---
# === IDENTITY ===
id: business/erp-integration/oracle-certificate-management/2026
canonical_question: "How do you manage Oracle ERP Cloud SSL/TLS certificates, wallet management, and rotation?"
aliases:
  - "Oracle Fusion Cloud SSL certificate management"
  - "Oracle ERP Cloud TLS certificate rotation and renewal"
  - "Oracle Cloud wallet management for integrations"
  - "How to import SSL certificates into Oracle Fusion trust keystore"
entity_type: erp_integration
domain: business > erp-integration > oracle-certificate-management
region: global
jurisdiction: global
temporal_scope: 2025-2026

# === SYSTEM PROFILE ===
systems:
  - name: "Oracle ERP Cloud (Fusion Cloud Applications)"
    vendor: "Oracle"
    version: "Release 24C/25A"
    edition: "Enterprise"
    deployment: "cloud"
    api_surface: "REST, SOAP, FBDI"

# === VERIFICATION ===
last_verified: 2026-03-09
confidence: 0.87
version: 1.0
first_published: 2026-03-09

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: volatile
  last_breaking_change: "Release 24B TLS 1.3 enforcement"
  next_review: 2026-09-05
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "Oracle manages SaaS-tier TLS certificates automatically; customers cannot replace them"
  - "Outbound integration certificates must be imported into fusion_trust.jks via self-service (11.12.1.0.0+)"
  - "Oracle renews SaaS TLS certificates every 6 months; integration partners must re-download after renewal"
  - "Only PEM and Base64-encoded DER formats supported for trust certificate import; DER binary requires orapki"
  - "JKS keystores require all private keys to share the same password"
  - "OCI Certificates service limits apply per-tenancy; check service limits for CA and certificate counts"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "User needs Oracle Autonomous Database wallet rotation (mTLS)"
    use_instead: "Search knowledgelib.io for Autonomous Database wallet rotation (mTLS) - no dedicated unit yet"
  - condition: "User needs Oracle Integration Cloud (OIC) certificate upload only"
    use_instead: "Search knowledgelib.io for OIC certificate upload - no dedicated unit yet"
  - condition: "User needs OCI infrastructure load balancer SSL termination"
    use_instead: "Search knowledgelib.io for OCI load balancer SSL termination - no dedicated unit yet"

# === AGENT HINTS ===
inputs_needed:
  - key: certificate_scope
    question: "Which Oracle certificate scope do you need?"
    type: choice
    options:
      - "SaaS TLS (Oracle-managed, Fusion Applications inbound)"
      - "outbound integration (customer-managed trust certificates)"
      - "OCI infrastructure (load balancer, API gateway)"
      - "database connectivity (wallet/mTLS)"
  - key: integration_direction
    question: "What is the certificate flow direction?"
    type: choice
    options:
      - "inbound (clients connecting to Oracle ERP)"
      - "outbound (Oracle ERP calling external services)"
      - "mutual TLS (two-way SSL)"
  - key: environment
    question: "Which environment?"
    type: choice
    options:
      - "production"
      - "test/staging"
      - "development"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/business/erp-integration/oracle-certificate-management/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-09)"

# === RELATED UNITS ===
related_kos:
  depends_on: []
  related_to:
    - id: "business/erp-integration/oracle-erp-cloud-rest-api-capabilities/2026"
      label: "Oracle ERP Cloud (Fusion) REST API capabilities — 499-record pagination, expand vs fields, CRUD"
  solves: []
  alternative_to: []
  often_confused_with: []

# === SOURCES ===
sources:
  - id: src1
    title: "Upload an SSL Certificate — Oracle Integration 3 Documentation"
    author: Oracle
    url: https://docs.oracle.com/en/cloud/paas/application-integration/oracle-integration-oci/upload-ssl-certificate.html
    type: official_docs
    published: 2025-12-01
    reliability: authoritative
  - id: src2
    title: "Overview of Certificates — OCI Certificates Service"
    author: Oracle
    url: https://docs.oracle.com/en-us/iaas/Content/certificates/overview.htm
    type: official_docs
    published: 2025-11-01
    reliability: authoritative
  - id: src3
    title: "Periodic TLS Certificate Renewal — Oracle Fusion Cloud"
    author: Oracle
    url: https://docs.oracle.com/en/cloud/saas/enterprise-performance-management-common/cgsad/tls_certificate_annual_renewal.html
    type: official_docs
    published: 2025-10-01
    reliability: authoritative
  - id: src4
    title: "Managing Keystores, Wallets, and Certificates — Oracle Fusion Middleware"
    author: Oracle
    url: https://docs.oracle.com/cloud/latest/fmw122100/ASADM/wallets.htm
    type: official_docs
    published: 2025-06-01
    reliability: authoritative
  - id: src5
    title: "Import SSL Certificate Into Fusion Applications Trust Keystore (Doc ID 2369771.1)"
    author: Oracle Support
    url: https://support.oracle.com/knowledge/Oracle%20Cloud/2369771_1.html
    type: official_docs
    published: 2024-08-01
    reliability: authoritative
  - id: src6
    title: "Oracle Wallet Manager and orapki — Oracle Database Security Guide"
    author: Oracle
    url: https://docs.oracle.com/en/database/oracle/oracle-database/26/dbseg/using-the-orapki-utility-to-manage-pki-elements.html
    type: official_docs
    published: 2025-09-01
    reliability: authoritative
  - id: src7
    title: "Fusion Applications Cloud SSL Certificate Renewal FAQ (Doc ID 2262079.1)"
    author: Oracle Support
    url: https://support.oracle.com/knowledge/Oracle%20Cloud/2262079_1.html
    type: official_docs
    published: 2024-12-01
    reliability: high
---

# Oracle ERP Cloud SSL/TLS Certificate Management

## TL;DR

- **Bottom line**: Oracle manages SaaS-tier TLS certificates automatically with 6-month renewal cycles, but customers must manage outbound integration certificates themselves by importing third-party CA certs into the fusion_trust.jks keystore.
- **Key limit**: Oracle renews SaaS certificates every 6 months; integration partners using downloaded certificates must re-download and redeploy within the renewal window or face connection failures.
- **Watch out for**: Outbound calls from Fusion Applications to external HTTPS endpoints fail silently when the external service's CA certificate is missing from fusion_trust.jks -- the error appears as a generic SSL handshake failure with no clear indication of the missing trust anchor.
- **Best for**: Any Oracle ERP Cloud integration requiring secure communication -- inbound TLS (Oracle-managed), outbound SSL trust (customer-managed), or mutual TLS for high-security integrations.
- **Authentication**: Certificate management is separate from API authentication (OAuth 2.0); certificates establish the transport-layer trust, while OAuth handles application-layer authorization.

## System Profile

This card covers SSL/TLS certificate lifecycle management across the Oracle ERP Cloud (Fusion Cloud Applications) ecosystem. It spans three distinct certificate domains: (1) Oracle-managed SaaS TLS certificates that secure inbound connections to Fusion Applications, (2) customer-managed trust certificates in the fusion_trust.jks keystore for outbound integrations, and (3) OCI Certificates service for infrastructure-level certificate management. The card does not cover Oracle Autonomous Database wallet rotation (mTLS) or Oracle Integration Cloud (OIC) adapter-specific certificate configuration, which are documented in separate units.

| Property | Value |
|---|---|
| **Vendor** | Oracle |
| **System** | Oracle ERP Cloud (Fusion Cloud Applications), Release 24C/25A |
| **API Surface** | REST, SOAP, FBDI (certificate management is transport-layer, not API-specific) |
| **Current Release** | 25A (February 2025 quarterly update) |
| **Editions Covered** | Enterprise (SaaS) |
| **Deployment** | Cloud |
| **API Docs** | [Oracle Cloud Security Documentation](https://docs.oracle.com/en/cloud/saas/) |
| **Status** | GA |

## API Surfaces & Capabilities

Certificate management in Oracle ERP Cloud does not use a single API surface. Instead, certificates are managed through multiple interfaces depending on the certificate scope:

| Certificate Scope | Management Interface | Format | Automation | Who Manages |
|---|---|---|---|---|
| SaaS TLS (inbound) | Oracle-managed (no customer action) | X.509 | Automatic 6-month renewal | Oracle |
| Outbound trust (fusion_trust.jks) | Self-service UI or SR (11.12.1.0.0+) | PEM, Base64 DER | Manual import required | Customer |
| OIC adapter certificates | OIC Console > Settings > Certificates | JKS, CER, CRT | Manual upload; filter by expiry | Customer |
| OCI infrastructure certificates | OCI Console / REST API / CLI | PEM | Auto-renewal configurable | Customer or OCI-managed |
| Middleware wallets (on-prem/hybrid) | WLST, orapki, Fusion Middleware Control | Oracle Wallet (PKCS#12), JKS | Script-automatable via orapki | Customer |
| Signing keys (OIC) | OIC Console > Settings > Certificates | PKCS1, PKCS8 | Manual upload | Customer |

## Rate Limits & Quotas

Certificate management operations are not subject to API rate limits in the traditional sense. However, the following operational limits apply:

### Per-Request Limits

| Limit Type | Value | Applies To | Notes |
|---|---|---|---|
| Max certificates per OIC instance | ~500 | Oracle Integration Cloud | Practical limit; no hard documented cap |
| Max CAs per OCI tenancy | Service-limit dependent | OCI Certificates service | Request increase via support |
| Max certificates per OCI CA | 1,000 (default) | OCI Certificates service | Configurable via service limit increase |
| JKS private key password | Single shared password | All private keys in a JKS file | Different passwords per key prevent extraction |

### Rolling / Daily Limits

| Limit Type | Value | Window | Notes |
|---|---|---|---|
| SaaS TLS renewal cycle | Every 6 months | Per certificate | Oracle-managed; no customer control over timing |
| OCI certificate auto-renewal | Configurable | Per certificate policy | Set renewal rules in OCI Certificates service |
| Oracle wallet auto-login validity | No expiry | Until explicitly rotated | Auto-login wallets (cwallet.sso) do not expire |
| Self-signed certificate validity (FMW) | 5 years | From creation | Fusion Middleware Control default |

## Authentication

Certificate management authentication depends on the management interface being used:

| Interface | Auth Method | Access Level | Notes |
|---|---|---|---|
| Fusion Applications self-service | Fusion Apps login (SAML/SSO) | Security Administrator role | For fusion_trust.jks imports |
| OIC Console | OIC admin credentials | ServiceAdministrator role | Upload trust/identity certificates |
| OCI Console | OCI IAM (API key or session) | Certificate-Manager policy | Manage OCI Certificates service resources |
| WLST (Middleware) | WebLogic admin credentials | WebLogic Admin | connect('weblogic','password') |
| orapki (CLI) | OS-level access + wallet password | File system permissions | No network auth required |

### Authentication Gotchas

- Certificate management authentication is entirely separate from the OAuth 2.0 flows used for ERP API calls -- having API access does not grant certificate management permissions. [src1]
- OCI Certificates service requires IAM policies granting explicit access to the certificates family of resources; default tenancy admin policies do not include certificate management. [src2]
- WLST sessions require the Admin Server to be running; if the Admin Server is down, use orapki for direct wallet manipulation. [src4]

## Constraints
<!-- Agents: read this section before recommending any integration approach from this unit.
     These are hard constraints that must not be violated. -->

- Oracle-managed SaaS TLS certificates cannot be replaced, customized, or pinned by customers -- any integration that certificate-pins to Oracle's SaaS endpoint will break at the next 6-month renewal cycle.
- Outbound SSL calls from Fusion Applications require the external service's CA certificate chain to be present in fusion_trust.jks; missing intermediate certificates cause handshake failures even if the root CA is trusted.
- DER-encoded (binary) certificates cannot be imported via Fusion Middleware Control or WLST -- use orapki exclusively for DER format imports. [src4]
- All private keys within a single JKS keystore must share the same password; mixing passwords prevents key extraction and causes cryptic runtime errors. [src1]
- Self-service certificate import into fusion_trust.jks is only available from Oracle Fusion release 11.12.1.0.0 and later; earlier releases require an Oracle Service Request (SR). [src5]
- OCI Certificates service does not support mixed certificate chains (RSA + ECDSA in the same chain); use separate CA hierarchies for different key algorithm families. [src2]

## Integration Pattern Decision Tree

```
START -- Certificate management for Oracle ERP Cloud
|-- What type of certificate operation?
|   |-- Inbound TLS (clients connecting to Oracle ERP)
|   |   |-- SaaS environment?
|   |   |   |-- YES --> Oracle-managed, no action needed
|   |   |   |           (renews every 6 months automatically)
|   |   |   +-- NO (on-prem/hybrid) --> Manage via WLST or FMW Control
|   |   +-- Need custom domain certificate?
|   |       |-- YES --> Not supported for SaaS; use OCI LB for custom domains
|   |       +-- NO --> Oracle default certificate applies automatically
|   |-- Outbound SSL (Oracle ERP calling external services)
|   |   |-- External CA already in fusion_trust.jks?
|   |   |   |-- YES --> No action needed
|   |   |   +-- NO --> Import CA cert via self-service or SR
|   |   |-- Need mutual TLS (two-way SSL)?
|   |   |   |-- YES --> Upload identity cert (.jks) to OIC + trust cert to target
|   |   |   +-- NO --> Trust certificate import only
|   |   +-- Using Oracle Integration Cloud (OIC) as middleware?
|   |       |-- YES --> Upload via OIC Console > Settings > Certificates
|   |       +-- NO --> Import directly into fusion_trust.jks
|   |-- OCI infrastructure certificates
|   |   |-- Need auto-renewal?
|   |   |   |-- YES --> Use OCI Certificates service with renewal policy
|   |   |   +-- NO --> Import third-party cert manually
|   |   +-- Load balancer SSL termination?
|   |       |-- YES --> Associate cert via OCI LB configuration
|   |       +-- NO --> Apply cert to specific OCI service
|   +-- Certificate rotation / renewal
|       |-- SaaS TLS renewal?
|       |   +-- Oracle handles automatically; re-download if using stored certs
|       |-- Integration partner certificates?
|       |   +-- Monitor expiry; re-import before expiration
|       +-- OCI managed certificates?
|           +-- Configure auto-renewal policy in OCI Certificates service
+-- Certificate format conversion needed?
    |-- PEM to JKS --> Use keytool: keytool -importcert -keystore keystore.jks
    |-- JKS to PKCS#12 --> Use orapki: orapki wallet jks_to_pkcs12
    |-- PKCS#12 to JKS --> Use orapki: orapki wallet pkcs12_to_jks
    +-- DER to PEM --> Use openssl: openssl x509 -inform der -outform pem
```

## Quick Reference

### Certificate Format Compatibility Matrix

| Format | Import to fusion_trust.jks | Import to OIC | Import to Oracle Wallet | Import to OCI Certificates | Notes |
|---|---|---|---|---|---|
| PEM (.pem, .crt) | Yes (Base64) | Yes (.cer, .crt) | Yes (via orapki or WLST) | Yes | Most compatible format |
| DER (.der, .cer binary) | No (use orapki) | No | Yes (orapki only) | No | Convert to PEM first for most tools |
| JKS (.jks) | N/A (is a keystore) | Yes (identity certs) | Convert via orapki | No | Java-specific keystore format |
| PKCS#12 (.p12, .pfx) | No (extract certs first) | No | Yes (ewallet.p12 is PKCS#12) | No | Oracle Wallet native format |
| PKCS#7 (.p7b) | No | No | Yes (trusted chain import) | No | Certificate chain format |
| PKCS1/PKCS8 (keys) | N/A (private keys) | Yes (signing keys) | N/A | N/A | OIC signing key upload only |

### Common keytool Commands for Oracle ERP Integration

| Operation | Command | Notes |
|---|---|---|
| List certificates in JKS | `keytool -list -keystore fusion_trust.jks -storepass <password>` | View all trusted CAs |
| Import CA certificate | `keytool -importcert -alias <alias> -file ca.pem -keystore fusion_trust.jks -storepass <password>` | Add external CA trust |
| Export certificate | `keytool -exportcert -alias <alias> -keystore fusion_trust.jks -file cert.pem -rfc` | Extract in PEM format (-rfc flag) |
| Delete certificate | `keytool -delete -alias <alias> -keystore fusion_trust.jks -storepass <password>` | Remove expired/revoked cert |
| Check expiry | `keytool -list -v -keystore fusion_trust.jks -storepass <password> | grep "Valid from"` | Monitor expiration dates |
| Create new JKS | `keytool -genkeypair -alias <alias> -keyalg RSA -keysize 2048 -keystore new.jks` | For identity keystores |
| Import PKCS#12 to JKS | `keytool -importkeystore -srckeystore cert.p12 -srcstoretype PKCS12 -destkeystore dest.jks` | Format conversion |

## Step-by-Step Integration Guide

### 1. Determine your certificate scope and current state

Before making any certificate changes, identify which certificate domain you are working with and what is currently configured. Oracle ERP Cloud has distinct certificate management paths for SaaS TLS, outbound trust, and OCI infrastructure. [src1, src3]

```bash
# For OCI infrastructure -- list certificates in your tenancy
oci certs-mgmt certificate list --compartment-id <compartment_ocid> --all

# For OIC -- list certificates via REST API
curl -X GET \
  "https://<oic-instance>.integration.ocp.oraclecloud.com/ic/api/integration/v1/certificates" \
  -H "Authorization: Bearer <access_token>" \
  -H "Accept: application/json"

# For JKS keystore -- list contents
keytool -list -v -keystore fusion_trust.jks -storepass <password>
```

**Verify**: Check the output for certificate aliases, expiry dates, and issuer chains. Any certificate expiring within 30 days needs immediate attention.

### 2. Import a trust certificate for outbound integration

When Oracle ERP Cloud needs to call an external HTTPS endpoint whose CA is not already trusted, you must import the CA certificate chain. [src5]

```bash
# Step 1: Download the external service's CA certificate chain
# Use openssl to extract the full chain from the target endpoint
openssl s_client -connect api.external-service.com:443 -showcerts </dev/null 2>/dev/null \
  | openssl x509 -outform PEM > external_ca.pem

# Step 2: Verify the downloaded certificate
openssl x509 -in external_ca.pem -text -noout | head -20

# Step 3: Import into fusion_trust.jks (if you have direct access)
keytool -importcert \
  -alias external-service-ca \
  -file external_ca.pem \
  -keystore fusion_trust.jks \
  -storepass <password> \
  -noprompt

# Step 4: Verify the import
keytool -list -keystore fusion_trust.jks -storepass <password> | grep external-service-ca
```

**Verify**: `keytool -list -keystore fusion_trust.jks -storepass <password> -alias external-service-ca` should display the certificate details with the correct issuer and validity dates.

### 3. Upload certificates to Oracle Integration Cloud (OIC)

For integrations routed through Oracle Integration Cloud, certificates are uploaded via the OIC Console. [src1]

```bash
# For trust certificates (outbound SSL validation):
# 1. Navigate to OIC Console > Settings > Certificates
# 2. Click Upload
# 3. Certificate Type: X.509 (SSL Transport)
# 4. Category: Trust
# 5. Enter alias name (e.g., "external-api-ca-2026")
# 6. Browse and select the .cer or .crt file
# 7. Click Upload

# For identity certificates (mutual TLS / two-way SSL):
# 1. Same navigation as above
# 2. Certificate Type: X.509 (SSL Transport)
# 3. Category: Identity
# 4. Enter alias name
# 5. Browse and select the .jks keystore file
# 6. Enter the keystore password
# 7. Enter comma-separated passwords for key aliases
# 8. Click Upload

# Verify via OIC REST API:
curl -X GET \
  "https://<oic-instance>.integration.ocp.oraclecloud.com/ic/api/integration/v1/certificates?q=external-api" \
  -H "Authorization: Bearer <access_token>"
```

**Verify**: The certificate should appear in the OIC Certificates list with status "Active" and the correct expiration date.

### 4. Configure OCI Certificates service for auto-renewal

For OCI infrastructure certificates (load balancers, API gateways), use the OCI Certificates service to enable automatic renewal. [src2]

```bash
# Create a CA in OCI Certificates service
oci certs-mgmt certificate-authority create-root-ca-by-generating-internally \
  --compartment-id <compartment_ocid> \
  --name "erp-integration-ca" \
  --certificate-authority-config '{"configType":"ROOT_CA_GENERATED_INTERNALLY","subject":{"commonName":"ERP Integration CA","organization":"YourOrg"},"signingAlgorithm":"SHA256_WITH_RSA","validity":{"timeOfValidityNotAfter":"2028-03-09T00:00:00Z"}}' \
  --kms-key-id <vault_key_ocid>

# Issue a certificate with auto-renewal
oci certs-mgmt certificate create-by-generating-internally \
  --compartment-id <compartment_ocid> \
  --name "erp-api-endpoint" \
  --certificate-config '{"configType":"ISSUED_BY_INTERNAL_CA","issuerCertificateAuthorityId":"<ca_ocid>","subject":{"commonName":"api.yourdomain.com"},"certChainDepth":0,"signingAlgorithm":"SHA256_WITH_RSA","validity":{"timeOfValidityNotAfter":"2027-03-09T00:00:00Z"}}' \
  --certificate-rules '[{"ruleType":"CERTIFICATE_RENEWAL_RULE","renewalInterval":"P90D","advanceRenewalPeriod":"P30D"}]'

# Verify auto-renewal configuration
oci certs-mgmt certificate get --certificate-id <cert_ocid> \
  --query 'data.{"name":name,"lifecycle-state":"lifecycle-state","current-version":"current-version-summary"}'
```

**Verify**: `oci certs-mgmt certificate get --certificate-id <cert_ocid>` should show the renewal rules and the next scheduled renewal date.

### 5. Handle Oracle SaaS TLS certificate renewal (6-month cycle)

Oracle automatically renews SaaS TLS certificates every 6 months. If your integration stores or pins Oracle's certificate, you must update it after each renewal. [src3, src7]

```bash
# Step 1: Check when the current Oracle SaaS certificate expires
openssl s_client -connect <your-fusion-instance>.oraclecloud.com:443 -servername <your-fusion-instance>.oraclecloud.com </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

# Step 2: Download the new certificate after renewal
openssl s_client -connect <your-fusion-instance>.oraclecloud.com:443 -showcerts </dev/null 2>/dev/null \
  | openssl x509 -outform PEM > oracle_fusion_new.pem

# Step 3: Update your integration's trust store
keytool -delete -alias oracle-fusion-saas -keystore integration_trust.jks -storepass <password> 2>/dev/null
keytool -importcert \
  -alias oracle-fusion-saas \
  -file oracle_fusion_new.pem \
  -keystore integration_trust.jks \
  -storepass <password> \
  -noprompt

# Step 4: Verify chain validity
openssl verify -CAfile oracle_fusion_new.pem oracle_fusion_new.pem
```

**Verify**: After updating, test the integration endpoint. A successful HTTPS connection confirms the new certificate is trusted.

## Code Examples

### Python: Monitor certificate expiry and alert before renewal deadline

```python
# Input:  Oracle ERP Cloud hostname, trust keystore path
# Output: Certificate expiry report with days-until-expiry and alert status

import ssl
import socket
import datetime
import json

def check_oracle_cert_expiry(hostname, port=443):
    """Check SSL certificate expiry for an Oracle ERP Cloud endpoint."""
    context = ssl.create_default_context()
    with socket.create_connection((hostname, port), timeout=10) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            cert = ssock.getpeercert()
            not_after = datetime.datetime.strptime(
                cert['notAfter'], '%b %d %H:%M:%S %Y %Z'
            )
            days_left = (not_after - datetime.datetime.utcnow()).days
            return {
                'hostname': hostname,
                'issuer': dict(x[0] for x in cert['issuer']),
                'subject': dict(x[0] for x in cert['subject']),
                'not_after': not_after.isoformat(),
                'days_until_expiry': days_left,
                'needs_renewal': days_left < 30,
                'critical': days_left < 7
            }

# Check Oracle Fusion Cloud endpoint
result = check_oracle_cert_expiry('your-instance.fa.us2.oraclecloud.com')
print(json.dumps(result, indent=2))

if result['critical']:
    print('CRITICAL: Certificate expires in less than 7 days!')
elif result['needs_renewal']:
    print('WARNING: Certificate expires in less than 30 days.')
```

### Bash: Automated certificate chain extraction and validation

```bash
#!/bin/bash
# Input:  Target Oracle ERP Cloud hostname
# Output: Full certificate chain saved as PEM files + validation report

HOST="${1:-your-instance.fa.us2.oraclecloud.com}"
PORT="${2:-443}"
OUTPUT_DIR="./oracle_certs_$(date +%Y%m%d)"

mkdir -p "$OUTPUT_DIR"

echo "Extracting certificate chain from $HOST:$PORT..."

# Extract full chain
openssl s_client -connect "$HOST:$PORT" \
  -servername "$HOST" \
  -showcerts </dev/null 2>/dev/null > "$OUTPUT_DIR/full_chain.pem"

# Extract leaf certificate
openssl s_client -connect "$HOST:$PORT" \
  -servername "$HOST" </dev/null 2>/dev/null \
  | openssl x509 -outform PEM > "$OUTPUT_DIR/leaf.pem"

# Display certificate details
echo "=== Certificate Details ==="
openssl x509 -in "$OUTPUT_DIR/leaf.pem" -noout \
  -subject -issuer -dates -serial

# Check TLS version
echo "=== TLS Version ==="
openssl s_client -connect "$HOST:$PORT" \
  -servername "$HOST" </dev/null 2>/dev/null \
  | grep "Protocol  :"

echo "Certificates saved to $OUTPUT_DIR/"
```

### cURL: Quick Oracle ERP Cloud SSL diagnostics

```bash
# Input:  Oracle ERP Cloud instance URL
# Output: SSL handshake details, certificate info, connection status

# Test SSL connectivity and show certificate details
curl -vvv --head \
  "https://your-instance.fa.us2.oraclecloud.com/" \
  2>&1 | grep -E "(SSL|TLS|subject|issuer|expire|CN)"

# Test with specific TLS version (1.2 minimum for Oracle Cloud)
curl --tlsv1.2 --head \
  "https://your-instance.fa.us2.oraclecloud.com/" \
  -w "HTTP Code: %{http_code}\nSSL Verify: %{ssl_verify_result}\n" \
  -o /dev/null -s

# Download and inspect the server certificate
echo | openssl s_client \
  -connect your-instance.fa.us2.oraclecloud.com:443 \
  -servername your-instance.fa.us2.oraclecloud.com 2>/dev/null \
  | openssl x509 -noout -text | head -30
```

## Data Mapping

### Certificate Format Conversion Reference

| Source Format | Target Format | Tool | Command | Gotcha |
|---|---|---|---|---|
| PEM (.pem) | DER (.der) | openssl | `openssl x509 -in cert.pem -outform DER -out cert.der` | DER is binary; cannot be pasted into text fields |
| DER (.der) | PEM (.pem) | openssl | `openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem` | Required before importing to most Oracle tools |
| PEM (.pem) | JKS (.jks) | keytool | `keytool -importcert -file cert.pem -keystore store.jks -alias myalias` | Must import CA chain in correct order (leaf last) |
| JKS (.jks) | PKCS#12 (.p12) | keytool | `keytool -importkeystore -srckeystore in.jks -destkeystore out.p12 -deststoretype PKCS12` | PKCS#12 is Oracle Wallet native format |
| PKCS#12 (.p12) | JKS (.jks) | orapki | `orapki wallet pkcs12_to_jks -wallet wallet_dir -jksKeyStoreLoc out.jks -jksKeyStorepwd pwd` | orapki required; keytool alternative exists |
| PKCS#12 (.p12) | Oracle Wallet | orapki | `orapki wallet import_pkcs12 -wallet wallet_dir -pkcs12file cert.p12` | Creates ewallet.p12 + cwallet.sso |
| PEM key + cert | PKCS#12 | openssl | `openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.p12` | Include -chain flag for full chain |

### Data Type Gotchas

- Oracle Wallet files (ewallet.p12 and cwallet.sso) are PKCS#12 format internally but with Oracle-specific wrapper; standard PKCS#12 tools may not read them correctly -- always use orapki for Oracle Wallet manipulation. [src6]
- Certificate serial numbers in Oracle tools are displayed in hexadecimal, while some external CA portals show decimal -- convert before comparing. [src4]
- PEM files must not contain Windows-style line endings (CRLF); Oracle tools on Linux/Unix will reject PEM files with \r\n line endings -- use dos2unix before import. [src4]
- Oracle Integration Cloud silently strips BOM (byte order mark) from uploaded PEM files, but orapki does not -- ensure PEM files are UTF-8 without BOM. [src1]

## Error Handling & Failure Points

### Common Error Codes

| Error | Meaning | Cause | Resolution |
|---|---|---|---|
| `javax.net.ssl.SSLHandshakeException` | SSL handshake failure | Missing or expired CA certificate in trust store | Import the CA certificate chain into fusion_trust.jks or OIC |
| `PKIX path building failed` | Certificate chain validation failure | Intermediate CA certificate missing from trust store | Import the complete certificate chain, not just the leaf cert |
| `sun.security.validator.ValidatorException` | Certificate not trusted | Self-signed cert or unknown CA | Import CA cert; for dev, consider adding self-signed to trust store |
| `certificate_unknown` TLS alert | Server does not recognize client certificate | Wrong client cert or cert not in server's trust store | Verify client cert matches the identity expected by the server |
| `ORA-28759` | Failure to open Oracle Wallet | Wrong wallet password or corrupted wallet file | Verify password; recreate wallet if corrupted |
| `ORA-28864` | SSL connection closed gracefully | TLS version mismatch (server requires 1.2+, client sends 1.0/1.1) | Update client to TLS 1.2 minimum; Oracle enforces TLS 1.2+ since 24B |
| `IOException: Keystore was tampered with` | JKS integrity check failed | Wrong keystore password or file corruption | Verify password; restore from backup if corrupted |
| OIC certificate upload fails | Certificate format not recognized | Wrong file extension or encoding mismatch | Convert to PEM/Base64; ensure .cer or .crt extension for trust certs |

### Failure Points in Production

- **Silent outbound SSL failure**: Oracle ERP Cloud outbound web service calls fail with generic "connection refused" when the target's CA cert is missing from fusion_trust.jks. The error log does not clearly state "certificate not trusted." Fix: `Always test outbound connectivity after any certificate change using a simple REST call before deploying full integration.` [src5]
- **6-month renewal surprise**: Integration partners who download and store Oracle's SaaS TLS certificate get unexpected SSL failures when Oracle renews. Fix: `Never pin to Oracle's leaf certificate; trust the CA chain instead. Set calendar reminders for Oracle's 6-month renewal cycle.` [src3]
- **Incomplete certificate chain**: Importing only the leaf certificate without intermediate CAs causes validation failures in some Java versions. Fix: `Always download and import the full certificate chain using openssl s_client -showcerts.` [src4]
- **JKS password mismatch**: All private keys in a JKS keystore must share the same password. Using different passwords per key causes `UnrecoverableKeyException` at runtime with no clear diagnostic. Fix: `When creating JKS keystores, always use -keypass identical to -storepass.` [src1]
- **Auto-login wallet permissions**: Oracle auto-login wallets (cwallet.sso) rely on file system permissions for security. If permissions are too open (world-readable), security audits flag the wallet. If too restrictive, the application cannot read it. Fix: `Set permissions to 600 (owner read/write only) and ensure the application user owns the file.` [src4]
- **TLS 1.3 cipher mismatch**: After Oracle's TLS 1.3 enforcement in Release 24B, older integration clients using TLS 1.1 or cipher suites not in the TLS 1.3 specification fail to connect. Fix: `Update client libraries to support TLS 1.2+ and verify cipher suite compatibility.` [src7]

## Anti-Patterns

### Wrong: Certificate pinning to Oracle SaaS leaf certificate

```bash
# BAD -- pinning to the leaf certificate that Oracle rotates every 6 months
# This WILL break when Oracle renews the certificate
openssl s_client -connect instance.oraclecloud.com:443 </dev/null 2>/dev/null \
  | openssl x509 -outform PEM > pinned_cert.pem
# Then hardcoding the SHA-256 fingerprint of this specific cert
PINNED_HASH="sha256//AbCdEf123456..."
# Integration fails silently after Oracle's next renewal cycle
```

### Correct: Trust the CA chain, not the leaf certificate

```bash
# GOOD -- trust the Certificate Authority, which persists across renewals
# Extract the CA (issuer) certificate from the chain
openssl s_client -connect instance.oraclecloud.com:443 -showcerts </dev/null 2>/dev/null \
  | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{print}' | tail -n +2 > ca_chain.pem
# Import the CA into your trust store -- survives leaf cert renewals
keytool -importcert -alias oracle-ca -file ca_chain.pem \
  -keystore integration_trust.jks -storepass changeit -noprompt
```

### Wrong: Importing only the leaf certificate for outbound trust

```bash
# BAD -- importing only the server's leaf certificate into fusion_trust.jks
keytool -importcert -alias external-api \
  -file external_leaf_only.pem \
  -keystore fusion_trust.jks -storepass <password>
# This fails when the external service renews its leaf cert
# (even if they use the same CA)
```

### Correct: Import the full CA chain for outbound trust

```bash
# GOOD -- import the root CA and any intermediate CAs
# These persist even when the external service renews its leaf cert
openssl s_client -connect api.external.com:443 -showcerts </dev/null 2>/dev/null \
  | awk 'BEGIN{c=0} /BEGIN CERT/{c++} c>0{print > "cert_"c".pem"} /END CERT/{}'

# Import intermediate CA(s) and root CA (skip cert_1.pem which is the leaf)
for f in cert_2.pem cert_3.pem; do
  alias=$(openssl x509 -in "$f" -noout -subject -nameopt rfc2253 | sed 's/subject=//')
  keytool -importcert -alias "$alias" -file "$f" \
    -keystore fusion_trust.jks -storepass <password> -noprompt
done
```

### Wrong: Using a shared password for development and production wallets

```bash
# BAD -- same wallet password across environments
# Production wallet
orapki wallet create -wallet /prod/wallet -pwd Welcome1 -auto_login
# Development wallet (same password)
orapki wallet create -wallet /dev/wallet -pwd Welcome1 -auto_login
# If dev wallet is compromised, prod is also compromised
```

### Correct: Unique passwords per environment with vault storage

```bash
# GOOD -- generate unique passwords per environment, store in vault
PROD_PWD=$(openssl rand -base64 32)
DEV_PWD=$(openssl rand -base64 32)

# Store in OCI Vault or external secret manager
oci vault secret create-base64 --compartment-id <ocid> \
  --secret-name "erp-wallet-prod-pwd" \
  --vault-id <vault_ocid> \
  --key-id <key_ocid> \
  --secret-content-content "$(echo -n "$PROD_PWD" | base64)"

# Create wallets with unique passwords
orapki wallet create -wallet /prod/wallet -pwd "$PROD_PWD" -auto_login
orapki wallet create -wallet /dev/wallet -pwd "$DEV_PWD" -auto_login
```

## Common Pitfalls

- **Not monitoring certificate expiry dates**: Integration certificates expire silently. The integration works fine for months, then suddenly fails at 2 AM when the certificate expires. Fix: `Implement automated certificate expiry monitoring using the Python script above. Set alerts at 30 days, 14 days, and 7 days before expiry.` [src2]
- **Forgetting intermediate certificates**: Modern CA chains often have 2-3 intermediate CAs. Importing only the root CA or only the leaf certificate causes chain validation failures on some Java versions. Fix: `Always extract and import the complete chain using openssl s_client -showcerts. Import each certificate in the chain separately.` [src4]
- **CRLF line endings in PEM files**: PEM files created or edited on Windows have \r\n line endings. Oracle tools on Linux reject these files with cryptic parsing errors. Fix: `Run dos2unix on all PEM files before import, or use openssl x509 -in input.pem -out clean.pem to normalize.` [src6]
- **Testing with self-signed certs in production**: Self-signed certificates work in development because developers add them to the local trust store. In production, the trust store does not contain the self-signed cert, causing failures. Fix: `Use Let's Encrypt or a recognized CA for all environments. If self-signed is necessary for testing, document the trust store change and remove it before production deployment.` [src4]
- **Ignoring the 6-month SaaS renewal cycle**: Integration partners build the integration, test it, and deploy it. Six months later, Oracle renews the SaaS TLS certificate and the integration breaks. Fix: `Never hardcode or pin Oracle SaaS certificates. Trust the CA chain. Add Oracle's renewal schedule to your operations calendar.` [src3]
- **Wallet file permission errors**: Auto-login Oracle wallets (cwallet.sso) have no password protection; security depends entirely on file system permissions. Too-open permissions are a security risk; too-restrictive permissions cause the application to fail. Fix: `Set cwallet.sso to 600 permissions owned by the application user. Verify with ls -la before deploying.` [src4]

## Diagnostic Commands

```bash
# Check Oracle ERP Cloud endpoint certificate details
openssl s_client -connect your-instance.fa.us2.oraclecloud.com:443 \
  -servername your-instance.fa.us2.oraclecloud.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -serial

# Test TLS version support
openssl s_client -connect your-instance.fa.us2.oraclecloud.com:443 \
  -tls1_2 </dev/null 2>/dev/null | grep "Protocol  :"

# List all certificates in a JKS keystore
keytool -list -v -keystore fusion_trust.jks -storepass <password>

# Check if a specific CA is trusted
keytool -list -keystore fusion_trust.jks -storepass <password> -alias <alias>

# Verify a certificate chain
openssl verify -CAfile ca_chain.pem server_cert.pem

# List Oracle Wallet contents
orapki wallet display -wallet /path/to/wallet

# Check OCI Certificates service for expiring certificates
oci certs-mgmt certificate list --compartment-id <compartment_ocid> \
  --lifecycle-state ACTIVE --all \
  --query 'data[?"current-version-summary"."validity"."time-of-validity-not-after" < `2026-06-01T00:00:00Z`]'

# Test outbound connectivity from Oracle Integration Cloud
curl -v --tlsv1.2 \
  "https://api.external-service.com/health" \
  --cacert /path/to/trust/chain.pem

# Inspect a PEM certificate file
openssl x509 -in certificate.pem -text -noout

# Check for CRLF line endings in PEM file (should return nothing if clean)
file certificate.pem | grep CRLF
```

## Version History & Compatibility

| Release | Date | Status | Certificate Changes | Migration Notes |
|---|---|---|---|---|
| 25A | 2025-02 | Current | TLS 1.3 support expanded | No breaking changes for TLS 1.2 clients |
| 24C | 2024-11 | Supported | OCI Certificates service GA enhancements | Auto-renewal rules now support custom intervals |
| 24B | 2024-08 | Supported | TLS 1.3 enforcement for new instances | Older clients using TLS 1.0/1.1 must upgrade |
| 24A | 2024-02 | Supported | Certificate import self-service expanded | More certificate formats accepted in OIC Console |
| 23D | 2023-11 | Supported | OCI Certificates service improvements | Certificate-to-LB association simplified |
| 11.12.1.0.0 | 2017 | Legacy | Self-service cert import for fusion_trust.jks | First release with customer-accessible trust store |

### Deprecation Policy

Oracle Fusion Cloud Applications follow a quarterly release cadence (24A, 24B, 24C, 25A, etc.). TLS protocol changes are announced at least one release in advance. TLS 1.0 and 1.1 have been deprecated since 2020 and are blocked on all Oracle Cloud endpoints. Certificate format and management tool changes are documented in release-specific Security Guides. [src7]

## When to Use / When Not to Use

| Use When | Don't Use When | Use Instead |
|---|---|---|
| Securing outbound calls from Oracle ERP to third-party APIs | Managing Oracle Autonomous Database mTLS wallets | Oracle ADB wallet rotation documentation |
| Importing external CA certificates into fusion_trust.jks | Configuring OAuth 2.0 API authentication (application-layer) | Oracle ERP Cloud REST API authentication guide |
| Monitoring Oracle SaaS TLS certificate renewal cycles | Setting up OCI network security groups or firewall rules | OCI network security documentation |
| Converting between PEM, JKS, PKCS#12, and Oracle Wallet formats | Managing SSH keys for OCI compute instances | OCI compute SSH key management |
| Setting up mutual TLS for high-security integrations | Configuring Oracle Identity Cloud Service (IDCS) federation | IDCS federation configuration guide |

## Important Caveats

- Oracle renews SaaS TLS certificates on a 6-month cycle, but the exact renewal date is not publicly announced in advance -- monitor the certificate's notAfter date and plan for renewal within a 2-week window before expiry.
- The fusion_trust.jks keystore in Oracle Fusion Cloud SaaS may be reset during quarterly updates -- verify your custom certificate imports after each quarterly release deployment.
- OCI Certificates service auto-renewal only works for certificates issued by OCI-managed CAs; externally issued (imported) certificates must be renewed and re-imported manually.
- Certificate management interfaces vary across Oracle cloud services (Fusion Apps, OIC, OCI) -- there is no single unified certificate management console.
- All information in this card reflects Oracle's documented behavior as of Release 25A. Certificate management capabilities, format support, and renewal policies are subject to change with each quarterly release.

## Related Units

- [Oracle ERP Cloud REST API Capabilities](/business/erp-integration/oracle-erp-cloud-rest-api/2026)