How to automatically add TLS certificates to Oracle wallets?

Question

When accessing external webservices via HTTPS via the Oracle database you need to add the corresponding certificate to a database wallet to prevent a certificate validation error. When one creates an account at apex.oracle.com, one is able to access any external HTTPS webservice without the need to add certificates. So, Oracle seems to have some automated process in place to add the certificates when they are needed. My question is: How would you go about to do that? Or am I missing some "auto-add" feature?

• Rohit Gupta: Have you tried googling it ?
• WayneNani: I did, but the results only show how to add certificates in general. Not how to do so automatically.
• Rohit Gupta: I thought you were providing the web services. Are you trying to use web services provided by others.
• WayneNani: I am sorry for not being specific enough. I changed the question to more accurately describe my problem.
• mpapec: I'm afraid you'll need to write your own tool which works with orapki, and employs a tool like github.com/noxxi/p5-ssl-tools/blob/master/analyze-ssl.pl

Answer 1

For commercial services, you would need to manually load the root CA certificate chain for that service: the same root CAs that come pre-loaded on web browsers. For self-signed internal services you would need to load your own root CA certificate chain. There is no "auto loading" of those root CAs into a wallet. The reason this works at apex.oracle.com is that someone at Oracle has already loaded those commercial root CAs into the common wallet. There may also be an option to trust the remote certificate without validation, which would negate the need for the root CAs, but is not a good idea for anything except test systems.