15 Managing Wallets and Certificates

15.1.1.3.1 Options Supported:

• Open wallet from the registry

• Save wallet to the registry

• Save As to a different registry location

• Delete wallet from the registry

• Open wallet from the file system and save it to the registry

• Open wallet from the registry and save it to the file system

15.1.4.2.1 Creating a Standard Wallet

Unless you have a hardware security module (a PKCS #11 device), then you should use a standard wallet that stores credentials in a directory on your file system.

To create a standard wallet, perform the following tasks:

1. Choose Wallet > New from the menu bar. The New Wallet dialog box appears.

2. Follow the "Required Guidelines for Creating Wallet Passwords" on page 1-9 and enter a password in the Wallet Password field. This password protects unauthorized use of your credentials.

3. Re-enter that password in the Confirm Password field.

4. Choose Standard from the Wallet Type list.

5. Click OK to continue. If the entered password does not conform to the required guidelines, then the following message appears:

   Password must have a minimum length of eight characters,
   and contain alphabetic characters combined with numbers
   or special characters.
    Do you want to try again?
   
   

6. An alert is displayed, and informs you that a new empty wallet has been created. It prompts you to decide whether you want to add a certificate request. See Section 15.1.5.1.1, "Adding a Certificate Request".

   If you choose No, you are returned to the Oracle Wallet Manager main window. The new wallet you just created appears in the left window pane. The certificate has a status of [Empty], and the wallet displays its default trusted certificates.

7. Select Wallet > Save In System Default to save the new wallet.

   If you do not have permission to save the wallet in the system default, you can save it to another location. This location must be used in the SSL configuration for clients and servers.

   A message at the bottom of the window confirms that the wallet was successfully saved.

15.1.4.2.2 Creating a Wallet to Store Hardware Security Module Credentials

To create a wallet to store credentials on a hardware security module that complies with PKCS #11, perform the following tasks:

1. Choose Wallet > New from the menu bar; the New Wallet dialog box appears.

2. Follow Section 15.1.4.1, "Required Guidelines for Creating Wallet Passwords" and enter a password in the Wallet Password field.

3. Re-enter that password in the Confirm Password field.

4. Choose PKCS11 from the Wallet Type list, and click OK to continue. The New PKCS11 Wallet window appears.

5. Choose a vendor name from the Select Hardware Vendor list.

   
   

   Note: In the current release of Oracle Wallet Manager, only nCipher hardware has been certified to interoperate with Oracle wallets.

   
   

6. In the PKCS11 library filename field, enter the path to the directory in which the PKCS11 library is stored, or click Browse to find it by searching the file system.

7. Enter the SmartCard password, and choose OK.

   The smart card password, which is different from the wallet password, is stored in the wallet.

8. An alert is displayed, and informs you that a new empty wallet has been created. It prompts you to decide whether you want to add a certificate request. See Section 15.1.5.1.1, "Adding a Certificate Request".

   If you choose No, you are returned to the Oracle Wallet Manager main window. The new wallet you just created appears in the left window pane. The certificate has a status of [Empty], and the wallet displays its default trusted certificates.

9. Select Wallet > Save In System Default to save the new wallet.

   If you do not have permission to save the wallet in the system default, you can save it to another location.

   A message at the bottom of the window confirms that the wallet was successfully saved.

   
   

   Note: If you change the SmartCard password or move the PKCS #11 library, an error message displays when you try to open the wallet. Then you are prompted to enter the new SmartCard password or the new path to the library.

   
   

15.1.4.14.1 Enabling Auto Login

To enable auto login:

1. Choose Wallet from the menu bar.

2. Check Auto Login. A message at the bottom of the window indicates that auto login is enabled.

15.1.4.14.2 Disabling Auto Login

To disable auto login:

1. Choose Wallet from the menu bar.

2. Uncheck Auto Login. A message at the bottom of the window indicates that auto login is disabled.

15.1.5.1.1 Adding a Certificate Request

You can add multiple certificate requests with Oracle Wallet Manager. When adding multiple requests, Oracle Wallet Manager automatically populates each subsequent request dialog box with the content of the initial request that you can then edit.

The actual certificate request becomes part of the wallet. You can reuse any certificate request to obtain a new certificate. However, you cannot edit an existing certificate request. Store only a correctly filled out certificate request in a wallet.

To create a PKCS #10 certificate request:

1. Choose Operations > Add Certificate Request. The Add Certificate Request dialog box appears.

2. Enter the information specified in Table 15-2.

3. Choose OK. A message informs you that a certificate request was successfully created. You can either copy the certificate request text from the body of this dialog panel and paste it into an e-mail message to send to a certificate authority, or you can export the certificate request to a file.

4. Choose OK to return to the Oracle Wallet Manager main window. The status of the certificate changes to [Requested].

   
   

   See Also: "Section 15.1.5.1.7, "Exporting a User Certificate Request"

   
   

Table 15-3 lists the available key sizes and the relative security each size provides. Typically, CAs use key sizes of 1024 or 2048. When certificate owners wish to keep their keys for a longer duration, they choose 3072 or 4096 bit keys.

15.1.5.1.2 Importing the User Certificate into the Wallet

When the Certificate Authority grants you a certificate, it may send you an e-mail that has your certificate in text (BASE64) form or attached as a binary file.

To import the user certificate from the text of the Certificate Authority's e-mail, copy the certificate, represented as text (BASE64), from the certificate authority's e-mail message. Include the lines Begin Certificate and End Certificate.

1. Choose Operations > Import User Certificate.... The Import Certificate dialog box appears.

2. Choose Paste the certificate, and then click OK. Another Import Certificate dialog box appears with the following message:

   Please provide a base64 format certificate and paste it below.
   
   

3. Paste the certificate into the dialog box, and choose OK.

   1. If the certificate received is in PKCS#7 format, it is installed, and all the other certificates included with the PKCS#7 data are placed in the Trusted Certificate list.

   2. If the certificate received is not in PKCS#7 format, and the certificate of its CA is not already in the Trusted Certificates list, then more must be done. Oracle Wallet Manager will ask you to import the certificate of the CA that issued your certificate. This CA certificate will be placed in the Trusted Certificates list. (If the CA certificate was already in the Trusted Certificates list, your certificate is imported without additional steps.)

   After either (a) or (b) succeeds, a message at the bottom of the window confirms that the certificate was successfully installed. The Oracle Wallet Manager main window reappears, and the status of the corresponding entry in the left panel subtree changes to [Ready].

   
   

   Note: The standard X.509 certificate includes the following start and end text: -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- A typical PKCS#7 certificate includes more, as described earlier, and includes the following start and end text: -----BEGIN PKCS7----- -----END PKCS7----- You can use the standard Ctrl+c to copy, including all dashes, and Ctrl+v to paste.

   
   

To import the certificate from a file:

The user certificate in the file can be in either text (BASE64) or binary (der) format.

1. Choose Operations > Import User Certificate.... The Import Certificate dialog box appears.

2. Choose Select a file that contains the certificate, and click OK. Another Import Certificate dialog box appears.

3. Enter the path or folder name of the certificate file location.

4. Select the name of the certificate file (for example, cert.txt, cert.der).

5. Choose OK.

   1. If the certificate received is in PKCS#7 format, it is installed, and all the other certificates included with the PKCS#7 data are placed in the Trusted Certificate list.

   2. If the certificate received is not in PKCS#7 format, and the certificate of its CA is not already in the Trusted Certificates list, then more must be done. Oracle Wallet Manager will ask you to import the certificate of the CA that issued your certificate. This CA certificate will be placed in the Trusted Certificates list. (If the CA certificate was already in the Trusted Certificates list, your certificate is imported without additional steps.)

   After either (a) or (b) succeeds, a message at the bottom of the window confirms that the certificate was successfully installed. You are returned to the Oracle Wallet Manager main panel, and the status of the corresponding entry in the left panel subtree changes to [Ready].

15.1.5.1.3 Importing Certificates Created with a Third-Party Tool

Third-party certificates are those created from certificate requests that were not generated using Oracle Wallet Manager. These third-party certificates are actually wallets, in the Oracle sense, because they contain more than just the user certificate; they also contain the private key for that certificate. Furthermore, they include the chain of trusted certificates validating that the certificate was created by a trustworthy entity.

Oracle Wallet Manager makes these wallets available in a single step by importing them in PKCS#12 format, which includes all three elements described earlier: the user certificate, the private key, and the trusted certificates. It supports the following PKCS #12-format certificates:

• Netscape Communicator 4.x

• Microsoft Internet Explorer 5.x and later

Oracle Wallet Manager adheres to the PKCS#12 standard, so certificates exported by any PKCS#12-compliant tool should be usable with Oracle Wallet Manager.

Such third-party certificates cannot be stored into existing Oracle wallets because they would lack the private key and chain of trusted authorities. Therefore, each such certificate is exported and retrieved instead as an independent PKCS#12 file, that is, as its own wallet.

To import a certificate created with a third-party tool, you must first export it from the application you are using, and then save it as a wallet file that can be read by Oracle Wallet Manager. See Section 15.1.5.1.3, "Importing Certificates Created with a Third-Party Tool" for information about importing certificates that are created with third-party tools.

To import a certificate created with a third-party tool, perform the following steps:

1. Follow the procedures for your particular product to export the certificate. Take the actions indicated in the exporting product to include the private key in the export, and specify the new password to protect the exported certificate. Also include all associated trust points. (Under PKCS #12, browsers do not necessarily export trusted certificates, other than the signer's own certificate. You may need to add additional certificates to authenticate to your peers. You can use Oracle Wallet Manager to import trusted certificates.)

   The resulting file, containing the certificate, the private key, and the trust points, is the new wallet that enables the third-party certificate to be used.

2. Save the exported certificate to a file name appropriate for your operating system in a directory expected by Oracle Wallet Manager.

   For UNIX and Windows, the appropriate file name is ewallet.p12.

   For other operating systems, see the Oracle documentation for the applicable operating system.

3. Use Oracle Wallet Manager to navigate to the directory in which you saved the ewallet.p12 file and open it to use the PKI credentials it contains.

   
   

   Note: The password will be required whenever the associated application starts up or otherwise needs the certificate. To make such access automatic, see Section 15.1.4.14, "Using Auto Login". However, if the private key for the desired certificate is held in a separate hardware security module, you will not be able to import that certificate.

   
   

   If you exported the trusted certificate separately, then you must import the trusted certificate first before you open the ewallet.p12 file that contains the imported third-party user certificate.

15.1.5.1.4 Removing a User Certificate from a Wallet

To remove a user certificate from a wallet:

1. In the left panel subtree, select the certificate that you want to remove.

2. Choose Operations > Remove User Certificate.... A dialog panel appears and prompts you to verify that you want to remove the user certificate from the wallet.

3. Choose Yes to return to the Oracle Wallet Manager main panel. The certificate displays a status of [Requested].

15.1.5.1.5 Removing a Certificate Request

You must remove a certificate before removing its associated request.

To remove a certificate request:

1. In the left panel subtree, select the certificate request that you want to remove.

2. Choose Operations > Remove Certificate Request....

3. Click Yes. The certificate displays a status of [Empty].

15.1.5.1.6 Exporting a User Certificate

To save the certificate in a file system directory, export the certificate by using the following steps:

1. In the left panel subtree, select the certificate that you want to export.

2. Choose Operations > Export User Certificate... from the menu bar. The Export Certificate dialog box appears.

3. Enter the file system directory location in which you want to save your certificate, or navigate to the directory structure under Folders.

4. Enter a file name for your certificate in the Enter File Name field.

5. Choose OK. A message at the bottom of the window confirms that the certificate was successfully exported to the file. You are returned to the Oracle Wallet Manager main window.

15.1.5.1.7 Exporting a User Certificate Request

To save the certificate request in a file system directory, export the certificate request by using the following steps:

1. In the left panel subtree, select the certificate request that you want to export.

2. Choose Operations > Export Certificate Request.... The Export Certificate Request dialog box appears.

3. Enter the file system directory location in which you want to save your certificate request, or navigate to the directory structure under Folders.

4. Enter a file name for your certificate request, in the Enter File Name field.

5. Choose OK. A message at the bottom of the window confirms that the certificate request was successfully exported to the file. You are returned to the Oracle Wallet Manager main window.

15.1.5.2.1 Importing a Trusted Certificate

You can import a trusted certificate into a wallet in either of two ways: paste the trusted certificate from an e-mail that you receive from the certificate authority, or import the trusted certificate from a file.

Oracle Wallet Manager automatically installs trusted certificates from VeriSign, RSA, Entrust, and GTE CyberTrust when you create a new wallet.

To copy and paste the text only (BASE64) trusted certificate:

Copy the trusted certificate from the body of the e-mail message you received that contained the user certificate. Include the lines Begin Certificate and End Certificate.

1. Choose Operations > Import Trusted Certificate... from the menu bar. The Import Trusted Certificate dialog panel appears.

2. Choose Paste the Certificate, and click OK. Another Import Trusted Certificate dialog panel appears with the following message:

   Please provide a base64 format certificate and paste it below.
   
   

3. Paste the certificate into the window, and click OK. A message at the bottom of the window informs you that the trusted certificate was successfully installed.

4. Choose OK. You are returned to the Oracle Wallet Manager main panel, and the trusted certificate appears at the bottom of the Trusted Certificates tree.

   
   

   Keyboard shortcuts for copying and pasting certificates: Use Ctrl+c to copy, and use Ctrl+v to paste.

   
   

To import a file that contains the trusted certificate:

The file containing the trusted certificate should have been saved in either text (BASE64) or binary (der) format.

1. Choose Operations > Import Trusted Certificate.... The Import Trusted Certificate dialog panel appears.

2. Enter the path or folder name of the trusted certificate location.

3. Select the name of the trusted certificate file (for example, cert.txt).

4. Choose OK. A message at the bottom of the window informs you that the trusted certificate was successfully imported into the wallet.

5. Choose OK to exit the dialog panel. You are returned to the Oracle Wallet Manager main panel, and the trusted certificate appears at the bottom of the Trusted Certificates tree.

15.1.5.2.2 Removing a Trusted Certificate

You cannot remove a trusted certificate if it has been used to sign a user certificate still present in the wallet. To remove such trusted certificates, you must first remove the certificates it has signed. Also, you cannot verify a certificate after its trusted certificate has been removed from your wallet.

To remove a trusted certificate from a wallet:

1. Select the trusted certificate listed in the Trusted Certificates tree.

2. Choose Operations > Remove Trusted Certificate... from the menu bar.

   A dialog panel warns you that your user certificate will no longer be verifiable by its recipients if you remove the trusted certificate that was used to sign it.

3. Choose Yes. The selected trusted certificate is removed from the Trusted Certificates tree.

15.1.5.2.3 Exporting a Trusted Certificate

To export a trusted certificate to another file system location:

1. In the left panel subtree, select the trusted certificate that you want to export.

2. Select Operations > Export Trusted Certificate.... The Export Trusted Certificate dialog box appears.

3. Enter a file system directory in which you want to save your trusted certificate, or navigate to the directory structure under Folders.

4. Enter a file name to save your trusted certificate.

5. Choose OK. You are returned to the Oracle Wallet Manager main window.

15.1.5.2.4 Exporting All Trusted Certificates

To export all of your trusted certificates to another file system location:

1. Choose Operations > Export All Trusted Certificates.... The Export Trusted Certificate dialog box appears.

2. Enter a file system directory location in which you want to save your trusted certificates, or navigate to the directory structure under Folders.

3. Enter a file name to save your trusted certificates.

4. Choose OK. You are returned to the Oracle Wallet Manager main window.

15.2.5.1.1 What CRLs Should You Use?

You should have CRLs for all of the trust points that you honor. The trust points are the trusted certificates from a third party identity that is qualified with a level of trust. Typically, the certificate authorities you trust are called trust points.

15.2.5.1.2 How CRL Checking Works

Certificate revocation status is checked against CRLs which are located in file system directories, Oracle Internet Directory, or downloaded from the location specified in the CRL Distribution Point (CRL DP) extension on the certificate. If you store your CRLs on the local file system or in the directory, then you must update them regularly. If you use CRL DPs then CRLs are downloaded each time a certificate is used so there is no need to regularly refresh the CRLs.

The server searches for CRLs in the following locations in the order listed. When the system finds a CRL that matches the certificate CA's DN, it stops searching.

1. Local file system

   The system checks the sqlnet.ora file for the SSL_CRL_FILE parameter first, followed by the SSL_CRL_PATH parameter. If these two parameters are not specified, then the system checks the wallet location for any CRLs.

   Note: if you store CRLs on your local file system, then you must use the orapki utility to periodically update them. See "Renaming CRLs with a Hash Value for Certificate Validation" on page 1-28

2. Oracle Internet Directory

   If the server cannot locate the CRL on the local file system and directory connection information has been configured in the ORACLE_HOME/ldap/admin/ldap.ora file, then the server searches in the directory. It searches the CRL subtree by using the CA's distinguished name (DN) and the DN of the CRL subtree.

   The server must have a properly configured ldap.ora file to search for CRLs in the directory. It cannot use the Domain Name System (DNS) discovery feature of Oracle Internet Directory. Also note that if you store CRLs in the directory, then you must use the orapki utility to periodically update them. See "Uploading CRLs to Oracle Internet Directory" on page 1-28

3. CRL DP

   If the CA specifies a location in the CRL DP X.509, version 3, certificate extension when the certificate is issued, then the appropriate CRL that contains revocation information for that certificate is downloaded. Currently, Oracle Advanced Security supports downloading CRLs over HTTP and LDAP.

   
   

   Notes: For performance reasons, only user certificates are checked. Oracle recommends that you store CRLs in the directory rather than the local file system.

   
   

15.2.5.2.1 Renaming CRLs with a Hash Value for Certificate Validation

When the system validates a certificate, it must locate the CRL issued by the CA who created the certificate. The system locates the appropriate CRL by matching the issuer name in the certificate with the issuer name in the CRL.

When you specify a CRL storage location for the Certificate Revocation Lists Path field in Oracle Net Manager (sets the SSL_CRL_PATH parameter in the sqlnet.ora file), use the orapki utility to rename CRLs with a hash value that represents the issuer's name. Creating the hash value enables the server to load the CRLs.

On UNIX operating systems, orapki creates a symbolic link to the CRL. On Windows operating systems, it creates a copy of the CRL file. In either case, the symbolic link or the copy created by orapki are named with a hash value of the issuer's name. Then when the system validates a certificate, the same hash function is used to calculate the link (or copy) name so the appropriate CRL can be loaded.

Depending on your operating system, enter one of the following commands to rename CRLs stored in the file system.

To rename CRLs stored in UNIX file systems:

orapki crl hash -crl crl_filename [-wallet wallet_location]
-symlink crl_directory [-summary]

To rename CRLs stored in Windows file systems:

orapki crl hash -crl crl_filename
[-wallet wallet_location] -copy crl_directory [-summary]

In the preceding commands, crl_filename is the name of the CRL file, wallet_location is the location of a wallet that contains the certificate of the CA that issued the CRL, and crl_directory is the directory in which the CRL is located.

Using -wallet and -summary are optional. Specifying -wallet causes the tool to verify the validity of the CRL against the CA's certificate prior to renaming the CRL. Specifying the -summary option causes the tool to display the CRL issuer's name.

15.2.5.2.2 Uploading CRLs to Oracle Internet Directory

Publishing CRLs in the directory enables CRL validation throughout your enterprise, eliminating the need for individual applications to configure their own CRLs. All applications can use the CRLs stored in the directory in which they can be centrally managed, greatly reducing the administrative overhead of CRL management and use.

The user who uploads CRLs to the directory by using orapki must be a member of the directory group CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%). This is a privileged operation because these CRLs are accessible to the entire enterprise. Contact your directory administrator to be added to this administrative directory group.

To upload CRLs to the directory, enter the following at the command line:

orapki crl upload -crl crl_location
-ldap hostname:ssl_port -user username [-wallet wallet_location] [-summary]

In the preceding command, crl_location is the file name or URL in which the CRL is located, hostname and ssl_port (SSL port with no authentication) are for the system on which your directory is installed, username is the directory user who has permission to add CRLs to the CRL subtree, and wallet_location is the location of a wallet that contains the certificate of the CA that issued the CRL.

Using -wallet and -summary are optional. Specifying -wallet causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory. Specifying the -summary option causes the tool to print the CRL issuer's name and the LDAP entry in which the CRL is stored in the directory.

15.2.5.2.3 Listing CRLs Stored in Oracle Internet Directory

You can display a list of all CRLs stored in the directory with orapki, which is useful for browsing to locate a particular CRL to view or download to your local system. This command displays the CA who issued the CRL (Issuer) and its location (DN) in the CRL subtree of your directory.

To list CRLs in Oracle Internet Directory, enter the following at the command line:

orapki crl list -ldap hostname:ssl_port

In the preceding command, the hostname and ssl_port are for the system on which your directory is installed. Note that this is the directory SSL port with no authentication as described in the preceding section.

15.2.5.2.4 Viewing CRLs in Oracle Internet Directory

You can view specific CRLs that are stored in Oracle Internet Directory in a summarized format or you can request a complete listing of revoked certificates for the specified CRL. A summary listing provides the CRL issuer's name and its validity period. A complete listing provides a list of all revoked certificates contained in the CRL.

To view a summary listing of a CRL in Oracle Internet Directory, enter the following at the command line:

orapki crl display -crl crl_location [-wallet wallet_location] -summary

In the preceding command, crl_location is the location of the CRL in the directory. It is convenient to paste the CRL location from the list that displays when you use the orapki crl list command. See: "Listing CRLs Stored in Oracle Internet Directory" on page 1-29.

To view a list of all revoked certificates contained in a specified CRL, which is stored in Oracle Internet Directory, enter the following at the command line:

orapki crl display -crl crl_location [-wallet wallet_location] -complete

For example, the following orapki command:

orapki crl display -crl $T_WORK/pki/wlt_crl/nzcrl.txt -wallet $T_WORK/pki/wlt_crl -complete

produces the following output, which lists the CRL issuer's DN, its publication date, date of its next update, and the revoked certificates it contains:

issuer = CN=root,C=us, thisUpdate = Sun Nov 16 10:56:58 PST 2003,
nextUpdate = Mon Sep 30 11:56:58 PDT 2013, revokedCertificates = 
{(serialNo = 153328337133459399575438325845117876415, 
revocationDate - Sun Nov 16 10:56:58 PST 2003)}
CRL is valid

Using the -wallet option causes the orapki crl display command to validate the CRL against the CA's certificate.

Depending on the size of your CRL, choosing the -complete option may take a long time to display.

You can also use Oracle Directory Manager, a graphical user interface tool that is provided with Oracle Internet Directory, to view CRLs in the directory. CRLs are stored in the following directory location:

cn=CRLValidation,cn=Validation,cn=PKI,cn=Products,cn=OracleContext

15.2.5.2.5 Deleting CRLs from Oracle Internet Directory

The user who deletes CRLs from the directory by using orapki must be a member of the directory group CRLAdmins. See Section 15.2.5.2.2, "UploadingCRLs to Oracle Internet Directory" for information about this directory administrative group.

To delete CRLs from the directory, enter the following at the command line:

orapki crl delete -issuer issuer_name -ldap hostname:ssl_port 
-user username [-summary]

In the preceding command, issuer_name is the name of the CA who issued the CRL, the hostname and ssl_port are for the system on which your directory is installed, and username is the directory user who has permission to delete CRLs from the CRL subtree. Note that this must be a directory SSL port with no authentication. See Section 15.2.5.2.2, "UploadingCRLs to Oracle Internet Directory" for more information about this port.

Using the -summary option causes the tool to print the CRL LDAP entry that was deleted.

For example, the following orapki command:

orapki crl delete -issuer "CN=root,C=us" 
-ldap machine1:3500 -user cn=orcladmin -summary

produces the following output, which lists the location of the deleted CRL in the directory:

Deleted CRL at cn=root
cd45860c.rN,cn=CRLValidation,cn=Validation,cn=PKI,cn=Products,cn=OracleContext

15.2.6.1.1 Purpose

Use this command to create a signed certificate for testing purposes.

15.2.6.1.2 Syntax

orapki cert create [-wallet wallet_location]
-request certificate_request_location
-cert certificate_location -validity number_of_days [-summary]

• The -wallet parameter specifies the wallet containing the user certificate and private key that will be used to sign the certificate request.

• The -request parameter (mandatory) specifies the location of the certificate request for the certificate you are creating.

• The -cert parameter (mandatory) specifies the directory location in which the tool places the new signed certificate.

• The -validity parameter (mandatory) specifies the number of days, starting from the current date, that this certificate will be valid.

15.2.6.2.1 Purpose

Use this command to display details of a specific certificate.

15.2.6.2.2 Syntax

orapki cert display -cert certificate_location [-summary|-complete]

• The -cert parameter specifies the location of the certificate you want to display.

• You can use either the -summary or the -complete parameter to display the following information:

  • -summary displays the certificate and its expiration date

  • -complete displays additional certificate information, including the serial number and public key

15.2.6.3.1 Purpose

Use this command to delete CRLs from Oracle Internet Directory. Note that the user who deletes CRLs from the directory by using orapki must be a member of the CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%) directory group.

15.2.6.3.2 Prerequisites

None

15.2.6.3.3 Syntax

orapki crl delete -issuer issuer_name 
-ldap hostname:ssl_port -user username [-summary]

• The -issuer parameter specifies the name of the certificate authority (CA) who issued the CRL.

• The -ldap parameter specifies the hostname and SSL port for the directory in which the CRLs are to be deleted. Note that this must be a directory SSL port with no authentication. See "Uploading CRLs to Oracle Internet Directory" on page 7-29 for more information about this port.

• The -user parameter specifies the username of the directory user who has permission to delete CRLs from the CRL subtree in the directory.

• The -summary parameter is optional. Using it causes the tool to print the CRL LDAP entry that was deleted.

15.2.6.4.1 Purpose

Use this command to display specific CRLs that are stored in Oracle Internet Directory.

15.2.6.4.2 Syntax

orapki crl display -crl crl_location 
[-wallet wallet_location] [-summary|-complete]

• The -crl parameter specifies the location of the CRL in the directory. It is convenient to paste the CRL location from the list that displays when you use the orapki crl list command. See "orapki crl list" on page 1-33

• The -wallet parameter (optional) specifies the location of the wallet that contains the certificate of the certificate authority (CA) who issued the CRL. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior to displaying it.

• Choosing either the -summary or the -complete parameters displays the following information:

  • -summary provides a listing that contains the CRL issuer's name and the CRL's validity period

  • -complete provides a list of all revoked certificates that the CRL contains. Note that this option may take a long time to display, depending on the size of the CRL.

15.2.6.5.1 Purpose

Use this command to generate a hash value of the certificate revocation list (CRL) issuer to identify the location of the CRL in your file system for certificate validation.

15.2.6.5.2 Syntax

orapki crl hash -crl crl_filename|URL 
[-wallet wallet_location] [-symlink|-copy] crl_directory [-summary]

• The -crl parameter specifies the filename that contains the CRL or the URL in which it can be found.

• The -wallet parameter (optional) specifies the location of the wallet that contains the certificate of the certificate authority (CA) who issued the CRL. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory.

• Depending on your operating system, use either the -symlink or the -copy parameter:

  • (UNIX) use -symlink to create a symbolic link to the CRL at the crl_directory location

  • (Windows) use -copy to create a copy of the CRL at the crl_directory location

• The -summary parameter (optional) causes the tool to display the CRL issuer's name.

15.2.6.6.1 Purpose

Use this command to display a list of CRLs stored in Oracle Internet Directory. This is useful for browsing to locate a particular CRL to view or download to your local file system.

15.2.6.6.2 Syntax

orapki crl list -ldap hostname:ssl_port

The -ldap parameter specifies the hostname and SSL port for the directory server from which you want to list CRLs. Note that this must be a directory SSL port with no authentication. See Section 15.2.5.2.2, "UploadingCRLs to Oracle Internet Directory" for more information about this port.

15.2.6.7.1 Purpose

Use this command to upload certificate revocation lists (CRLs) to the CRL subtree in Oracle Internet Directory. Note that you must be a member of the directory administrative group CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%) to upload CRLs to the directory.

15.2.6.7.2 Syntax

orapki crl upload -crl crl_location 
-ldap hostname:ssl_port -user username 
[-wallet wallet_location] [-summary]

• The -crl parameter specifies the directory location or the URL of the CRL that you are uploading to the directory.

• The -ldap parameter specifies the hostname and SSL port for the directory to which you are uploading the CRLs. Note that this must be a directory SSL port with no authentication. See Section 15.2.5.2.2, "UploadingCRLs to Oracle Internet Directory" for more information about this port.

• The -user parameter specifies the username of the directory user who has permission to add CRLs to the CRL subtree in the directory.

• The -wallet parameter specifies the location of the wallet that contains the certificate of the certificate authority (CA) who issued the CRL. This is an optional parameter. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior to uploading it to the directory.

• The -summary parameter is also optional. Using it causes the tool to display the CRL issuer's name and the LDAP entry in which the CRL is stored in the directory.

15.2.6.8.1 Purpose

Use this command to add certificate requests and certificates to an Oracle wallet.

15.2.6.8.2 Syntax

To add certificate requests:

orapki wallet add -wallet wallet_location -dn user_dn -keySize 512|1024|2048

• The -wallet parameter specifies the location of the wallet to which you want to add a certificate request.

• The -dn parameter specifies the distinguished name of the certificate owner.

• The -keySize parameter specifies the key size for the certificate.

• To sign the request, export it with the export option. See Section 15.2.6.11, "orapki wallet export".

To add trusted certificates:

orapki wallet add -wallet wallet_location -trusted_cert -cert certificate_location

• The -trusted_cert parameter causes the tool to add the trusted certificate, at the location specified with -cert, to the wallet.

To add root certificates:

orapki wallet add -wallet wallet_location -dn 
certificate_dn -keySize 512|1024|2048 -self_signed -validity number_of_days

• The -self_signed parameter causes the tool to create a root certificate.

• The -validity parameter is mandatory. Use it to specify the number of days, starting from the current date, that this root certificate will be valid.

To add user certificates:

orapki wallet add -wallet wallet_location -user_cert -cert certificate_location

• The -user_cert parameter causes the tool to add the user certificate at the location specified with the -cert parameter to the wallet. Before you add a user certificate to a wallet, you must add all the trusted certificates that make up the certificate chain. If all trusted certificates are not installed in the wallet before you add the user certificate, then adding the user certificate will fail.

15.2.6.9.1 Purpose

Use this command to create an Oracle wallet or to set auto login on for an Oracle wallet.

15.2.6.9.2 Syntax

orapki wallet create -wallet wallet_location [-auto_login]

• The -wallet parameter specifies a location for the new wallet or the location of the wallet for which you want to turn on auto login.

• The -auto_login parameter creates an auto login wallet, or it turns on automatic login for the wallet specified with the -wallet option. See Section 15.1.4.14, "Using Auto Login" for details about auto login wallets.

15.2.6.10.1 Purpose

Use this command to view the certificate requests, user certificates, and trusted certificates in an Oracle wallet.

15.2.6.10.2 Syntax

orapki wallet display -wallet wallet_location

• The -wallet parameter specifies a location for the wallet you want to open if it is not located in the current working directory.

15.2.6.11.1 Purpose

Use this command to export certificate requests and certificates from an Oracle wallet.

15.2.6.11.2 Syntax

To export a certificate from an Oracle wallet:

orapki wallet export -wallet wallet_location -dn
certificate_dn -cert certificate_filename

• The -wallet parameter specifies the location of the wallet from which you want to export the certificate.

• The -dn parameter specifies the distinguished name of the certificate.

• The -cert parameter specifies the name of the file that contains the exported certificate.

To export a certificate request from an Oracle wallet:

orapki wallet export -wallet wallet_location -dn
certificate_request_dn -request certificate_request_filename

• The -request parameter specifies the name of the file that contains the exported certificate request.