| Oracle® Database Platform Guide 10g Release 2 (10.2) for Microsoft Windows (x64) Part Number B15688-04 |
|
|
View PDF |
| Oracle® Database Platform Guide 10g Release 2 (10.2) for Microsoft Windows (x64) Part Number B15688-04 |
|
|
View PDF |
This chapter describes integration of Oracle public key infrastructure (PKI) with Windows 2000 public key infrastructure (Windows PKI) on Windows operating systems.
Oracle public key infrastructure (PKI) is used by Oracle Enterprise Security Manager, LDAP-enabled Oracle Enterprise Manager, Oracle's Secure Socket Layer (SSL) authentication, Oracle Database, and Oracle Application Server.
Note:
Oracle Security Manager is installed only with Oracle Database Client.Oracle PKI includes the following components:
Oracle Wallets
Oracle Wallet Manager (OWM)
Oracle Wallets store digital certificates, trust points, and private keys used in public key applications for encryption, decryption, digital signature, and verification.
This section describes Windows public key infrastructure.
This section contains these topics:
Using Microsoft Certificate Stores with Oracle PKI Applications
Note:
Microsoft Certificate Store integration works only with digital certificates that use Microsoft Enhanced Cryptographic Provider. To create these certificates, you need to install Windows High Encryption Pack and select Microsoft Enhanced Cryptographic Provider. Also, when there are more than one of these certificates available for the same key usage (signature/key exchange), the first certificate retrieved will be used for Oracle SSL.Microsoft Certificate Stores are repositories for storing digital certificates and their associated properties. Windows 2000 stores digital certificates and certificate revocation lists in logical and physical stores. Logical stores contain pointers to public key objects in physical stores. Logical stores enable public key objects to be shared between users, computers, and services without requiring storage of duplicates of objects for each user, computer, or services. Public key objects are physically stored in the registry of the local computer or, for some user certificates, in Active Directory. Standard system certificate stores defined by Microsoft include:
MY or Personal
CA
ROOT
MY or Personal holds a user's certificates for which the associated private key is available. The MY certificate store maintains certificate properties that indicate the Cryptographic Service Provider (CSP) associated with the private key. An application uses this information to obtain the private key from the CSP for the associated certificate. CA holds issuing or intermediate certificate authority (CA) certificates. ROOT holds only self-signed CA certificates for trusted root CAs.
Microsoft Certificate Services (MCS) consists of the following modules:
Server Engine
Intermediary
Policy
Server Engine handles all certificate requests. It interacts with other modules at each processing stage to ensure that the proper action is taken based on the state of the request. The Intermediary module receives requests for new certificate from clients and then submits them to Server Engine. The Policy module contains the set of rules controlling the issuance of certificates. This module may be upgraded or customized as needed.
Wallet Resource Locator (WRL) specifies that parameter WALLET_LOCATION in file sqlnet.ora identifies a particular PKI. You can choose between using Oracle Wallet or Microsoft Certificate Stores by setting parameter WALLET_LOCATION in sqlnet.ora. To use credentials from Microsoft Certificate Stores, set parameter WALLET_LOCATION in sqlnet.ora to:
WALLET_LOCATION = (SOURCE = (METHOD=MCS))
The Oracle application uses Oracle's TCP/IP with SSL protocol (TCPS) to connect to Oracle Server. The SSL protocol uses X.509 certificates and trust points from the user's Microsoft Certificate Store for SSL authentication.
