{"id":4983,"date":"2013-01-27T20:05:49","date_gmt":"2013-01-28T00:05:49","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=4983"},"modified":"2013-01-27T20:05:49","modified_gmt":"2013-01-28T00:05:49","slug":"ssl-configuration-in-ovd-oracle-virtual-directory","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/01\/27\/ssl-configuration-in-ovd-oracle-virtual-directory\/","title":{"rendered":"SSL configuration in OVD – Oracle Virtual Directory"},"content":{"rendered":"

This post covers key points and documentation to configure SSL in Oracle Virtual Directory<\/strong> (OVD) 11g. For SSL configuration in OID 11g<\/strong> click here<\/a><\/p>\n

1. SSL Authentication Mode<\/strong> – OVD and any other SSL listener can be configured in one of three Authentication Mode
\na. SSL No-Auth Mode<\/strong> : Neither client nor server are required to authenticate by showing their certificate. This mode is also called as anonymous<\/strong> or no authentication<\/strong> mode.
\nb. Server Authentication Mode<\/strong> : In this mode Server Authenticate itself to client by presenting SSL certificates but client does not Authenticate itself using certificate. This mode is also called as one-way SSL<\/strong> or Server<\/strong> authentication.
\nc. Mutual Authentication<\/strong> : In this mode both client and server authenticates each other using SSL certificates. This mode is also called as two-way SSL<\/strong> or Client<\/strong> authentication.<\/p>\n

Note<\/strong>: OVD SSL Listener by default is configured in Server Authentication<\/strong> Mode.<\/p>\n

2.<\/strong> OVD by default listens on four ports (More on OVD listeners \u00a0here<\/a>)
\na)<\/strong> \u00a0LDAP Listener – Non SSL LDAP default port 6501
\nb)<\/strong> \u00a0LDAPS Listener – SSL LDAP default port 7501
\nc)<\/strong> \u00a0Admin Listener – SSL Admin port 8899
\nd)<\/strong> \u00a0DSML Gateway – Non SSL HTTP port 8080<\/p>\n

Note: Client’s usually connect to OVD using LDAP or LDAPS Listener<\/span><\/p>\n

\"\"<\/a><\/p>\n

3.<\/strong>\u00a0LDAPS<\/strong> and Admin Gateway<\/strong> Listener by default comes with SSL with self signed certificate. You can change from self signed certificates to certificates issues trusted CA like Verisign\/Thawte or you can use your own CA.<\/p>\n

4.<\/strong> SSL certificates (issued to OVD listeners) and Certifying Authority’s Certificates (Certificates of Authority that issues these certificate ) are stored in Keystore.<\/p>\n

5. Keystore<\/strong> – In Oracle Fusion Middleware there are two type of keystores.<\/p>\n

a) JKS Keystore and Truststore (aka Java Key Store)
\nb) Oracle Wallets<\/p>\n

Note : OVD uses Java Key Store to store certificates. System Components of Fusion Middleware like OID & OHS uses Oracle Wallets to store SSL certificates.<\/span><\/p>\n

6.<\/strong> You can configure\/manage\u00a0SSL in OVD<\/strong>\u00a0(LDAPS listener) using<\/p>\n

a)<\/strong> WebLogic Scripting Tool (WLST)
\nor
\nb)<\/strong> Fusion Middleware Enterprise Manager Control (\/em)<\/p>\n

\n

Note<\/strong>: To manage SSL certificates using EM or WLST, OVD must be configured with Weblogic Server with EM application deployed<\/span> .<\/p>\n

<\/div>\n

7.<\/strong>\u00a0Java Keystore lifecycle includes<\/p>\n<\/div>\n

a) Creating keystore
\nb) viewing\/updating keystore
\nc) exporting\/importing keystore
\nd) deleting keystore<\/p>\n

8.<\/strong> To create\/manage \u00a0keystore in OVD –
\na) Login to EM
\nb) Navigate to ovd<\/strong> -> Security<\/strong> -> Keystores<\/strong><\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

9. OVD by default creates following Keystore<\/p>\n

a)<\/strong> keys.jks<\/strong> (Trust Store and SSL Keys for OVD LDAPS Listeners)<\/p>\n

b)<\/strong>\u00a0Optional – If LDAP Adapter<\/strong><\/a>\u00a0using TLS\/SSL is defined then adapters.jks<\/strong> (containing SSL certificate and trust store for OVD to LDAP connection on SSL )<\/p>\n

\"\"<\/a><\/p>\n

10.<\/strong> Location of Key Store<\/strong> for OVD LDAPS Listener<\/strong> is defined in OVD EM : Administration<\/strong> -> Listeners<\/strong> -> LDAP SSL End Point<\/strong> (Edit) -> Change SSL Settings<\/strong><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

11.<\/strong> Location of Key Store<\/strong> for OVD LDAP Adapter<\/strong> is defined in OVD EM : Administration -> Server Properties (Under TLS Configuration<\/strong> Section)<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

12.<\/strong> Java Keystore (JKS) for OVD is stored on File System under $ORACLE_INSTANCE\/config\/OVD\/[ovd1]\/keystores<\/strong><\/p>\n

13.<\/strong> If you don’t<\/strong><\/span> want to use self signed certificate and wish to use certificates signed by trusted certifying certificate<\/strong> (like verisign or thawte) or signed by your companies PKI then<\/p>\n

a.<\/strong> Create Java keystore using \/em or wlst
\nb.<\/strong> Generate CSR (Certificate Signing Request)
\nc.<\/strong> Send CSR to Certifying Authority (CA) for signing the certificates
\nd.<\/strong> Once you get signed certificate from CA (Certifying Authority) then import signed certificate in to keystore
\ne.<\/strong>\u00a0 If certificates are signed by companies PKI then ask OVD clients (including ODSM) to include CA’s certificates (as trusted certificate)<\/p>\n

Note:<\/strong> Certificates can be DER-encoded or Base-64 encoded format. You cannot use FMW control to import DER-encoded certificate.<\/span><\/p>\n

 <\/p>\n

References\/Further Reading<\/strong><\/span><\/p>\n