
These are sample certificates created to test Oracle JDBC Thin with SSL
but also good enough for SSL-enabled testing of RMI or JMX. Some
details on how these were created:


Create a wallet for the test CA

For test purposes, we are going to use a CA called .root. which has a self-signed
certificate.
Create an empty wallet in the root directory:
> orapki wallet create -wallet ./root
You end up with ewallet.p12 in the ./root directory
Add a self-signed certificate to the wallet:
> orapki wallet add -wallet ./root -dn CN=root_test,C=US -keysize 2048
-self_signed -validity 3650
View the wallet:
> orapki wallet display -wallet ./root
Requested Certificates:
User Certificates:
Subject: CN=root_test,C=US
Trusted Certificates:
Subject: CN=root_test,C=US
(&)
Export the certificate:
> orapki wallet export -wallet ./root -dn CN=root_test,C=US
-cert ./root/b64certificate.txt
Create a wallet for the Oracle server
Create an empty wallet with auto login enabled:
> orapki wallet create -wallet ./server -auto_login
Two files are created under the server directory:
server/cwallet.sso server/ewallet.p12
Add a user in the wallet (a new pair of private/public keys is created):
> orapki wallet add -wallet ./server -dn CN=server_test,C=US -keysize
2048
If you display the server.s wallet you will see the following requested certificate:
Requested Certificates:
Subject: CN=server_test,C=US
Export the certificate request to a file:
> orapki wallet export -wallet ./server -dn CN=server_test,C=US
-request ./server/creq.txt
Using the test CA, sign the certificate request:
> orapki cert create -wallet ./root -request ./server/creq.txt
-cert ./server/cert.txt -validity 3650
You now have the following files under the server directory:
server/cert.txt server/creq.txt server/cwallet.sso
server/ewallet.p12
View the signed certificate:
> orapki cert display -cert ./server/cert.txt -complete
{ fingerprint = cb384d05b627d2cb20f0499781f704f6, notBefore = Tue Nov
13 17:44:47 PST 2007, notAfter = Fri Nov 10 17:44:47 PST 2017, holder
= CN=server_test,C=US, issuer = CN=root_test,C=US, serialNo = 0,
sigAlgOID = 1.2.840.113549.1.1.4, key = { modulus =
1959367951374601576535596271107995277417664424536098395399265269124721
8377994361345161198275934214447477226820230208385849110018924496387704
4484639443652466378093963161320192391160905740289465375255115252978607
9834099013465953836979377789767891049188057304407921469766478339671147
3736713730827796216908755554377710566510839206341716045058853599226754
8460749873033793093373387298332477942247788814090235867746623126621826
9319505528877172776186889553531222971886597798361091355959715918186264
3061313984478003607762017842505744116997048267905434071794600231924974
969198032240336875590366035431182383935713771751264581303, exponent =
65537 } }
Add the test CA.s trusted certificate to the wallet
> orapki wallet add -wallet ./server -trusted_cert
-cert ./root/b64certificate.txt
If you display the server.s certificate at this point, you should see a new entry in the
list of trusted certificates:
Subject: CN=root_test,C=US
Finally add the user certificate to the wallet:
> orapki wallet add -wallet ./server -user_cert -cert ./server/cert.txt
Displaying the server.s certificate will show:
Requested Certificates:
User Certificates:
Subject: CN=server_test,C=US
Trusted Certificates:
Subject: CN=root_test,C=US
(...)
Note that if you had not added the trusted certificate in the previous step you
would have run into this error:
Could not install user cert at./client/cert.txt
Please add all trusted certificates before adding the user certificate
For the client (proceed the same way as for the server)
> orapki wallet create -wallet ./client_wallet -auto_login
> orapki wallet add -wallet ./client_wallet -dn CN=client_test,C=US
-keysize 2048
> orapki wallet export -wallet ./client_wallet -dn CN=client_test,C=US
-request ./client_wallet/creq.txt
> orapki cert create -wallet ./root -request ./client_wallet/creq.txt
-cert ./client_wallet/cert.txt -validity 3650
> orapki wallet add -wallet ./client_wallet -trusted_cert
-cert ./root/b64certificate.txt
> orapki wallet add -wallet ./client_wallet -user_cert
-cert ./client_wallet/cert.txt
To create a wallet that contains only the trusted certificate
For a wallet that would be used for the truststore only:
> orapki wallet create -wallet ./truststore -auto_login
> orapki wallet add -wallet ./truststore -trusted_cert
-cert ./root/b64certificate.txt
> orapki wallet display -wallet ./truststore
Requested Certificates:
User Certificates:
Trusted Certificates:
(...)
Subject: CN=root_test,C=US




For more details, see www.oracle.com/technology/tech/java/sqlj_jdbc/pdf/wp-oracle-jdbc_thin_ssl_2007.pdf -

