating a Signed Certificate Using a Self-Signed Root

This certificates creation method involves the use of an Oracle wallet with self signed certificate.

Using a certificate signed by a public Certificate Authority (CA) simplifies TLS connections because the root trust certificate for the database server is most likely already available in the default trust store on clients.

  1. Create a wallet and add a self-signed root certificate to this wallet.

    1. Create the wallet as follows:

      Create the wallet in its own directory (for example, wallet1) under the wallet directory structure

      orapki wallet create -wallet wallet_file_directory/wallet1 -pwd wallet_password -auto_login

      The default algorithm is AES256.

    2. Add a self-signed certificate to this wallet.

      For example:

      orapki wallet add -wallet wallet_file_directory/wallet1

-dn 'CN=sales.us.example.com, O=Oracle, L=Reading, ST=Texas,
C=US' -self_signed -validity 3650 -keysize 2048 -sign_alg sha256

-pwd wallet_password

  2. Create a second wallet in its own directory (for example, wallet2) for the certificate.

    orapki wallet create -wallet wallet_file_directory/wallet2 -pwd wallet_password

-auto_login

  3. Add a certificate request to this second wallet and export it into a file.

    orapki wallet add -wallet wallet_file_directory/wallet2

-dn 'CN=server_test,C=US' -keysize 2048 -pwd wallet_password

orapki wallet export -wallet wallet_file_directory/wallet2

-dn 'CN=server_test,C=US' -request creq.txt -pwd wallet_password

  4. Use the first wallet with a self-signed root key to sign the certificate request creq.txt.

    The option -sign_alg sha256 setting to specifies the SHA-2 algorithm. The file usercert.txt file will contain the SHA-2 certificate.

    orapki cert create -wallet wallet_file_directory/wallet1

-request wallet_file_directory/wallet2/creq.txt -cert wallet_file_directory/wallet2/usercert.txt

-sign_alg sha256 -validity 3650

  5. Verify that the user certificate has been created with SHA-2 algorithm.

    openssl x509 -in  wallet_file_directory/wallet2/usercert.txt -text

    Output similar to the following appears:

    Certificate:
Data:
Version: 1 (0x0)
Serial Number: 0 (0x0)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Texas, L=Reading, O=Oracle,
sales.us.example.com
Validity
Not Before: Aug 5 06:50:44 2023 GMT
Not After : Aug 2 06:50:44 2027 GMT
Subject: C=US, CN=server_test
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
00:b0:36:ba:33:86:9f:f2:03:c0:13:b5:a2:99:09:

...

oU6jgrYfZkxcMMZMhnWKCpNBdA==

-----END CERTIFICATE-----

  6. Export the self-signed certificate from the first wallet and import it as a trusted certificate into the second wallet.

    To add the signed certificate into the original (second wallet), first you must import the root trust certificate and any intermediate trust certificates in hierarchical order before you can add the newly signed user certificate. This example uses the root private key to sign the user certificate, so you just need to export the self-signed root certificate from the first wallet and then import it as a trusted certificate into the second wallet.

    orapki wallet export -wallet wallet_file_directory/wallet1

-dn 'CN=sales.us.example.com, O=Oracle, L=Reading, ST=Texas, C=US'

-cert self_cert.crt

orapki wallet add -wallet wallet_file_directory/wallet2 -trusted_cert -cert
/wallet_file_directory/wallet1/self_cert.crt -pwd wallet_password

  7. Import the certificate file usercert.txt into the second wallet.

    orapki wallet add -wallet wallet_file_directory/wallet2 -user_cert

-cert wallet_file_directory/wallet2/usercert.txt

-sign_alg sha256 -pwd wallet_password

  8. In the domain for the wallet and certificate, display the wallet to confirm.

    [sales]wallet_file_directory/wallet2> orapki
wallet display -wallet .

    Output similar to the following should appear:

    Requested Certificates:
User Certificates:
Subject: CN=server_test,C=US
Trusted Certificates:
Subject: O=Oracle\, Inc.,C=US,
Inc.,C=US
Subject: CN=GTE CyberTrust Global Root,
Inc.,O=GTE Corporation,C=US

Adding a Trusted Certificate to an Oracle Wallet

You can use the orapki utility to add trusted certificates to an Oracle wallet.

This command adds a trusted certificate to the specified location (-cert certificate_file_directory), to a wallet. You must add all trusted certificates in the certificate chain of a user certificate before adding a user certificate, or the command to add the user certificate will fail.

To add a trusted certificate to an Oracle wallet, use the orapki wallet add command.

orapki wallet add -wallet wallet_file_directory -trusted_cert -cert certificate_file [-pwd wallet_password]

If you omit the -pwd parameter, then you are prompted to enter the wallet password. For better security, enter the password at this prompt.

Adding a Root Certificate to an Oracle Wallet

You can use the orapki utility to add a root certificate to an Oracle wallet.

This command creates a new self-signed (root) certificate and adds it to the wallet.

To add a root certificate to an Oracle wallet, use the orapki wallet add command.

orapki wallet add -wallet wallet_file_directory -dn certificate_dn -keySize 512\|768\|1024\|2048\|4096\|8192\|16384 -self_signed -validity number_of_days
 [-pwd wallet_password] [-cert_validation_mode strict|non-strict]

In this specification:

Adding Root Certificate Authority That Requires an Intermediate Certificate Using Microsoft Internet Explorer

This procedure explains how to install a new or replacement root certificate authority (CA) by downloading it from Microsoft Explorer versions 5, 6, or 7.

  1. In Internet Explorer, select Tools, then Internet Options, then Content, then Certificates.

  2. Selct the Trusted Root Certification Authorities tab.

  3. Select Issued to: ….

  4. Click Export.

  5. In the wizard that opens, select Next, then Select Base-64 encoded X.509 (.CER).

  6. Enter a file name and select Finish.

Adding a User Certificate to an Oracle Wallet

You can use the orapki utility to add a user certificate to an Oracle wallet.

Use the orapki wallet add command to add the user certificate to the wallet.

orapki wallet add -wallet wallet_file_directory -user_cert -cert certificate_file_directory [-pwd wallet_password]

If you omit the -pwd parameter, then you are prompted to enter the wallet password. For better security, enter the password at this prompt.

Verifying Credentials on the Hardware Device That Uses a PKCS#11 Wallet

You can verify credentials on the hardware device using the PKCS#11 wallet.

To verify the credential details, use the orapki wallet p11_verify command.

orapki wallet p11_verify -wallet wallet_file_directory [-pwd wallet_password]

pwd is the wallet password. If no password is provided, then a password prompt appears. For better security, enter the password at the prompt instead of entering it at the command line

Adding PKCS#11 Information to an Oracle Wallet

A wallet that contains PKCS#11 information can be used like any Oracle wallet.

The private keys for this type of wallet are stored on a hardware device. Hardware devices maintain the private key and perform cryptographic operations using the private key. Therefore, the private key is never needed outside of the hardware device boundary.

To add PKCS#11 information to a wallet, use the orapki wallet p11_add command.

orapki wallet p11_add -wallet wallet_file_directory -p11_lib pkcs11Lib
[-p11_tokenlabel tokenLabel] [-p11_tokenpw tokenPassphrase]
[-p11_certlabel certLabel] [-pwd wallet_password]

In this specification:

Viewing a Certificate

After you create a certificate, you can use the orapki utility to view it.

To view a certificate, use the orapki cert display command.

orapki cert display -cert certificate_file_directory [-complete]

In this specification:

Controlling MD5 and SHA-1 Certificate Use

You can use the sqlnet.ora file to control whether MD5 and SHA-1 signed certificates are accepted.

To control whether the MD5 and SHA-1 signed certificates are accepted, you can edit the sqlnet.ora file to enable or disable their use. Note: MD5 is deprecated in this release.

  1. Log in to the server where the Oracle database resides.

  2. Edit the sqlnet.ora file.

    By default, the sqlnet.ora file is located in the $ORACLE_HOME/dbs directory or in the location set by the TNS_ADMIN environment variable.

  3. Set the following parameters:

    • ACCEPT_MD5_CERTS controls the use of MD5 certificates. The default is FALSE. This parameter replaces the ORACLE_SSL_ALLOW_MD5_CERT_SIGNATURES environment variable.

    • ACCEPT_SHA1_CERTS controls the use of SHA-1 certificates. The default is TRUE.

Certificate Import and Export Operations

You can use orapki to import and export certificates.

Importing a User-Supplied or Trusted Certificate into an Oracle Wallet

You can add a user-supplied or trusted certificate to an Oracle wallet.

Use the orapki wallet add -wallet command as follows:

In this specification, pwd is the wallet password. If no password is provided, then a password prompt appears. For better security, enter the password at the prompt instead of entering it at the command line.

Exporting Certificates and Certificate Requests from an Oracle Wallet

You can use the orapki utility to export certificates and certificate requests from an Oracle wallet.

Depending on the type of certificate that you want to export from a wallet, use the orapki wallet export command.

dn specifies the distinguished name of the certificate. In the case of a multi-valued DN, the order in which the individual DN values are stored in the wallet is uncertain. To find the correct DN that you want, run orapki wallet display.

Related Topics

Management of Certificate Revocation Lists (CRLs) with orapki Utility

You must manage certificate revocation lists (CRLs) with the orapki utility.

This utility creates a hashed value of the CRL issuer’s name to identify the CRLs location in your system. If you do not use orapki, your Oracle server cannot locate CRLs to validate PKI digital certificates.

Related Topics