Unable to Use CA Certificates with Oracle Trace File Analyzer

Description: After CA certificates are configured, TFAMain starts successfully, but running tfactl commands results in client-server SSL socket exceptions.

Cause: The caroot.cert.txt file contains both the intermediate CA certificate and the server certificate. Combining these certificates in a single file causes an Empty server certificate chain error.

Action: Separate the intermediate CA certificate and server certificate into individual PEM files, and then recreate and configure the client and server keystores.

1. Examine the certificate information to identify the certificates in the certificate file:

   openssl x509 -in cerfile.cer -noout -text

   Separate the certificates into the following files:

   • intermediate.cert.pem - Intermediate CA certificate
   • server.cert.pem - Server certificate

2. Convert the server certificate keystore to PKCS#12 format:

   keytool -importkeystore \
     -destkeystore server.p12 \
     -deststoretype PKCS12 \
     -srckeystore serverCert.pfx

3. Create the server JKS keystore from the PKCS#12 keystore:

   keytool -v -importkeystore \
     -srckeystore server.p12 \
     -srcstoretype PKCS12 \
     -destkeystore server_ac.jks \
     -deststoretype JKS

4. Create the client JKS keystore from the PKCS#12 keystore:

   keytool -v -importkeystore \
     -srckeystore server.p12 \
     -srcstoretype PKCS12 \
     -destkeystore client_ac.jks \
     -deststoretype JKS

5. Verify the client keystore:

   keytool -list -keystore client_ac.jks

   Example output:

   Enter keystore password:
   Keystore type: jks
   Keystore provider: SUN
   
   Your keystore contains 1 entry
   
   1, Nov 30, 2021, PrivateKeyEntry,
   Certificate fingerprint (SHA1):
   59:BA:C8:94:97:48:9C:6C:11:23:36:F9:46:A1:1C:87:67:F7:84:19

6. Verify the server keystore:

   keytool -list -keystore server_ac.jks

   Example output:

   Enter keystore password:
   Keystore type: jks
   Keystore provider: SUN
   
   Your keystore contains 1 entry
   
   1, Nov 30, 2021, PrivateKeyEntry,
   Certificate fingerprint (SHA1):
   59:BA:C8:94:97:48:9C:6C:11:23:36:F9:46:A1:1C:87:67:F7:84:19

7. Import the server certificate into the client keystore:

   keytool -import -v \
     -alias server-ca \
     -file server.cert.pem \
     -keystore client_ac.jks

8. Import the server certificate into the server keystore:

   keytool -import -v \
     -alias client-ca \
     -file server.cert.pem \
     -keystore server_ac.jks

9. Import the intermediate CA certificate into the server keystore:

   keytool -importcert -trustcacerts \
     -alias inter \
     -file intermediate.cert.pem \
     -keystore server_ac.jks

10. Verify the contents of the server keystore:

    keytool -list -keystore server_ac.jks

    Example output:

    Enter keystore password:
    Keystore type: jks
    Keystore provider: SUN
    
    Your keystore contains 3 entries
    
    inter, Nov 30, 2021, trustedCertEntry,
    Certificate fingerprint (SHA1):
    F6:E3:AA:60:E0:D0:80:69:12:72:06:E0:FA:62:7A:EB:54:38:11:55
    
    client-ca, Nov 30, 2021, trustedCertEntry,
    Certificate fingerprint (SHA1):
    59:BA:C8:94:97:48:9C:6C:11:23:36:F9:46:A1:1C:87:67:F7:84:19
    
    1, Nov 30, 2021, PrivateKeyEntry,
    Certificate fingerprint (SHA1):
    59:BA:C8:94:97:48:9C:6C:11:23:36:F9:46:A1:1C:87:67:F7:84:19

11. Verify the contents of the client keystore:

    keytool -list -keystore client_ac.jks

    Example output:

    Enter keystore password:
    Keystore type: jks
    Keystore provider: SUN
    
    Your keystore contains 2 entries
    
    1, Nov 30, 2021, PrivateKeyEntry,
    Certificate fingerprint (SHA1):
    59:BA:C8:94:97:48:9C:6C:11:23:36:F9:46:A1:1C:87:67:F7:84:19
    
    server-ca, Nov 30, 2021, trustedCertEntry,
    Certificate fingerprint (SHA1):
    59:BA:C8:94:97:48:9C:6C:11:23:36:F9:46:A1:1C:87:67:F7:84:19

After configuring the keystores, run the required tfactl commands again and verify that the client-server SSL connection is established successfully.