Oracle Wallet Types of Keystores

Managing Keystores, Wallets, and Certificates 8-5

8.3.1 About Keystores and Certificates

Keys and certificates are used to digitally sign and verify data and achieve authentication, integrity, and privacy in network communications. A Java keystore JKS is a protected database that holds keys and certificates for the organization. Oracle Fusion Middleware utilizes JKS keystores for Oracle Virtual Directory and for applications deployed in Oracle WebLogic Server. Access to a keystore requires a password which is defined at the time the keystore is created, by the person who creates the keystore, and which can only be changed by providing the current password. In addition, each private key in a keystore can be secured by its own password. This section contains these topics: ■ Sharing Keystores Across Instances ■ Keystore Naming Conventions

8.3.1.1 Sharing Keystores Across Instances

Oracle recommends that you do not share keystores between component instances or Oracle instances, since each keystore represents a unique identity. The exception to this is an environment with a cluster of component instances, in which case keystore sharing would be an acceptable practice. Note that no management tools or interfaces are available to facilitate keystore sharing. However, you can export a keystore from one instance and import it into another instance.

8.3.1.2 Keystore Naming Conventions

Follow these naming conventions for your JKS keystores: ■ Do not use a name longer than 256 characters. ■ Do not use any of the following characters in a keystore name: | ; , \ ` ~ { } [ ] = + space tab ■ Do not use non-ascii characters in a keystore name. ■ Additionally, follow the operating system-specific rules for directory and file names.

8.3.2 Managing the Keystore Life Cycle

Typical life cycle events for a JKS keystore are as follows: ■ The keystore is created. Keystores can be created directly, or by importing a keystore file from the file system. ■ The list of available keystores are viewed and specific keystores selected for update. Note: Observe this rule even if your operating system supports the character.