Oracle Wallet (Orapki commands)

Wallets:
      A wallet is a password-protected container used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL. The wallets it creates can be read by Oracle Database, Oracle Application Servers (OHS) , and the Oracle Identity Management infrastructure.

There are three types of wallets.

1.Password protected - ewallet.p12
Required password for all operations like display,add,delete

2.Password protected with autologin- ewallet.p12& cwallet.sso
Required password for only add,delete not for display. It can be read by oracle products without password.

3.Auto_login_only - cwallet.sso
Doesn’t required password for any operations.

Creating and Viewing Oracle Wallets with orapki:

1.password-protected wallet creation:

orapki wallet create -wallet wallet_location

This command will prompt you to enter and re-enter a wallet password. It creates a wallet in the location specified for -wallet.

2.Password-Protected with auto-login enabled: (Used in our environments, Typically used by all)

orapki wallet create -wallet wallet_location -auto_login

This command creates a wallet with auto-login enabled, or it can also be used to enable auto-login on an existing wallet. If the wallet_location already contains a wallet, then auto-login will be enabled for it. To disable the auto-login feature, delete cwallet.sso.For wallets with the auto-login feature enabled, you are prompted for a password only for operations that modify the wallet, such as add

3. Autologin wallets:

To create an auto login wallet (cwallet.sso) that does not need a password, use the following command:

orapki wallet create -wallet wallet_location -auto_login_only

This command creates an auto login wallet (cwallet.sso) that does not need a password to open. You can also modify or delete the wallet without using a password. File system permissions provide the necessary security for such auto login wallets.

4.To view an Oracle wallet:

orapki wallet display -wallet wallet_location

5.Modifying the Password for a Wallet:

To change the wallet password, use the following command:

orapki wallet change_pwd -wallet wallet_location [-oldpwd password ] [-newpwd password]

6.How to add private key and certificates generated using openssl?

a.Create Wallet using openssl:

openssl pkcs12 -export -in jaydba_blogspot_com_cert.cer -inkey jaydba_blogspot_com.key -cerfile jaydba_blogspot_com_interm.cer -out ewallet.p12

b.Enable auto login:

orapki wallet create -wallet . -auto_login

                                             [or]


If you face Issues while enabling Autologin:

In Oracle HTTP server 12.1.3 an exception thrown when attempting to set the "auto-login" flag on a a wallet using the "orapki" command,I got this error.

Exception in thread "main" java.lang.NullPointerException
at oracle.security.pki.OracleKeyStoreSpi.a(Unknown Source)
at oracle.security.pki.OracleSSOKeyStoreSpi.a(Unknown Source)
at oracle.security.pki.OracleFileWalletImpl.b(Unknown Source)
at oracle.security.pki.OracleWallet.saveSSO(Unknown Source)
at oracle.security.pki.textui.OracleWalletTextUI.create(Unknown Source)
at oracle.security.pki.textui.OracleWalletTextUI.command(Unknown Source)
at oracle.security.pki.textui.OraclePKITextUI.main(Unknown Source)"


Please follow below steps as an alternate.

a.Create Wallet using openssl:

openssl pkcs12 -export -in jaydba_blogspot_com_cert.cer -inkey jaydba_blogspot_com.key -cerfile jaydba_blogspot_com_interm.cer -out ewallet.p12 

cp ewallet.p12  temp.p12

b. Create Auto login Wallet:

orapki wallet create -wallet -auto_login -with_trust_flags -compat_v12

c. Finally import the pkcs12 file from step 1.

orapki wallet import_pkcs12 -wallet . -pkcs12file  temp.p12 

7.How to Convert JKS to wallet:

a.create a password protected Oracle wallet with autologin:

orapki wallet create -wallet ./ -pwd password  -auto_login

b.Migrate the JKS keystore entries to the wallet:

orapki wallet jks_to_pkcs12 -wallet ./ -pwd password -keystore ./ewallet.jks -jkspwd password