How to import certificates for monitoring Oracle database with SSL authentication?
For users using Applications Manager version 14250 and below:
One-way SSL: (Client authentication disabled)
1. Open the command prompt using 'Run as administrator' option and navigate to the Applications Manager installation directory.
2. Import your trusted CA certificate(s) to AppManager_Home\working\Cert\apm.keystore
Navigate to AppManager_Home\working\jre\bin, execute the following command
keytool -importcert -file [FILE PATH TO CERTIFICATE] -keystore [AppManager_Home\working\Cert\apm.keystore] -alias alias
Example:
keytool -importcert -file C:\myFiles\clientCertificate.cer -keystore AppManager_Home\working\Cert\apm.keystore -alias apmClient
3. Restart Applications Manager to verify SSL connectivity while using Oracle database monitor.
You need to replace AppManager_Home with the actual directory path where AppManager is installed.
Alternatively, you can use KeyStore explorer. KeyStore Explorer is an open-source GUI replacement for the Java command-line utilities like keytool.
Two-way SSL:
1. Open the command prompt using 'Run as administrator' option and navigate to the Applications Manager installation directory.
2. Import your client certificate(s) to AppManager_Home\working\Cert\apm.keystore
Navigate to AppManager_Home\working\jre\bin, execute the following command
keytool -importcert -file [FILE PATH TO CERTIFICATE] -keystore [AppManager_Home\working\Cert\apm.keystore] -alias alias
Example:
keytool -importcert -file C:\myFiles\clientCertificate.cer -keystore AppManager_Home\working\Cert\apm.keystore -alias apmClient
If the client's certificate is in PKCS12 format, first set certificate password to appmanager. Then execute the following command to import the certificate in Keystore.
keytool -v -importkeystore -srckeystore [PATHTOCERTIFICATE] -srcstoretype PKCS12 -destkeystore AppManager_Home\working\Cert\apm.keystore -deststoretype JKS
Enter destination keystore password: (by default it is appmanager)
Enter source keystore password: appmanager
Entry for alias orakey successfully imported.
Example:
keytool -v -importkeystore -srckeystore C:\myFiles\orakey.p12 -srcstoretype PKCS12 -destkeystore AppManager_Home\working\Cert\apm.keystore -deststoretype JKS
3. Restart Applications Manager to verify SSL connectivity while using Oracle database monitor.
You need to replace AppManager_Home with the actual directory path where AppManager is installed.
Certificate password and Keystore password should match, which must be set to appmanager.
For users using Applications Manager version 14260 and above:
A new option to import SSL certificates from GUI was introduced with version 14260 release.
To import certificates with "Manage Certificates", follow the steps given below:
- Go to Admin--> Tools--> Manage Certificates.
- Once you enter, details of the "Certificate currently being used by Applications Manager" will be displayed under SSL configuration tab.
- If you want to import a new SSL certificate, click "Import new SSL certificate" button. You will be prompted to choose whether you want to Generate CSR or Import certificate.
- In case you choose Generate CSR, the following details need to be entered.
- After entering the details, click Generate to generate the certificate. If you want to reset the details you've entered, click Reset. On clicking the Generate button your CSR and private key files will be downloaded as a ZIP. Extract the file and use the "AppManager.csr" file to get a signed certificate from a CA of your choice.
- If you already have a valid certificate and key files (or) a keystore or a PFX file with the certificate, choose Import certificate and click choose file.
- Select the appropriate certificate and the key file.
- Verify the details and choose Import.
- If the certificate cannot be validated with trusted sources, you will be asked to provide the intermediate certificates and root certificate files. On successful import, you will be prompted to restart Applications Manager.
- If you are using a Keystore or a PFX file, you will be prompted to input the password for opening the file.
- On clicking Fetch, you will be provided with a list of Key-entries present in the Keystore. Choose a specific alias which is to be used to enable SSL in Applications Manager.
- You will be shown a preview of the certificate information, verify and click on Import for using the certificate.
- Finally you will be prompted to restart Applications Manager for the changes to take effect.
- If you want to import Trust Certificates, click on the "Trust Certificates" tab. Here you have 3 options to import certificates into trusted sources.
- Fetch certificate from a URL reachable from Applications Manager server.
- If you choose URL and provide the url of the service you want to trust, you will be prompted to verify and import the fetched certificate.
- Choose the SSL version from the drop-down menu. By default, it is set as auto.
- Click Import and it will be added to the trusted sources.
- Directly upload certificates from a Keystore/Truststore.
- If you choose this option, then you will have to browse and select the appropriate keystore/truststore/pfx file.
- Input the password and click Fetch.
- You will be shown a list of aliases availale in the truststore you can choose the ones you want and click Import.
- Directly upload certificates as files.
- Choose the necessary file.
- On clicking Import, it will be added to Applications Manager's trust store.
- Click List certificates tab to view the Keystore Password and List of certificates.
New to ADSelfService Plus?
Related Articles
How to import certificates for monitoring DB2 Server with SSL authentication?
By default, if you want to use self-signed certificates for SSL connection then the certificate generated by the DB2 server will be db2server.arm. But our AppManager doesn't support arm files. So it has to be renamed as the db2server.cer and then ...How to import certificates for monitoring Postgres Server with SSL authentication?
Error Message: The connection attempt failed! Reason: This error occurs when you are trying to add an SSL enabled server but the certificates which are used for SSL connection are not present in the cacerts. Solution: To import certificates, ...How to import certificates for monitoring MariaDB/MySQL DB Server with SSL authentication?
To monitor the MariaDB/MySQL, the respective MariaDB or MySQL driver must be utilized. In Applications Manager, the required driver can be selected in the Monitor Add/Edit page. MariaDB Driver connection If the monitor was added using MariaDB for ...How to import certificates for monitoring Websphere Application Server with SSL authentication?
For users using Applications Manager version 14250 and below: Client certificate in .cer format 1. Open the command prompt using 'Run as administrator' option and navigate to the Applications Manager installation directory. 2. Import your trusted CA ...Troubleshooting SSL Handshake Error
SSL Handshake Error SSL Handshake error occurs when a secure connection cannot be established to the URL added for monitoring. Common reasons for it are wrong SSL protocol version, incompatible ciphers, and invalid/missing client-side certificate. ...