On Fri, Feb 20, 2004, Gabriel Fernando Castillo Contreras wrote: > I'm using Oracle HTTP Server is a part of the Oracle Application Server. > Although based on Apache web server, it doesn't come with Apache's > mod_ssl, instead supplying a proprietary mod_ossl module. > Instead of keeping SSL certificates and keys in the file system, > mod_ossl puts them in "Wallets" which it expects you to manipulate using > the convenient graphical interface of Oracle Wallet Manager. > Actually I have the certificate files, I need a way to add a existing > certificate and private key to a wallet. > In Oracle Wallet Manager, you can't import a site certificate as a user > certificate, because it won't let you import certificates that it > doesn't have CSRs for. And You can't import your old CSR even if you > have kept it, because it doesn't have the option for that either > > > I know, the wallet is an PKCS#12 file, I convert my CA Cerfitivacte > Verisign file plus private key plus > certificate to PKCS#12 format with the following openssl command: > > # openssl pkcs12 -export -certfile VersignCACertfile -inkey private.key > -in site-certificate -name 'central.sib.gob.gt' -certpbe PBE-SHA1-RC2-40 > -keypbe PBE-SHA1-3DES -noiter -out ewallet.p12 > > and next i tried to open with oracle wallet manager, but it doesn't > recognise, and show the unhelpful error message will claim the password > is incorrect. then i used other option of the command and obtain the > same result. > > # openssl pkcs12 -export -certfile VersignCACertfile -inkey private.key > -in site-certificate -name 'central.sib.gob.gt' -noiter -out ewallet.p12 > and used > > # openssl pkcs12 -export -certfile VersignCACertfile -inkey private.key > -in site-certificate -name 'central.sib.gob.gt' -out ewallet.p12 > > I'm think oracle wallet manager doesn't accept the pkcs#12 because of a > wrong option in the openssl command. What are the correct options, > > Someone has done this. How? >
Try the -info option on a PKCS#12 file that it will tolerate and try to keep the same parameters, things such as the certificate, private key and CA names (if any) as well as encryption algorithms and iteration counts. I notice you haven't included -nomaciter you could try that too. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
