Home / APPS DBA / OPMNCTL startall Fails with status 4200

OPMNCTL startall Fails with status 4200

OPMNCTL startall Fails with unexpected exit: status 4200

When attempting to initiate the opmnctl services in E-Busines Suite R12.2, an error with the code 4200 is encountered as shown below.


opmnctl startall: starting opmn and all managed processes… 

[opmn] [ERROR:1] [] [internal] /u01/apps/fs1/FMW_Home/webtier/opmn/bin/opmn: unexpected exit: status 4200 

opmnctl startall: opmn failed to start. 



The inability of OPMN and OHS to start is attributed to the default wallets generated by Oracle Fusion Middleware, which include self-signed certificates signed using md5WithRSA. However, the updated security library no longer supports certificates signed by md5WithRSA. To resolve this issue, the certificate signature algorithm must be sha256WithRSA or a more advanced algorithm.


By following the below steps, you can generate a new wallet that includes a self-signed certificate meeting the required standards. Subsequently, you can deploy this wallet to the default locations, enabling the successful startup of OHS and OPMN.
Step 1: Begin by logging in as the user responsible for the application tier installation. Then, access the run file system environment and the $FMW_HOME/SetWebtier.env  file
$ source <EBS base install directory>/EBSapps.env run 
$ source $FMW_HOME/SetWebtier.env 
Step 2: Proceed with setting an alias for the appropriate orapki command.
$ alias orapki=$FMW_HOME/oracle_common/bin/orapki 
Step 3: In the third step, generate a new wallet with an acceptable self-signed certificate in the directory $HOME/ss  Here’s an example:
$ mkdir ~/ss 
$ cd ~/ss 
$ orapki wallet create -wallet ./ -auto_login_only 
$ orapki wallet add -wallet . -dn "CN=FMWSmallCircleOfTrust" -asym_alg RSA -keysize 2048 -sign_alg sha256 -self_signed -validity 3652 -auto_login_only 
$ orapki wallet display -wallet . 

To ensure the successful creation of the wallet, you can use the final command (orapki wallet display -wallet .) to verify its status.

Step 4: In the fourth step, identify the instanceName of the current environment and save it as an environment variable for future reference.
tr < $CONTEXT_FILE '<>' '  ' | awk '/"s_ohs_instance"/ {print $(NF-1)}' 
iName=$(tr < $CONTEXT_FILE '<>' '  ' | awk '/"s_ohs_instance"/ {print $(NF-1)}' ) 
Step  5: Proceed to navigate to the instance directory as part of the fifth step.
$ cd $FMW_HOME/webtier/instances/$iName

Locate the default wallets utilized by this instance.

$ find . -name cwallet.sso | fgrep -v /webgate/ 
Step  6: As part of the sixth step, ensure that each wallet solely consists of the self-signed certificate for verification purposes.
$ find . -name cwallet.sso | fgrep -v /webgate/ | while read w ; do echo -e "n$w"; orapki wallet display -nologo -wallet $w ; done 

For default wallets, confirm that each wallet exhibits a single “User Certificate” and a matching “Trusted Certificate.” Refer to the following example for clarification:

Requested Certificates: 
User Certificates: 
Subject: CN=Self-Signed Certificate for EBS_web_OHS120,OU=OAS,O=ORACLE,L=REDWOODSHORES,ST=CA,C=US 
Trusted Certificates: 
Subject: CN=Self-Signed Certificate for EBS_web_OHS120,OU=OAS,O=ORACLE,L=REDWOODSHORES,ST=CA,C=US 
Note: Please note that if a wallet is not a default wallet, it is advisable to create a backup copy of the wallet before proceeding further. 
Step  7:  Duplicate the newly created wallet with a SHA-256 signature and place it in all the designated default wallet locations
$ find . -name cwallet.sso | fgrep -v /webgate/ | while read w ; do echo $w; cp -p ~/ss/cwallet.sso $w ; done 

By completing the aforementioned step, you have successfully copied the newly generated self-signed wallet to the default locations within the run file system. This approach eliminates the need to modify the OPMN and OHS configuration files to reference an alternative wallet or wallet directory.

Step  8: In preparation for implementing the changes to the patch file system, proceed with the modification of the adop_sync.drv file located in $APPL_TOP_NE/ad/custom. Include the following updates:
#Oracle HTTP Server Wallet - cwallet.sso 
rsync -zr %s_current_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/keystores/default/cwallet.sso %s_other_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/keystores/default/cwallet.sso 
#OPMN Wallet - cwallet.sso 
rsync -zr %s_current_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OPMN/opmn/wallet/cwallet.sso %s_other_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OPMN/opmn/wallet/cwallet.sso 
rsync -zr %s_current_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/proxy-wallet/cwallet.sso %s_other_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/proxy-wallet/cwallet.sso 
Once you execute the steps outlined in Section 4 during the prepare phase (adop phase=prepare) of the online patching process, the aforementioned changes will be applied to the patch file system. These changes will come into effect following a successful cutover (adop phase=cutover).
Once you have completed this procedure, it is important to refrain from removing or modifying the updated adop_sync.drv file.
Step 9: Proceed with the re-registration of OHS if it is deemed necessary.
Retrieve the host, port, and user name variables for WLS Admin from CONTEXT_FILE.
$ aHost=$( tr < $CONTEXT_FILE '<>' '  ' | awk '/"s_wls_admin_host"/ {print $(NF-1)}' ) 
$ aPort=$( tr < $CONTEXT_FILE '<>' '  ' | awk '/"s_wls_adminport"/ {print $(NF-1)}' ) 
$ aUser=$( tr < $CONTEXT_FILE '<>' '  ' | awk '/"s_wls_admin_user"/ {print $(NF-1)}' ) 
Perform the re-registration of OHS by executing the following commands:
$ cd $FMW_HOME/webtier/instances/$iName/bin 
$ ./opmnctl unregisterinstance -adminHost $aHost -adminPort $aPort -adminUsername $aUser -instanceName $iName 
$ ./opmnctl registerinstance -adminHost $aHost -adminPort $aPort -adminUsername $aUser 

Once the new wallet is in place, OPMN and OHS should be able to initiate successfully.

To verify the startup of only OPMN and OHS, you can utilize the commands adopmnctl.sh start and adapcctl.sh start.

Alternatively, you have the option to execute adstrtal.sh, which will attempt to start all components simultaneously.



  • 5

About Syed Saad Ali

With 13 years of experience as a certified and skilled Oracle Database Administrator, I possess the expertise to handle various levels of database maintenance tasks and proficiently perform Oracle updates. Throughout my career, I have honed my analytical abilities, enabling me to swiftly diagnose and resolve issues as they arise. I excel in planning and executing special projects within time-sensitive environments, showcasing exceptional organizational and time management skills. My extensive knowledge encompasses directing, coordinating, and exercising authoritative control over all aspects of planning, organization, and successful project completions. Additionally, I have a strong aptitude for resolving customer relations matters by prioritizing understanding and effective communication. I am adept at interacting with customers, vendors, and management, ensuring seamless communication and fostering positive relationships.

Check Also


Changing IP Address in an Oracle EBS R12 Environment

Changing IP Address in an Oracle EBS R12 Environment 1. First, Change the IP Address …

Leave a Reply