Steps to Renew Default OHS Keystore Wallet in Oracle Enterprise Manager (OEM)

Please follow the below steps.

 

Prerequisites

 

  • Take a backup of the existing wallet.
  • Ensure you have appropriate Oracle user privileges.
  • Verify OMS is healthy before making changes.

 

Step 1: Backup the Existing Wallet

cd /dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default

mv cwallet.sso cwallet.sso.expired

 

Step 2: Create a New Auto-Login Wallet

/dboracle/app/oracle/oem135/oracle_common/bin/orapki wallet create \
-wallet /dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default \
-auto_login_only

 

Step 3: Generate a New Self-Signed Certificate

/dboracle/app/oracle/oem135/oracle_common/bin/orapki wallet add \
-wallet /dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default \
-dn “CN=localhost,OU=GCDomain ohs1,O=FOR TESTING ONLY” \
-keysize 2048 \
-self_signed \
-validity 3650 \
-sign_alg sha256 \
-auto_login_only

Parameters

  • Key Size: 2048 bits
  • Signature Algorithm: SHA-256
  • Validity: 3650 days (10 years)

 

Step 4: Verify Wallet Contents

/dboracle/app/oracle/oem135/oracle_common/bin/orapki wallet display \
-wallet /dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default

 

Step 5: Copy the Wallet to the OHS Instance Location

cp \
/dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default/cwallet.sso \
/dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/instances/ohs1/keystores/default/

 

Step 6: Restart Oracle Management Service (OMS)

/dboracle/app/oracle/oem135/bin/emctl stop oms -all -force

/dboracle/app/oracle/oem135/bin/emctl start oms

 

Step 7: Verify OMS Status

/dboracle/app/oracle/oem135/bin/emctl status oms -details

Ensure:

  • OMS is Up
  • OHS is Up
  • WebTier is Running
  • Upload is Running

 

Step 8: Validate the New Certificate

orapki wallet display \
-wallet /dboracle/app/oracle/gc_inst/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default \
-summary

or verify through a browser by opening the OEM console

 

Notes

  • This procedure renews the default self-signed OHS wallet used by Oracle Enterprise Manager.
  • If your OEM is configured with a CA-signed or enterprise SSL certificate, do not use this procedure. Instead, renew the certificate from your Certificate Authority and import it into the wallet.
  • Always keep a backup of the original cwallet.sso so you can quickly roll back if necessary.
  • If the OHS instance uses multiple wallet locations, ensure the updated cwallet.sso is copied to all required locations before restarting OMS.
Recent Posts