E
orapki Utility

This command creates a new self- signed (root) certificate and adds it to the wallet. The -validity parameter (mandatory) specifies the number of days, s tarting from the current date, that this certificate will be valid. You can specify a key size for this root certificate (-keyS ize) of 512, 1024, or 2048 bits.

To add a user certificate to an Oracle wallet:

orapki wallet add -wallet <wallet_location> -user_cert -cert <certificate_
lo
cation>

This command adds the user certificate at the location specified with the -cert parameter to the Oracle wallet at the <wallet_location>. Befor e you add a user certificate to a wallet, you must add all the trusted certificates that make up the certificate chain. If all truste d certificates are not installed in the wallet before you add the user certificate, then adding the user certificate will fail.

Exporting Certif icates and Certificate Requests from Oracle Wallets with orapki

To export a certificate from an Oracle wallet:< /dt>

orapki wallet export -wallet <wallet_location> -dn <
;certificate_dn> -cert 
<certificate_filename>

This command exports a certificate with the subject's distinguished name (-d n) from a wallet to a file that is specified by -cert.

To export a certificate request from an Oracle wallet:

orapki wallet export -wallet <wallet_location> -dn <certificate_request_dn> 
-request <certificate_request_filename>

This command exports a certificate request with the subject's disti nguished name (-dn) from a wallet to a file that is specified by -request.

Managing Certificate Revocation Lists (CRLs ) with orapki Utility

CRLs must be managed with orapki. This utility creates a hashed value of the CRL issuer's name to identify the CRLs location in your system. If you do not use or apki, your Oracle server cannot locate CRLs to validate PKI digital certificates. For detailed information about using o rapki to manage CRLs refer to "Certificate Revocation List Management".

orapki Utility Commands Summary

This section lists and describes the following orapki commands:

• orapki cert create
• orapki cert display< /a>
• orapki crl delete
• orapki crl display
• < /a>orapki crl hash
• orapki crl list
• orapki crl upload
< li class="LB1" type="disc">orapki wallet add
• < a name="638574">orapki wallet create
• orapki wallet display
• orapki wallet export

orapki cert create

Purpose

Use this c ommand to create a signed certificate for testing purposes.

Syntax

orapki cert c
reate [-wallet <wallet_location>] -request <certificate_request_
location> -cert <certificate_location> -validity <number_of_days> [-summa
ry]

• The -wallet paramete r specifies the wallet containing the user certificate and private key that will be used to sign the certificate request.
• The -request parameter (mandatory) specifies the location of the certificate request for the certificate you are creating.
• The -cert parameter (mandatory) specifies the directory location where the tool places the new signed certificate.
• The -validity parameter (mandatory) specifies the number of days, starting from the current date, that t his certificate will be valid.

orapki cert display

Purpose

Use this command to display details of a specific certificate.

Syntax

orapki cert d
isplay -cert <certificate_location> [-summary|-complete]

• The -cert parameter specifies the location of the certificate you wa nt to display.
• You can use either the -summary or the -compl ete parameter to display the following information:
  • -summary displays the certificate and its expiration date
  • -comp lete displays additional certificate information, including the serial number and public key

orapki crl delete

Purpose

Use this command to delete CRLs from Oracle Internet Direct ory. Note that the user who deletes CRLs from the directory by using orapki must be a member of the CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%) directory group.

orapki crl delete -issuer <issue
r_name> -ldap <hostname:ssl_port> -user 
<u
sername> [-wallet <wallet_location>] [-summary]

orapki crl display -crl <crl_location> [-wallet <wallet_location>] 
[-summary|-complete]

• The -crl parameter specifies the location of the CRL in the directory . It is convenient to paste the CRL location from the list that displays when you use the orapki crl list command. See < a href="asoappe.htm#638499">"orapki crl list"
• The -wallet parameter (optional) specifies the location of the wallet that contains the certificate of the certifica te authority (CA) who issued the CRL. Using it causes the tool to verify the validity of the CRL against the CA's certificate prior t o displaying it.
• Choosing either the -summary or the -complete parameters displ ays the following information:
  • -summary provides a listing that contains the CRL issuer's name and the CRL's validity period
  • -complete provides a list of all revoked certificates that the CRL contains. Note that this option may take a long time to display, depending on the size of the CRL.

orapki crl hash

Use this command to generate a hash value of the certificate revocation list (CRL) issuer to identify the location of the CRL in your file system for certificate validation.

Syntax

orapki crl hash -
crl <crl_filename|URL> [-wallet <wallet_location>] 
[-symlink|-copy]
<crl_directory> [-summary]

• The -crl parameter specifies the filename that contains the CRL or the URL where it can be found.< /li>
• The -wallet parameter (optional) specifies the location of the wal let that contains the certificate of the certificate authority (CA) who issued the CRL. Using it causes the tool to verify the validi ty of the CRL against the CA's certificate prior to uploading it to the directory.
• Depending on your operating system, use either the -symlink or the -copy parameter:
  < li class="LD2" type="CIRCLE">(UNIX) use -symlink to create a symbolic link to the CRL at the <crl_directory> location
  • (Windows) use -copy to cre ate a copy of the CRL at the <crl_directory> location
• The -summary parameter (optional) causes the tool to display the CRL issuer's name.

orapki crl list

Purpose

Use this command to display a list of CRLs stored in Oracle Internet D irectory. This is useful for browsing to locate a particular CRL to view or download to your local file system.

Syntax

orapki crl upload

Purpose

Use this command to upload certificate revocation lists (CRLs) to the CRL subtree in Oracle Internet Directory. Note that you must be a member of the di rectory administrative group CRLAdmins (cn=CRLAdmins,cn=groups,%s_OracleContextDN%) to upload CRLs to the d irectory.

S yntax

orapki crl upload -crl <crl_location> -ldap <hostname:ssl_port> -user <username> 
[-wallet <wallet_location>] [-summary]

• The -crl parameter specifies the directory location or the URL where the CRL i s located that you are uploading to the directory.
• The -ldap param eter specifies the hostname and SSL port for the directory where you are uploading the CRLs. Note that this must be a directory SSL p ort with no authentication. See "Uploading CRLs to Oracle Internet Directory" for more information about this port.
• The -user paramet er specifies the username of the directory user who has permission to add CRLs to the CRL subtree in the directory.
• The -wallet parameter specifies the location of the wallet that contains the certif icate of the certificate authority (CA) who issued the CRL. This is an optional parameter. Using it causes the tool to verify the val idity of the CRL against the CA's certificate prior to uploading it to the directory.
• The -summary parameter is also optional. Using it causes the tool to display the CRL issuer's name and the LDAP e ntry where the CRL is stored in the directory.

orapki wallet add

< h4 class="H3">Purpose

Use this command to add certificate requests and certificates to an Oracle wallet.

Syntax

To add certificate requests:

orapki walle
t add -wallet <wallet_location> -dn <user_dn> -keySize 
<512|1024|
2048>

• The -wallet par ameter specifies the location of the wallet to which you want to add a certificate request.
• The -dn parameter specifies the distinguished name of the certificate owner.
• The -keySize parameter specifies the key size for the certificate.
• To sign the request, export it with the export option. See "orapki wallet expor t"

To add trusted certificat es:

orapki wallet add -wallet <wallet_location> -tr
usted_cert -cert <certificate_
location>

• The -trusted_cert parameter causes the tool to add the trusted certificate, at the l ocation specified with -cert, to the wallet.

To add root certificates:

orapki wallet add -wallet <wallet_locati
on> -dn <certificate_dn> -keySize 
<512|1024|2048> -self_signed -validity <number_of_days>

• T he -self_signed parameter causes the tool to create a root certificate.
• The -validity parameter is mandatory. Use it to specify the number of days, starting from the current date, that t his root certificate will be valid.

To add user certificates:

orapki wallet add -wallet <wallet_location> -user_cert
 -cert <certificate_
location>

• The -user_cert parameter causes the tool to add the user certificate at the location specified with the -cert parameter to the wallet. Before you add a user certificate to a wallet, you must add all the trusted cer tificates that make up the certificate chain. If all trusted certificates are not installed in the wallet before you add the user cer tificate, then adding the user certificate will fail.

orapki wallet create

Purpose

Use this command to create an Oracle wallet or to set auto login on for an Oracle wallet.

< /a>

Syntax

orapki wallet create -wallet <wallet_location> [-auto_login]

• The -wallet parameter spec ifies a location for the new wallet or the location of the wallet for which you want to turn on auto login.
• The -auto_login parameter creates an auto login wallet, or it turns on automatic login for the wallet specified with the -wallet option. See "Using Auto Login" for details about auto login wallets.

orapki wallet displ ay

Purpose

Use this command to view the certificate reque sts, user certificates, and trusted certificates in an Oracle wallet.

Syntax

ora
pki wallet display -wallet <wallet_location>

• The -wallet parameter specifies a location for the wallet you want to open if it is not located in the current working directory.

orapki wallet export

Purpose

Use this command to export certificate requests and certificates from an Oracle wallet.

Syntax

To export a certificate from an Oracle wallet:

orapki wallet export -wallet <wallet_location> -dn <certific
ate_dn> -cert 
<certificate_filename>

• The -wallet parameter specifies the location of the wallet from which you want to export the certificate.
• The -dn parameter specifies the disting uished name of the certificate.
• The -cert parameter specifies the name of the file that contains the exported certificate.

To expor t a certificate request from an Oracle wallet:

orapki wallet export -wallet <wallet_location> -dn <certificate_request_dn> 
-request <certificate_request_filename>

• The -request parameter specifies the name of the file that contains the exported certificate request.

---

Previous< /a> Next

Copyright © 1996, 2003 Oracle Corporation All Rights Reserved.

Home Book List< /a> Contents Index Master&nbs p;Index Feedback