How to Use/Convert an ODSEE CA-Signed Certificate Chain to Use in an OUD PKCS12 Keystore
(Doc ID 2657916.1)
Last updated on JULY 10, 2023
Applies to:
Oracle Unified Directory - Version 12.2.1.3.0 and later Oracle Directory Server Enterprise Edition - Version 11.1.1.7.190716 and later Information in this document applies to any platform.
Goal
By default, OUD uses Java Keystores/Truststores.
When using keytool -list this Warning is given -
Warning: The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore <KEYSTORE> -destkeystore <KEYSTORE> -deststoretype pkcs12".
This document shows how to use / convert an ODSEE CA-signed certificate chain to use in an OUD PKCS12 keystore
Create the ODSEE certificate chain which consists of a -
CA-signed server cert
CA cert
Verify that ldapsearch is successful using the ODSEE cert DB (which contains the certificate chain)
Using pk12util, create the PKCS12 file using the ODSEE cert DB
Create a new OUD instance and configure the OUD LDAPS Connection Handler to use the PKCS12 Key Manager Provider with the PKCS12 file
Verify that ldapsearch is successful using the PKCS12 file
Configure the OUD Administration Connector to use the same PKCS12 file
Test the OUD Administration Connector using ldapsearch and dsconfig
Solution
To view full details, sign in with your My Oracle Support account.
Don't have a My Oracle Support account? Click to get started!
