title: ORA-29024: Certificate validation failure - Apex and HTTPS
body: <p>Let me explain what is happening:</p>
  <ul>
  <li>Database: Oracle 19c</li>
  <li>Apex: 19.1.0.00.15</li>
  <li>ORDS standalone is 19.1.0.r0921545</li>
  </ul>
  <p>I did the tasks to configure an Apex Social Sign In to Microsoft AAD without almost any issue:</p>
  <ul>
  <li>I created the authentication method in Apex.</li>
  <li>I register my application and get the web credentials in Azure.</li>
  <li>I created a wallet in my database with the root CA Microsoft certificates and configured the instance settings to usee that wallet.</li>
  <li>My wallet in the database server contains the property auto_login to avoid using passwords.</li>
  <li>I created the ACEs entries to allow connection to the login.microsoftonline.com in the port 443</li>
  <li>Although it is not important for the purpose of the question itself and the error that is producing, just comment that I configured the wallet settings in the internal workspace in order to provide access to the wallet to the apex applications.</li>
  </ul>
  <p>For some weeks the process was working fine, I was having a perfect Single Sing on mechanism for all my apex applications in the different workspaces. However,  since some days ago, I am getting always the same error:</p>
  <p><strong>ORA-29024: Certificate validation failure</strong></p>
  <p>After some digging I realise that someone has configured a PROXY for outgoing traffic. Before even trying in Apex, I tried in SQL using APEX_WEB_SERVICE</p>
  <p>Request with proxy settings to login.microsoftonline.com</p>
  <pre><code>select apex_web_service.make_rest_request(
      p_url         =&gt; 'https://login.microsoftonline.com',
      p_http_method =&gt; 'GET',
      p_wallet_path =&gt; 'file:/home/oracle/wallet',
      p_wallet_pwd =&gt; 'MyPassword' ,
      p_proxy_override =&gt; 'http://myproxy:myport'
    7  ) from dual;
  ERROR:
  ORA-29273: HTTP request failed
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1035
  ORA-29024: Certificate validation failure
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 380
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 1148
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 934
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1580
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEBSERVICES_API&quot;, line 408
  ORA-06512: at line 1
  </code></pre>
  <p>Request without proxy settings, just to see if I can get there</p>
  <pre><code>SQL&gt; select apex_web_service.make_rest_request(
    2      p_url         =&gt; 'https://login.microsoftonline.com',
    3      p_http_method =&gt; 'GET',
    4      p_wallet_path =&gt; 'file:/home/oracle/wallet'
    5* ) from dual
  SQL&gt; /
  ERROR:
  ORA-29273: HTTP request failed
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1035
  ORA-29024: Certificate validation failure
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 380
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 1148
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 934
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1580
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEBSERVICES_API&quot;, line 408
  ORA-06512: at line 1
  </code></pre>
  <p>Request to google using Proxy settings</p>
  <pre><code>select apex_web_service.make_rest_request(
      p_url         =&gt; 'https://google.com',
      p_http_method =&gt; 'GET',
      p_wallet_path =&gt; 'file:/home/oracle/wallet',
      p_wallet_pwd =&gt; 'MyPassword' ,
    6      p_proxy_override =&gt; 'http://myproxy:myport'
    7  ) from dual ;
  ERROR:
  ORA-29273: HTTP request failed
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1035
  ORA-29024: Certificate validation failure
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 380
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 1148
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 934
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1580
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEBSERVICES_API&quot;, line 408
  ORA-06512: at line 1
  </code></pre>
  <p>Request to google without proxy settings</p>
  <pre><code>SQL&gt; select apex_web_service.make_rest_request(
    2      p_url         =&gt; 'https://google.com',
    3      p_http_method =&gt; 'GET',
    4      p_wallet_path =&gt; 'file:/home/oracle/wallet'
    5* ) from dual
  SQL&gt; /
  ERROR:
  ORA-29273: HTTP request failed
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1035
  ORA-12535: TNS:operation timed out
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 380
  ORA-06512: at &quot;SYS.UTL_HTTP&quot;, line 1148
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 934
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEB_SERVICES&quot;, line 1580
  ORA-06512: at &quot;APEX_190100.WWV_FLOW_WEBSERVICES_API&quot;, line 408
  ORA-06512: at line 1
  </code></pre>
  <p>My questions are the following:</p>
  <ul>
  <li>It is a network problem or a proxy issue regarding inbound/outbound
  traffic ? I can reach Microsoft but not Google in the port 443 when I don't specify proxy.</li>
  <li>Why am I getting invalid certificate when it has nothing to do with
  the certificates ?</li>
  <li>How can I setup my APEX to use authentication on Azure or any other
  provider for that matter when I have a proxy in the middle ?</li>
  <li>As I use ORDS standalone, am I allow to keep using it or I need a
  reverse proxy with Tomcat ?</li>
  </ul>
  <p>I tried to configure the ACE to use HTTP_PROXY in the ports by running</p>
  <pre><code>begin
    sys.dbms_network_acl_admin.append_host_ace(
      host        =&gt; 'myproxyserver'
     ,lower_port  =&gt; 8080
     ,upper_port  =&gt; 8080
     ,ace         =&gt; xs$ace_type(
        privilege_list     =&gt; xs$name_list('http_proxy')
       ,granted            =&gt; true
       ,principal_name     =&gt; 'MY_PRINCIPAL'
       ,principal_type     =&gt; XS_ACL.PTYPE_DB
      )
    );
  end;
  /
  </code></pre>
  <p>Even I grant to the ACE privileges over the wallet</p>
  <pre><code>SET SERVEROUTPUT ON
  BEGIN
    DBMS_NETWORK_ACL_ADMIN.APPEND_WALLET_ACE
    (
      WALLET_PATH =&gt; 'file:/home/oracle/wallet',
      ACE =&gt; XS$ACE_TYPE(
                          PRIVILEGE_LIST =&gt; XS$NAME_LIST('use_passwords','use_client_certificates'),
                          PRINCIPAL_NAME =&gt; 'MY_PRINCIPAL',
                          PRINCIPAL_TYPE =&gt; XS_ACL.PTYPE_DB
                        )
    );
  EXCEPTION WHEN OTHERS THEN
    DBMS_OUTPUT.PUT_LINE('Error while configuring ACL for wallet: '|| SQLERRM);
  END;
  /
  </code></pre>
  <p>but I am still getting the same error all over.</p>
  <p>Any help would be appreciated!
  Thank you</p>