{"id":529,"date":"2022-09-28T18:02:07","date_gmt":"2022-09-28T16:02:07","guid":{"rendered":"https:\/\/ilmarkerm.eu\/blog\/?p=529"},"modified":"2022-09-28T18:02:07","modified_gmt":"2022-09-28T16:02:07","slug":"create-oracle-wallet-user-certificate-from-external-files","status":"publish","type":"post","link":"https:\/\/ilmarkerm.eu\/blog\/2022\/09\/create-oracle-wallet-user-certificate-from-external-files\/","title":{"rendered":"Create Oracle wallet user certificate from external files"},"content":{"rendered":"\n<p>Lets say your company has an automated system that propagates and renews TLS certificates for each server automatically, for example using NDES. And you want to use the same files also for your Oracle database TCPS protocol connections.<\/p>\n\n\n\n<p>For Oracle database the database server user certificate needs to be placed inside Oracle wallet and the default workflow for Oracle wallet is that you create the private key and certificate request inside Oracle wallet and then use the exported certificate request to request a certificate from your certificate authority and then you import that certificate to the wallet.<\/p>\n\n\n\n<p>But you have already issued certificate and private key as separate files, like many popular open source tools like it. It is possible to create Oracle wallet from these.<\/p>\n\n\n\n<p>We have two files.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Private key &#8211; \/etc\/pki\/tls\/private\/servername.key<\/li><li>Issued certificate &#8211; \/etc\/pki\/tls\/private\/servername.crt<\/li><\/ul>\n\n\n\n<p>We also need the certificate authority certificates (all of them, the full chain) who issued your server certificate. You can usually download them from your CA webpage or there also might be URL embedded in the certificate itself.<\/p>\n\n\n\n<p>I&#8217;m using orapki executable from 19c installation.<\/p>\n\n\n\n<p>First create an empty Oracle wallet.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># orapki wallet create -wallet \/oracle\/wallet\/location -pwd oracle_wallet_password<\/code><\/pre>\n\n\n\n<p>Then add all the certificate authority certificates to the wallet<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># You can check the certificate if it has links to issuer server certificates embedded. You need to repeat that until there is no output (you have reached the root) and download each file along the way. Usually there are about 2-3 of them.\n# openssl x509 -in \/etc\/pki\/tls\/private\/servername.crt -inform pem -noout -issuer -ext authorityInfoAccess\n\n\n# orapki wallet add -wallet \/oracle\/wallet\/location -pwd oracle_wallet_password -trusted_cert -cert \/tmp\/ca_certificate_intermediate.cer\n# orapki wallet add -wallet \/oracle\/wallet\/location -pwd oracle_wallet_password -trusted_cert -cert \/tmp\/ca_certificate_root.cer<\/code><\/pre>\n\n\n\n<p>A quick sanity check, the server certificate you have should have TLS Web Server Authentication extended key usage set. If it is not, ask your CA to reissue the certificate. Without it your clients might get an error like this: <strong>IO error: extended key usage does not permit use for TLS server authentication<\/strong>\u00a0<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># openssl x509 -ext extendedKeyUsage -in \/etc\/pki\/tls\/private\/servername.crt -noout\nX509v3 Extended Key Usage: \n    TLS Web Client Authentication, TLS Web Server Authentication<\/code><\/pre>\n\n\n\n<p>If the private key is unencrypted, then you first need to encrypt it in PKCS#8 format &#8211; into a separate temporary file. oraplki cannot import unencrypted private key.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Check first, if the key in unencrypted\n# head -1 \/etc\/pki\/tls\/private\/servername.key\n-----BEGIN PRIVATE KEY-----\n\n# export wallet_build_pass=\"long_key_encryption_password\"\n# openssl pkcs8 -topk8 -in \/etc\/pki\/tls\/private\/servername.key -out \/tmp\/encrypted.key -passout env:wallet_build_pass\n\n# Lets check that the resulting file has encrypted key\n# # head -1 \/tmp\/encrypted.key \n-----BEGIN ENCRYPTED PRIVATE KEY-----<\/code><\/pre>\n\n\n\n<p>Now you can import the private key and certificate into Oracle wallet.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># orapki wallet import_private_key -wallet \/oracle\/wallet\/location -pwd oracle_wallet_password -pvtkeyfile \/tmp\/encrypted.key -pvtkeypwd long_key_encryption_password -cert \/etc\/pki\/tls\/private\/servername.crt<\/code><\/pre>\n\n\n\n<p>Code &#8211; to automatically renew Oracle wallet. NB! read and modify the code according to your needs.<\/p>\n\n\n\n<script src=\"https:\/\/gist.github.com\/ilmarkerm\/6dd639dd6257119078d71bc7732074b4.js\"><\/script>\n","protected":false},"excerpt":{"rendered":"<p>Lets say your company has an automated system that propagates and renews TLS certificates for each server automatically, for example using NDES. And you want to use the same files also for your Oracle database TCPS protocol connections. For Oracle database the database server user certificate needs to be placed inside Oracle wallet and the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[4,63],"class_list":["post-529","post","type-post","status-publish","format-standard","hentry","category-blog-entry","tag-oracle","tag-security"],"_links":{"self":[{"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/posts\/529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/comments?post=529"}],"version-history":[{"count":2,"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/posts\/529\/revisions"}],"predecessor-version":[{"id":531,"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/posts\/529\/revisions\/531"}],"wp:attachment":[{"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/media?parent=529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/categories?post=529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ilmarkerm.eu\/blog\/wp-json\/wp\/v2\/tags?post=529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}