---
title: "How to rotate Oracle database passwords over TLS"
slug: "executions-how-to-rotate-oracle-passwords-over-tls"
updated: 2026-11-06T03:25:52Z
published: 2026-11-06T03:25:52Z
canonical: "docs.senhasegura.io/executions-how-to-rotate-oracle-passwords-over-tls"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to rotate Oracle database passwords over TLS

Segura™ can rotate passwords on Oracle databases that accept only secure (TLS) connections. The database presents its certificate. Segura™ validates it with an auto-login Oracle Wallet stored on the device. The credential keeps authenticating with a username and password.

## Requirements

- An Oracle database that accepts TLS connections on a secure port. Get the port number from your DBA.
- The certificate of the certificate authority (CA) that signed the database certificate, and the intermediate CA certificate, if there is one.
- A machine with Oracle's `orapki` tool, which ships with Oracle Database and the full Oracle Client.
- A credential on the device that authenticates with a username and password.
- Permission to manage devices.

## Create the Oracle Wallet

1. On the machine with `orapki`, create an auto-login wallet:

```
orapki wallet create -wallet ./segura-wallet -auto_login_only
```
2. Add the CA certificate to the wallet. Replace `database-ca.pem` with the name of your CA file:

```
orapki wallet add -wallet ./segura-wallet -trusted_cert -cert ./database-ca.pem -auto_login_only
```

If there is an intermediate CA, run the same command with its certificate file.
3. Confirm that the CA is listed under "Trusted Certificates":

```
orapki wallet display -wallet ./segura-wallet
```

The file to upload is `segura-wallet/cwallet.sso`. Use a wallet dedicated to Segura™ that holds only the CA certificate and no private keys.

## Configure the device

1. On Segura™, in the navigation bar, hover over the **Products menu** and select **PAM Core**.
2. In the side menu, select **Devices > All devices**.
3. Open the Oracle database device for editing.
4. On the **Connectivity** tab, in the **Connectivity** table, set **Oracle** with the secure port of the database.
5. In the **Certificate** section, set **Use TLS/SSL?** to **Yes**.
6. In **Oracle Wallet (cwallet.sso)**, upload the `cwallet.sso` file.
7. Complete the remaining tabs and save the device.

The credential does not change. Its username, current password, and service name stay as they are.

Attention

If an Oracle device already has **Use TLS/SSL?** set to **Yes**, for example for DB Proxy, its password rotation fails until you upload the Oracle Wallet.

## Verify your results

1. Run a password rotation for a credential on the device. To run the rotation, see [How to configure a password change](/v4-2/docs/executions-how-to-configure-a-password-change).
2. In the execution details, confirm that the rotation succeeded and that the connection used the device's Oracle Wallet.
3. Run a second rotation and confirm that it also succeeds. This confirms that Segura™ stored the new password.

If the rotation fails, check the following:

- **No wallet on the device**: the rotation fails with an error. Segura™ never falls back to an unencrypted connection.
- **Upload refused**: only a `cwallet.sso` file created by `orapki` is accepted. Files such as `.pem`, `.p12`, or `.zip` are refused.
- **Connection fails**: confirm that the wallet contains the CA that signed the database certificate and that the device uses the secure port. When the CA does not match, the rotation fails and the password does not change.

## Limitations

- Mutual TLS is not supported. Databases that require Segura™ to present its own client certificate cannot use this method.
- Users that authenticate only with a certificate, without a password, are not supported.

## Related topics

- [Device registration](/v4-2/docs/pam-device-device-registration)
- [How to configure a password change](/v4-2/docs/executions-how-to-configure-a-password-change)