ORA-29106: Cannot import PKCS #12 wallet.

As the name of this blog suggests, sometimes this blog will just be about debugging a little something that occurs in APEX. This is one of those little things. If you attempt to access a TLS/SSL web service in any way (the declarative REST services, using the apex_web_service API, a social sign-in provider, etc.) and you get the error

ORA-29106: Cannot import PKCS #12 wallet.

your problem may be that you are on Oracle Database Standard Edition and your wallet password is "complex"--that is, it has special characters. This seems to happen when you use orapki, but it may not be an issue when you use Oracle Wallet Manager. So, according to Oracle Support Document 2815506.1, there are two possible solutions:

  1. Simply change the password to something without special characters (but with lower case, upper case and numbers), things should work. You may also need to bounce ORDS to get new database sessions.

  2. Use Oracle Wallet Manager to create the wallet (not orapki).

In my experience you may have to play around with this a bit. Depending on versions of everything, you may not be able to use orapki without special chars, different lengths or required, etc. You may even need to create the Oracle Wallet with an earlier version of orapki or Oracle Wallet Manager. If you can't get it working, leave a comment with your specific database version and I may be able to point you in the right direction.

Yes, a small...but if you run into this...a (bitter)sweet blog post.