--- title: Create Oracle Wallet for AWS DMS SSL connections using SQLcl description: A step-by-step guide shows how to use Oracle SQLcl, a lightweight Java-based alternative to the full Oracle Client, to create and manage an Oracle Wallet for... canonical: https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Create Oracle Wallet for AWS DMS SSL connections using SQLcl | daily.dev og:description: A step-by-step guide shows how to use Oracle SQLcl, a lightweight Java-based alternative to the full Oracle Client, to create and manage an Oracle Wallet for... og:url: https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k og:image: https://api.daily.dev/og/posts/muSeVqd7K.png og:image:alt: Create Oracle Wallet for AWS DMS SSL connections using SQLcl og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Create Oracle Wallet for AWS DMS SSL connections using SQLcl **[AWS Database Blog](https://daily.dev/sources/aws-database-blog)** · 12 min read · 1 upvotes · 0 comments ## Summary A step-by-step guide shows how to use Oracle SQLcl, a lightweight Java-based alternative to the full Oracle Client, to create and manage an Oracle Wallet for SSL connections between AWS DMS and Amazon RDS for Oracle. It covers installing SQLcl and Java (Amazon Corretto 21) on Amazon Linux 2023, splitting the RDS certificate bundle into individual PEM files, creating and populating the wallet with orapki, configuring sqlnet.ora, tnsnames.ora, and ojdbc.properties, testing the TCPS connection, uploading the wallet to S3, and importing it into AWS DMS. A troubleshooting section addresses common errors including SSL handshake failures from disabled TLS_RSA cipher suites, DMS certificate validation failures from adding the bundle instead of individual certs, and ORA-17002 PKIX path building errors caused by the JDBC thin driver ignoring WALLET_LOCATION. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does my AWS DMS endpoint test connection fail after adding the RDS certificate bundle to an Oracle Wallet? Adding the full RDS certificate bundle PEM file directly to the wallet causes DMS certificate validation to fail because the bundle contains multiple certificates in one file. Split it into individual files (cert.pem, cert1.pem, cert2.pem) using awk, then add each certificate separately to the wallet with orapki so all three trusted certificates are present. _Anyone wiring up SSL for Oracle migrations can save setup time by tracking practical DMS fixes like this on daily.dev._ ### How do I fix an SSL handshake failure error when connecting SQLcl to Amazon RDS for Oracle with JDK 21? The handshake failure happens because JDK 21 disables TLS_RSA_* cipher suites by default, while Amazon RDS for Oracle relies on RSA certificates requiring an SSL_RSA_* cipher suite. The fix is to locate the java.security file, back it up, and remove TLS_RSA_* entries from the jdk.tls.disabledAlgorithms list to re-enable the required RSA ciphers. _Database engineers debugging JDK and TLS cipher mismatches can keep this kind of fix on hand via daily.dev._ ### Why does SQLcl throw ORA-17002 PKIX path building failed when connecting to RDS Oracle over SSL even though the wallet is configured? SQLcl's JDBC thin driver ignores the WALLET_LOCATION directive in sqlnet.ora, since that setting only applies to OCI or thick clients, so it falls back to the JDK's default cacerts truststore which lacks the Amazon RDS root CA. The fix is creating an ojdbc.properties file pointing the JDBC driver to load cwallet.sso from the wallet directory for SSL trust. _Teams troubleshooting JDBC thin driver SSL trust issues can follow fixes like this through daily.dev._ ## Similar posts on daily.dev - [Cross-database access using module signing on Amazon RDS for SQL Server](https://daily.dev/posts/cross-database-access-using-module-signing-on-amazon-rds-for-sql-server-cih7agstr) · AWS Database Blog · 1 upvotes · 0 comments - [Migrating data from Oracle to Amazon Aurora DSQL](https://daily.dev/posts/migrating-data-from-oracle-to-amazon-aurora-dsql-ch3tmz9ki) · AWS Database Blog · 0 upvotes · 0 comments - [Amazon RDS now provides an enhanced console experience to connect to a database](https://daily.dev/posts/amazon-rds-now-provides-an-enhanced-console-experience-to-connect-to-a-database-jhbyqxml9) · AWS · 0 upvotes · 0 comments - [Fix the Java-MySQL Connection Exception: Public Key Retrieval is not allowed](https://daily.dev/posts/fix-the-java-mysql-connection-exception-public-key-retrieval-is-not-allowed-irph6xfla) · Baeldung · 1 upvotes · 0 comments - [Connect Claude Code to a Private RDS Database Using MCP and SSM Tunnels](https://daily.dev/posts/connect-claude-code-to-a-private-rds-database-using-mcp-and-ssm-tunnels-4ak8enuzn) · AWS Fundamentals · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#database](https://daily.dev/tags/database), [#oracle](https://daily.dev/tags/oracle) [View this post on daily.dev](https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Create Oracle Wallet for AWS DMS SSL connections using SQLcl","url":"https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k"},"datePublished":"2026-08-17T18:11:51.517Z","dateModified":"2026-09-13T19:20:05.241Z","description":"A step-by-step guide shows how to use Oracle SQLcl, a lightweight Java-based alternative to the full Oracle Client, to create and manage an Oracle Wallet for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef0e415300e27ea03fe0ef162ef235e9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef0e415300e27ea03fe0ef162ef235e9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"AWS Database Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS Database Blog","logo":"https://media.daily.dev/image/upload/s--En-avd2a--/f_auto,q_auto/v1780213446/logos/aws-database-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aws-database-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,database,oracle","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS Database Blog","item":"https://daily.dev/sources/aws-database-blog"},{"@type":"ListItem","position":3,"name":"Create Oracle Wallet for AWS DMS SSL connections using SQLcl"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/create-oracle-wallet-for-aws-dms-ssl-connections-using-sqlcl-musevqd7k#faq","mainEntity":[{"@type":"Question","name":"Why does my AWS DMS endpoint test connection fail after adding the RDS certificate bundle to an Oracle Wallet?","acceptedAnswer":{"@type":"Answer","text":"Adding the full RDS certificate bundle PEM file directly to the wallet causes DMS certificate validation to fail because the bundle contains multiple certificates in one file. Split it into individual files (cert.pem, cert1.pem, cert2.pem) using awk, then add each certificate separately to the wallet with orapki so all three trusted certificates are present. Anyone wiring up SSL for Oracle migrations can save setup time by tracking practical DMS fixes like this on daily.dev."}},{"@type":"Question","name":"How do I fix an SSL handshake failure error when connecting SQLcl to Amazon RDS for Oracle with JDK 21?","acceptedAnswer":{"@type":"Answer","text":"The handshake failure happens because JDK 21 disables TLS_RSA_* cipher suites by default, while Amazon RDS for Oracle relies on RSA certificates requiring an SSL_RSA_* cipher suite. The fix is to locate the java.security file, back it up, and remove TLS_RSA_* entries from the jdk.tls.disabledAlgorithms list to re-enable the required RSA ciphers. Database engineers debugging JDK and TLS cipher mismatches can keep this kind of fix on hand via daily.dev."}},{"@type":"Question","name":"Why does SQLcl throw ORA-17002 PKIX path building failed when connecting to RDS Oracle over SSL even though the wallet is configured?","acceptedAnswer":{"@type":"Answer","text":"SQLcl's JDBC thin driver ignores the WALLET_LOCATION directive in sqlnet.ora, since that setting only applies to OCI or thick clients, so it falls back to the JDK's default cacerts truststore which lacks the Amazon RDS root CA. The fix is creating an ojdbc.properties file pointing the JDBC driver to load cwallet.sso from the wallet directory for SSL trust. Teams troubleshooting JDBC thin driver SSL trust issues can follow fixes like this through daily.dev."}}]} ```