Oracle & MySQL Support

InfraStack-Labs Oracle & MySQL DBA Services help you manage, maintain, and optimize your critical Oracle systems. We deliver 24/7, year-round support with flexible monthly contracts that don’t lock you in.

Please contact me :-

Wednesday, January 7, 2015

Oracle Apps R12: How To Renew SSL Certificate on Apps Tier in 5 minutes

1.      Set Your Environment
·         Logon to the application middle tier as the OS user who owns the middle tier files.
·         Source your middle tier environment file.
·         Navigate to the $INST_TOP/ora/10.1.3 and source the .env file to set your 10.1.3 ORACLE_HOME variables.

Note:- When working with wallets and certificates you MUST use the 10.1.3 executables.

2.      Deploy Certificate across Environment
export SYSTEM=ajiebs
export SSLDIR=/u01/app/applmgr${SYSTEM}/ssl_renew
mkdir -p $SSLDIR
chmod 700 $SSLDIR

3.      Copy new certificate and the CA certificate to the $SSLDIR directory e.g.
-rw-r--r--  1 applmgr oinstall 4198 Jul 26 10:30 chain.cer
-rw-r--r--  1 applmgr oinstall 1794 Jul 26 10:30
-rw-r--r--  1 applmgr oinstall  887 Jul 26 10:30

4.      Create the wallet

$ORACLE_HOME/Apache/Apache/bin/ssl2ossl -cert ${SSLENV}.cer -key ${SSLENV}.key -cafile ./chain.cer -wallet . -ssowallet yes

5.      The content of wallet can be listed e.g.
orapki wallet display -wallet $SSLDIR

Requested Certificates:
Subject:,OU=Information Technology,O=Lab Inc.,L=Bangalore,ST=India,C=IN
User Certificates:
Trusted Certificates:
Subject:        CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US
Subject:,OU=Information Technology,O=Lab Inc., L=Bangalore,ST=India,C=IN
Subject:        CN=Lab Inc. Enterprise Issuing CA1,O=Lab Inc.
Subject:        CN=Lab Inc. Enterprise CA,O=Lab Inc.

6.      Determine the current Apache's wallet directory
·         Which is the value of s_web_ssl_directory + Apache, by default it's $INST_TOP/certs/Apache
·         Create a new directory named BAK and move the default wallet's files to there
·         Install the new wallet

cd $SSLDIR/../
mv ssl ssl_bak_`date +%Y`
mv ssl_renew ssl
Some features of XML Publisher and BI Publisher require the server certficate to be present in cacerts file.

7.      Backup the existing cacerts file.
cp $OA_JRE_TOP/lib/security/cacerts $OA_JRE_TOP/lib/security/cacerts.bak.`date +%Y`

8.      Add new server cert to cacerts:
chmod u+w $OA_JRE_TOP/lib/security/cacerts

keytool -importcert -keystore $OA_JRE_TOP/lib/security/cacerts -alias ${SSLENV}.`date +%Y` -file ${SSLENV}.cer -v

9.      When prompted enter the keystore password.
10.  Restart APP Web Tier
11.  Restart oacore, forms, web listener processes




  1. Nice article.It was very interesting.

  2. It will surely spread technical awareness in people. Thanks for writing. People can also visit a website, mysslonline to install SSL certificate


Thanks for you valuable comments !