Certificate installation on OEM

Login to OEM server <OMS server> follow the procedure : 
  

Create a keystore : 

  
$ cd /<base>/Middleware/jdk16/jdk/bin 
  
./keytool -genkey -alias <host name>  -keyalg RSA -keystore <host name>.jks  -keysize 2048 
  

Fill the details : 

  
Enter keystore password: 
Re-enter new password: 
What is your first and last name? 
  [Unknown]:  <host name>​ 
What is the name of your organizational unit? 
  [Unknown]:  Secure-24 
What is the name of your organization? 
  [Unknown]:  Secure-24 
What is the name of your City or Locality? 
  [Unknown]:  Southfield 
What is the name of your State or Province? 
  [Unknown]:  Michigan 
What is the two-letter country code for this unit? 
  [Unknown]:  US 
Is CN=<host name>, OU=Secure-24, O=Secure-24, L=Southfield, ST=Michigan, C=US correct? 
  [no]:  yes 
  
Enter key password for <<host name>> 
        (RETURN if same as keystore password):******** 
Re-enter new password:***** 
  

Create CSR by using newly created keystore : 

  
$./keytool -certreq -alias <host name> -keystore <host name>.jks -file <host name>.csr 
  
EX: 
[oracle@<host name> bin]$ ./keytool -certreq -alias <host name> -keystore <host name>.jks -file <host name>.csr 
Enter keystore password: 
  
Submit the new CSR to certificate authority, once you have the certs import all the certs to key store: 
  
Bundle cert : 
  
$./keytool -import -alias root -keystore <host name>.jks -trustcacerts -file bundle.cer 
  
Chain cert : 
  
$ ./keytool -import -alias intermed -keystore <host name>.jks -trustcacerts -file gdig2.cer 
Root cert : 
  
$ ./keytool -import -alias root_GD -keystore <host name>.jks -trustcacerts -file root.crt 
  
Server cert : 
  
$ ./keytool -import -alias <host name> -keystore <host name>.jks -trustcacerts -file server.cer 
Validation of the imported certs : 
  
$. /keytool -importkeystore -srckeystore <host name>.jks -destkeystore <host name>.p12 -srcstoretype JKS -deststoretype PKCS12 -srcstorepass **** -deststorepass **** -srcalias <host name> -destalias <host name> -srckeypass **** -destkeypass *** -noprompt 
 $openssl pkcs12 -in <host name>.p12 -out tempcrt.pem 
  $openssl x509 -in tempcrt.pem -noout -enddate 
  

Create a wallet : 

  
cd /u03/app/oracle/Middleware/ 
  
  mkdir wallet1 
   
   orapki wallet create -wallet /u03/app/oracle/Middleware/wallet1 
   
   orapki wallet jks_to_pkcs12 -wallet jks_to_pkcs12 -wallet /u03/app/oracle/Middleware/wallet1 -keystore /u03/app/oracle/Middleware/jdk16/jdk/bin/<host name>.jks 
   
   orapki wallet create -wallet /u03/app/oracle/Middleware/wallet1 -auto_login 
   
    orapki wallet display -wallet /u03/app/oracle/Middleware/wallet1 
  

SSL configurations on Webtier : 

  
cd /u03/app/oracle/Middleware/gc_inst/WebTierIH1/config/OHS/ohs1 
  
Change the wallet location in ssl.conf to newly created wallet location i.e /u03/app/oracle/Middleware/wallet1 

Backout Plan: 

This either works or it doesnt.   The only backout plan is to remove the certificate file and restart the OMS 
Note: This activity was performed by my coleague thanks to him for sharing ..

Thanks
Anil Vejendla