EM 13c WebTier Could Not Be Started – Fix for Expired OHS Default Keystore Certificate

When Oracle Enterprise Manager (EM) 13c suddenly refuses to start and throws the dreaded message “WebTier Could Not Be Started”, it can bring monitoring, alerts, and management operations to a complete halt.

This issue is especially common in long-running environments where Oracle HTTP Server (OHS) has been running silently for years—until one day, a certificate expires.

In this article, we’ll walk through:

• How to identify the root cause
• Why this happens in EM 13c (13.4 → 13.5)
• How to safely regenerate the default OHS keystore certificate
• Special steps for multi-node OMS environments

This guide is based on real production logs and field-tested recovery steps.

---

Environment Overview

• Product: Oracle Enterprise Manager Cloud Control
• Versions affected: 13.4.0.0.0 to 13.5.0.0.0
• Component failing: WebTier (OHS)
• Underlying service: Oracle HTTP Server

---

Problem Summary

When starting OMS using:

<OMS_HOME>/bin/emctl start oms

The startup fails with:

WebTier Could Not Be Started.

Even though OMS attempts to start normally, it stops when initializing the WebTier.

The logs typically point to OHS failing under Node Manager control.

---

Key Error Symptoms in Logs

emctl.log

Failed to start OHS component named ohs1
WebTier Could Not Be Started.
OMSController failed for start oms

ohs_nm.log

Failed to start the server ohs1 successfully

ohs1.log (Critical Clue)

Unable to initialize SSL environment,
nzosSetCredential returned 28791

⚠️ This error almost always indicates an SSL or keystore issue.

---

Root Cause Explained (Why This Happens)

From WebLogic Server 12.2.1.3.0 onwards, OHS enables SSL on the Admin port (default: 10006) by default.

• OHS uses a self-signed certificate
• Stored in the default keystore
• Validity period: 5 years

Once that certificate expires, OHS fails silently, and WebTier never comes up.

Default Keystore Location

<GC_INST>/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default

---

How to Confirm Certificate Expiry

Display Wallet Details

<OMS_HOME>/oracle_common/bin/orapki wallet display \
-wallet <GC_INST>/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/ohs1/keystores/default

Export the Certificate

orapki wallet export \
-wallet <...>/keystores/default \
-dn "CN=localhost,OU=GCDomain ohs1,O=FOR TESTING ONLY" \
-cert /tmp/server.cer

Check Expiry Using OpenSSL

openssl x509 -in /tmp/server.cer -noout -text

If you see:

Not After : Feb 3 2025

✅ Certificate is expired and must be regenerated.

---

Solution: Regenerate the Default OHS Keystore Certificate

⚠️ Important Notes Before You Start

• Always run orapki from: <OMS_HOME>/oracle_common/bin
• Perform actions in the Stage location, not the instance location.

---

Step 1: Backup Existing Wallet

cd <GC_INST>/.../OHS/ohs1/keystores/default
mv cwallet.sso cwallet.sso.expired

---

Step 2: Create a New Wallet

<OMS_HOME>/oracle_common/bin/orapki wallet create \
-wallet <GC_INST>/.../keystores/default \
-auto_login_only

---

Step 3: Add a New Self-Signed Certificate

orapki wallet add \
-wallet <GC_INST>/.../keystores/default \
-dn 'CN=localhost,OU=GCDomain ohs1,O=FOR TESTING ONLY' \
-keysize 2048 \
-self_signed \
-validity 3650 \
-sign_alg sha256 \
-auto_login_only

---

Step 4: Verify Wallet Contents

orapki wallet display \
-wallet <GC_INST>/.../keystores/default

You should see:

• User Certificate ✔
• Trusted Certificate ✔

---

Step 5: Sync Wallet to Instance Location

cp <GC_INST>/.../keystores/default/cwallet.sso \
<GC_INST>/.../instances/ohs1/keystores/default

---

Step 6: Restart OMS

<OMS_HOME>/bin/emctl stop oms -all -force
<OMS_HOME>/bin/emctl start oms

🎉 WebTier should now start successfully.

---

Special Case: Multi-Node OMS Environment

If you have multiple OMS nodes, you must replicate the wallet.

On Primary Node

• Backup existing cwallet.sso
• Copy new wallet to ohs2, ohs3, etc.
• Transfer the file to other OMS hosts (via SCP)

On Additional Nodes

mv cwallet.sso cwallet.sso.expired
cp /tmp/cwallet.sso <instances>/ohs2/keystores/default

Then restart OMS on each node.

---

Why This Issue Is Easy to Miss

• OMS startup error is generic
• OHS fails quietly
• Certificate expiry happens only every 5 years
• No proactive alert by default

💡 Pro Tip: Add a calendar reminder to check OHS certificates every 4 years.

---

Final Thoughts

The “WebTier Could Not Be Started” error in EM 13c is one of those problems that looks complex but has a clear, repeatable fix once you know where to look.

If your OMS suddenly goes down after years of stability, always check the OHS keystore certificate first—especially in long-running production systems.

EM13c: WebTier Could Not Be Started Due To The Default OHS Keystore Certificate Expired (KB693282)