Converting a Self-Signed Certificate into a Third-Party Certificate Using WLST

Managing Keystores, Wallets, and Certificates 8-37

8.4.8.3 Changing a Self-Signed Wallet to a Third-Party Wallet

You can convert a self-signed wallet into a third-party wallet, one that contains certificates signed by a trusted Certificate Authority CA. Assuming a self-signed wallet named MYWallet, containing a certificate with DN as CN=my.example.com,O=example, take these steps to convert it into a third-party wallet: 1. Remove the user certificate CN=my.example.com,O=example from the wallet. 2. Remove the trusted certificate CN=my.example.com,O=example from the wallet this has the same DN as the user certificate, but is a separate entity nonetheless. 3. Export the certificate request CN=my.example.com,O=example from the wallet and save it to a file. 4. Give this certificate request file to a third-party certificate authority CA such as Verisign. 5. The CA will return one of the following: ■ A user certificate file and its own certificate file ■ A single file with a certificate chain consisting of a user certificate and its own certificate 6. Import the above files into the wallet.

8.4.8.4 Replacing an Expiring Certificate in a Wallet

An expiring certificate should be replaced before it actually expires to avoid or reduce application downtime. The steps for replacing an expiring certificate are as follows: 1. Export the certificate request from the wallet this is the same request for which the current expiring certificate was issued. 2. Provide this certificate request to the third-party Certificate Authority CA for certificate issuance. The validity date of the new certificate should be earlier than the expiration date of the current certificate. This overlap is recommended to reduce downtime. 3. Remove the existing certificate the one that is about to expire from the wallet. 4. Import the newly issued certificate into the wallet. To reduce downtime, remove the previous certificate and import the new certificate in the overlap period when the new certificate has become valid and the older one has not yet expired. 5. If the new certificate was issued by a CA other than the one that issued the original certificate, you may also need to import the new CAs trusted certificate before importing the newly issued certificate. Note: Steps 1 and 2 are not required when the third-party CA already maintains the certificate request in a repository. In that case, simply request the CA to issue a new certificate for that certificate request. 8-38 Oracle Fusion Middleware Administrators Guide