{"id":517,"date":"2019-12-30T11:51:20","date_gmt":"2019-12-30T11:51:20","guid":{"rendered":"https:\/\/www.spotonoracle.com\/?p=517"},"modified":"2019-12-30T13:18:52","modified_gmt":"2019-12-30T13:18:52","slug":"all-roads-lead-to-rome-importing-custom-tls-certificate-into-oracle-wallet","status":"publish","type":"post","link":"https:\/\/www.spotonoracle.com\/?p=517","title":{"rendered":"All roads lead to Rome &#8211; Importing custom TLS certificate into Oracle wallet"},"content":{"rendered":"<p>It appears that Oracle&#8217;s preferred way to get a certificate into a wallet is by generating a key pair and then create certificate signing request using &#8220;orapki&#8221; (that&#8217;s what you mostly see in the docs and on MOS). Once the request is singed by the CA you import the certificate into the wallet.<br \/>\nBut, there are situations where you don&#8217;t get to create the signing request from the Oracle wallet. For instance, at one of my clients, they create everything at the CA and just send a PKCS#12 file to the DBAs. Since <a href=\"https:\/\/en.wikipedia.org\/wiki\/PKCS\" rel=\"noopener noreferrer\" target=\"_blank\">PKCS<\/a> is a standard and the Oracle wallet itself is a PKCS#12 file one could (naively) assume that these things are compatible. Unfortunately, this is not always the case. When trying to generate an SSO file with &#8220;orapki&#8221; from an openssl created PKCS#12 file I get the following error:<\/p>\n<pre class=\"brush: plain; collapse: false; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nException in thread &quot;main&quot; java.lang.NullPointerException\r\n        at oracle.security.pki.OracleKeyStoreSpi.a(Unknown Source)\r\n        at oracle.security.pki.OracleSSOKeyStoreSpi.a(Unknown Source)\r\n        at oracle.security.pki.OracleFileWalletImpl.b(Unknown Source)\r\n        at oracle.security.pki.OracleWallet.saveLSSO(Unknown Source)\r\n        at oracle.security.pki.textui.OracleWalletTextUI.create(Unknown Source)\r\n        at oracle.security.pki.textui.OracleWalletTextUI.command(Unknown Source)\r\n        at oracle.security.pki.textui.OraclePKITextUI.main(Unknown Source)\r\n<\/pre>\n<p>This is just one example, I&#8217;ve encountered other problems when trying to work with PKCS#12 files that were created by tools other than &#8220;orapki&#8221; (or mkstore). Therefore you should always create the PKCS#12 file using &#8220;orapki&#8221; and then work from there.<br \/>\nI&#8217;m going to show a few practical ways how to import a &#8220;pre-created&#8221; custom TLS certificate into an Oracle wallet.<\/p>\n<p><strong>Assuming we get a PKCS#12 file containing everything we need:<\/strong><\/p>\n<ul>\n<li>Root certificate<\/li>\n<li>Intermediate certificated<\/li>\n<li>Private key<\/li>\n<li>Signed certificate<\/li>\n<\/ul>\n<pre class=\"brush: bash; collapse: false; highlight: [7,8,9,10,11]; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nORACLE_WALLET_LOC=\/home\/oracle\/wallet\r\nORACLE_WALLET_PWD=*****\r\nSOURCE_PKCS12_FILE\/home\/oracle\/custom-ca.p12\r\nSOURCE_PKCS12_PWD=*****\r\n\r\norapki wallet create -wallet &quot;${ORACLE_WALLET_LOC}&quot; -compat_v12 -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet import_pkcs12 \\\r\n    -wallet &quot;${ORACLE_WALLET_LOC}&quot; \\\r\n   -pkcs12file &quot;${SOURCE_PKCS12_FILE}&quot; \\\r\n   -pkcs12pwd &quot;${SOURCE_PKCS12_PWD}&quot; \\\r\n   -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet create -wallet &quot;${ORACLE_WALLET_LOC}&quot; -compat_v12 -auto_login_local -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet display -wallet &quot;${ORACLE_WALLET_LOC}&quot;\r\n<\/pre>\n<p><strong>Maybe we get a Java key store (JKS) containing everything:<\/strong><\/p>\n<pre class=\"brush: bash; collapse: false; highlight: [7,8,9,10,11]; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nORACLE_WALLET_LOC=\/home\/oracle\/wallet\r\nORACLE_WALLET_PWD=*****\r\nSOURCE_JKS_FILE=\/home\/oracle\/custom-ca.jks\r\nSOURCE_JKS_PWD=*****\r\n\r\norapki wallet create -wallet &quot;${ORACLE_WALLET_LOC}&quot; -compat_v12 -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet jks_to_pkcs12 \\\r\n    -wallet &quot;${ORACLE_WALLET_LOC}&quot; \\\r\n    -keystore &quot;${SOURCE_JKS_FILE}&quot; \\\r\n    -jkspwd &quot;${SOURCE_JKS_PWD}&quot; \\\r\n    -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet create -wallet &quot;${ORACLE_WALLET_LOC}&quot; -compat_v12 -auto_login_local -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet display -wallet &quot;${ORACLE_WALLET_LOC}&quot;\r\n<\/pre>\n<p><strong>Or, we might get everything as individual base64 encoded files:<\/strong><\/p>\n<ul>\n<li>root.cer<\/li>\n<li>inter.cer<\/li>\n<li>private-pwd.key (password protected)<\/li>\n<li>custom.cer<\/li>\n<\/ul>\n<pre class=\"brush: bash; collapse: false; highlight: [7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22]; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nCERT_FILES_LOC=\/home\/oracle\r\nORACLE_WALLET_LOC=\/home\/oracle\/wallet\r\nORACLE_WALLET_PWD=*****\r\nPRIVATE_KEY_PWD=*****\r\n\r\norapki wallet create -wallet &quot;${ORACLE_WALLET_LOC}&quot; -compat_v12 -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet add \\\r\n    -wallet &quot;${ORACLE_WALLET_LOC}&quot; \\\r\n    -trusted_cert \\\r\n    -cert &quot;${CERT_FILES_LOC}\/root.cer&quot; \\\r\n    -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet add \\\r\n    -wallet &quot;${ORACLE_WALLET_LOC}&quot; \\\r\n    -trusted_cert \\\r\n    -cert &quot;${CERT_FILES_LOC}\/inter.cer&quot; \\\r\n    -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet import_private_key \\\r\n    -wallet &quot;${ORACLE_WALLET_LOC}&quot; \\\r\n    -pvtkeyfile &quot;${CERT_FILES_LOC}\/private-pwd.key&quot; \\\r\n    -pvtkeypwd &quot;${PRIVATE_KEY_PWD}&quot; \\\r\n    -cert &quot;${CERT_FILES_LOC}\/custom.cer&quot; \\\r\n    -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet create -wallet &quot;${ORACLE_WALLET_LOC}&quot; -compat_v12 -auto_login_local -pwd &quot;${ORACLE_WALLET_PWD}&quot;\r\norapki wallet display -wallet &quot;${ORACLE_WALLET_LOC}&quot;\r\n<\/pre>\n<p><strong>&#8220;Helper functions&#8221;<\/strong><br \/>\nExtracting individual components from a PKCS#12 file:<\/p>\n<pre class=\"brush: bash; collapse: false; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nCERT_FILES_LOC=\/home\/oracle\r\nSOURCE_PKCS12_FILE\/home\/oracle\/custom-ca.p12\r\nSOURCE_PKCS12_PWD=*****\r\nPRIVATE_KEY_PWD=*****\r\n\r\n# extract private key from PKCS#12 file\r\nopenssl pkcs12 -nocerts -in &quot;${SOURCE_PKCS12_FILE}&quot; -out &quot;${CERT_FILES_LOC}\/private-pwd.key&quot; -password pass:&quot;${SOURCE_PKCS12_PWD}&quot; -passout pass:&quot;${PRIVATE_KEY_PWD}&quot;\r\n# cleanup file: remove Bag\/Key Attribute information\r\nsed -i -n '\/-BEGIN ENCRYPTED PRIVATE KEY-\/,\/-END ENCRYPTED PRIVATE KEY-\/p' &quot;${CERT_FILES_LOC}\/private-pwd.key&quot;\r\n\r\n# remove passphrase from private key file (!!!security risk!!!)\r\nopenssl rsa -in &quot;${CERT_FILES_LOC}\/private-pwd.key&quot; -out &quot;${CERT_FILES_LOC}\/private-nopwd.key&quot; -passin pass:&quot;${PRIVATE_KEY_PWD}&quot;\r\n\r\n# extract certificate from PKCS#12 file\r\nopenssl pkcs12 -clcerts -nokeys -in &quot;${SOURCE_PKCS12_FILE}&quot; -out &quot;${CERT_FILES_LOC}\/custom.cer&quot; -password pass:&quot;${SOURCE_PKCS12_PWD}&quot;\r\n\r\n# extract root and intermediate certs from PKCS#12 file\r\n#   manually split ca-chain.cer into root.cer and inter.cer\r\nopenssl pkcs12 -in &quot;${SOURCE_PKCS12_FILE}&quot; -cacerts -nokeys -chain -out &quot;${CERT_FILES_LOC}\/ca-chain.cer&quot; -password pass:&quot;${SOURCE_PKCS12_PWD}&quot;\r\n<\/pre>\n<p>Create PKCS#12 file with &#8220;openssl&#8221;:<\/p>\n<pre class=\"brush: bash; collapse: false; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nCERT_FILES_LOC=\/home\/oracle\r\nTARGET_PKCS12_FILE\/home\/oracle\/opennssl.p12\r\nTARGET_PKCS12_PWD=*****\r\nPRIVATE_KEY_PWD=*****\r\n\r\ncat &quot;${CERT_FILES_LOC}\/root.cer&quot; &quot;${CERT_FILES_LOC}\/inter.cer&quot; &gt; &quot;${CERT_FILES_LOC}\/ca-chain.cer&quot;\r\nopenssl pkcs12 -export -out &quot;${TARGET_PKCS12_FILE}&quot; -inkey &quot;${CERT_FILES_LOC}\/private-pwd.key&quot; -in &quot;${CERT_FILES_LOC}\/custom.cer&quot; -certfile &quot;${CERT_FILES_LOC}\/ca-chain.cer&quot; -password pass:&quot;${TARGET_PKCS12_PWD}&quot; -passin pass:&quot;${PRIVATE_KEY_PWD}&quot;\r\n<\/pre>\n<p>Convert a PKCS#12 file to Java key store (JKS):<\/p>\n<pre class=\"brush: bash; collapse: false; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nOPENSSL_PKCS12_FILE=\/home\/oracle\/wallet\/openssl.p12\r\nOPENSSL_PKCS12_PWD=*****\r\nJKS_FILE=\/home\/oracle\/wallet\/keystore.jks\r\nJKS_PWD=*****\r\n\r\nkeytool -v -importkeystore -srckeystore &quot;${OPENSSL_PKCS12_FILE}&quot; -srcstoretype pkcs12 -srcstorepass &quot;${OPENSSL_PKCS12_PWD}&quot; -destkeystore &quot;${JKS_FILE}&quot; -deststoretype jks -deststorepass &quot;${JKS_PWD}&quot;\r\n<\/pre>\n<p>Footnote: tested &#8220;orapki&#8221; from Oracle 19.5 database home<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It appears that Oracle&#8217;s preferred way to get a certificate into a wallet is by generating a key pair and then create certificate signing request using &#8220;orapki&#8221; (that&#8217;s what you mostly see in the docs and on MOS). Once the request is singed by the CA you import the certificate into the wallet. But, there [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,12],"tags":[],"class_list":["post-517","post","type-post","status-publish","format-standard","hentry","category-general","category-security"],"_links":{"self":[{"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=\/wp\/v2\/posts\/517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=517"}],"version-history":[{"count":5,"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=\/wp\/v2\/posts\/517\/revisions"}],"predecessor-version":[{"id":521,"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=\/wp\/v2\/posts\/517\/revisions\/521"}],"wp:attachment":[{"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.spotonoracle.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}