SSL Certificate Renewal on Oracle HTTP Server (Linux)
1. Overview
SSL certificates are required to secure websites hosted on Oracle HTTP Server (OHS).
Renewing SSL certificates before expiry ensures continued secure HTTPS access. Using
Azure DevOps to automate the renewal reduces manual steps, errors, and downtime.
2. Prerequisites
Certificate Files: Keep renewed SSL certificate files ready ([Link], [Link],
[Link], and wallet if required).
Azure DevOps Agent: The pipeline must run on an agent with SSH access to the Linux
server.
Server Access: Sudo privilege is required to restart the Oracle HTTP Server.
OHS Configuration Path: Note the ORACLE_INSTANCE and COMPONENT_HOME paths
(e.g.,
/u01/oracle/config/fmw/domains/base_domain/config/fmwconfig/components/
OHS/ohs1).
Wallet or Keystore Details: Note the wallet directory or keystore being used by OHS.
SSH Connection: Configure an SSH service connection in Azure DevOps.
Secure Variables: Store sensitive passwords or wallet credentials in Azure DevOps
Library.
3. Process Steps
1. Check the current SSL certificate expiry using openssl or orapki.
2. Back up the existing wallet or certificate directory.
3. Copy new SSL certificates (server, intermediate, root) to the OHS server.
4. Import the new certificates into the OHS wallet using orapki.
5. Update [Link] if required (certificate file path or wallet path).
6. Restart Oracle HTTP Server using opmnctl or systemctl (depending on version).
7. Validate the new SSL certificate via openssl or browser.
8. Save a backup of the updated wallet or certificate files.
4. Sample Azure DevOps YAML Pipeline Script
# SSL Certificate Renewal for Oracle HTTP Server (Linux)
trigger: none
variables:
ohs_home:
"/u01/oracle/config/fmw/domains/base_domain/config/fmwconfig/components/OHS/
ohs1"
wallet_path: "/u01/oracle/wallet"
cert_folder: "$([Link])/certs"
server_cert: "[Link]"
intermediate_cert: "[Link]"
root_cert: "[Link]"
stages:
- stage: Renew_SSL
displayName: "Renew SSL Certificate on Oracle HTTP Server"
jobs:
- job: SSL_Renewal
displayName: "SSL Certificate Renewal"
pool:
vmImage: "ubuntu-latest"
steps:
- task: CopyFiles@2
displayName: "Copy renewed certificate files"
inputs:
SourceFolder: "$([Link])/certs"
Contents: "*.crt"
TargetFolder: "$(cert_folder)"
- task: SSH@0
displayName: "Backup and import new certificates"
inputs:
sshEndpoint: "LinuxServerServiceConnection"
runOptions: "commands"
commands: |
echo "Backing up wallet..."
cp -r $(wallet_path) $(wallet_path)_backup_$(date +%Y%m%d)
echo "Copying new certificates..."
cp $(cert_folder)/$(server_cert) $(wallet_path)/
cp $(cert_folder)/$(intermediate_cert) $(wallet_path)/
cp $(cert_folder)/$(root_cert) $(wallet_path)/
echo "Importing new certificates into wallet..."
orapki wallet add -wallet $(wallet_path) -trusted_cert -cert $(wallet_path)/$
(root_cert) -pwd $(walletPassword)
orapki wallet add -wallet $(wallet_path) -trusted_cert -cert $(wallet_path)/$
(intermediate_cert) -pwd $(walletPassword)
orapki wallet add -wallet $(wallet_path) -user_cert -cert $(wallet_path)/$
(server_cert) -pwd $(walletPassword)
- task: SSH@0
displayName: "Restart Oracle HTTP Server"
inputs:
sshEndpoint: "LinuxServerServiceConnection"
runOptions: "commands"
commands: |
echo "Restarting OHS..."
sudo systemctl restart ohs
sudo systemctl status ohs --no-pager
- task: SSH@0
displayName: "Validate SSL Certificate Expiry"
inputs:
sshEndpoint: "LinuxServerServiceConnection"
runOptions: "commands"
commands: |
echo "Checking SSL certificate expiry..."
openssl s_client -connect [Link] -showcerts </dev/null
2>/dev/null | openssl x509 -noout -dates
5. How to Use This Pipeline
9. Upload renewed SSL certificate files to the certs/ folder in Azure DevOps repo.
10. Set secure variables (walletPassword, SSH credentials) in Azure DevOps Library.
11. Update wallet path, OHS home path, and service name if different.
12. Run the pipeline manually after receiving new certificates.
13. Review logs to confirm wallet update and OHS restart.
6. Best Practices
Always back up the OHS wallet before making any changes.
Restrict access to SSL files and wallet passwords.
Test wallet import steps in a lower environment first.
Document any manual steps or configuration changes.
Track certificate expiry dates and schedule renewals early.