{"id":5014,"date":"2013-02-05T10:39:37","date_gmt":"2013-02-05T14:39:37","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=5014"},"modified":"2017-02-28T09:38:02","modified_gmt":"2017-02-28T13:38:02","slug":"ssl-in-weblogic-ca-keystore-identity-trust-store-things-you-must-know-part-i","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/02\/05\/ssl-in-weblogic-ca-keystore-identity-trust-store-things-you-must-know-part-i\/","title":{"rendered":"SSL in WebLogic (CA, KeyStore, Identity & Trust Store) : Things you must know – Part I"},"content":{"rendered":"

This post covers basics of SSL in WebLogic Server<\/strong> and how to configure SSL with Custom Certificates<\/strong> and Certifying Authority<\/strong>. For SSL<\/strong> in Oracle E-Business Suite<\/strong> click here<\/a>, SSL in Oracle Internet Directory (OID) click here<\/a>\u00a0, SSL in Oracle Virtual Directory (OVD) click\u00a0here<\/a>\u00a0, and for SSL in Oracle Access Manager (OAM) click\u00a0here<\/a><\/p>\n

Secure Socket Layer (SSL) is used to encrypt data between client<\/strong> and Server<\/strong> (WebLogic in this case).<\/p>\n

1.<\/strong> When user connects to WebLogic Server they can connect
\na)<\/strong> Directly to WebLogic Server (Admin<\/strong> or Managed Server<\/strong> Port , more on WebLogic Admin\/Managed Server here<\/a>\u00a0) or
\nb) via Web Server<\/strong> or Load Balancer<\/strong> (Web Server or Load Balancer then connects to WebLogic Server). To configure WebServer (OHS) in front of WebLogic Server click\u00a0here<\/span><\/a><\/span><\/p>\n

User –> Load Balancer (or WebServer) –> WebLogic Server
\nUser –> WebLogic Server<\/p>\n

a)<\/strong> You can terminate SSL<\/strong> at Load Balancer (or WebServer) and communication from Load Balancer (or WebServer) to\u00a0WebLogic Server as non SSL<\/strong> (In this case Load Balancer (or Web Server) is configured to listen on SSL but WebLogic Server is configured to listen on NON SSL<\/span>)
\nor
\nb)<\/strong> You can terminate SSL at WebLogic Server (In this case Load Balancer (or Web Server) and WebLogic Server are all configured to listen on SSL<\/span>)<\/p>\n

2.<\/strong> WebLogic Server (Admin or Managed Server) are configured for both both non-SSL<\/strong> and SSL por<\/strong>t (To enable SSL you just need to select SSL Listen Port Enabled <\/strong>in WebLogic Console<\/span>).<\/p>\n

\"\"<\/a><\/p>\n

3.<\/strong>\u00a0SSL certificates are issued to a Server by an certificate signing authority<\/strong> (aka Certifying Authority<\/strong> or CA<\/strong>)<\/p>\n

4.<\/strong> There could be one Certifying Authority<\/strong> (root CA) and zero or more intermediate Certifying Authority<\/strong> (root CA delegates authority to issue certificates to intermediary CA)<\/p>\n

\"\"<\/a><\/p>\n

In above screen
\na)<\/strong> Root CA is “Class 3 Public Primary Certification Authority<\/strong>” that issued certificate to
\nb)<\/strong> “VeriSign Class 3 Public Primary Certification Authority – G5<\/strong>” (intermediate CA) that issued certificate to
\nc)<\/strong> “VeriSign Class 3 International Server CA – G3<\/strong>” (intermediate CA) that issued certificate to
\nd)<\/strong> *.oracle.com<\/strong><\/p>\n

In this case *.oracle.com is certificate where as three certificates above that are trusted certificates (certificates of certifying authority)<\/span><\/p>\n

5.<\/strong> By default certificates for SSL Listener on WebLogic are Self Signed<\/strong> (i.e. Certificate and Certifying Authority both are WebLogic Server<\/span>)<\/p>\n

\"\"<\/a><\/p>\n

6.<\/strong> There are two types of certificate
\na) Trusted Certificates –<\/strong> These are certificates of Certifying Authority (CA) . In second screen shot (above) certificates of “VeriSign Class 3 International Server CA – G3<\/strong>” or “VeriSign Class 3 Public Primary Certification Authority – G5<\/strong>” are trusted certificates<\/strong>
\nb) Identity Certificates<\/strong> – These are certificates of Server to which certificates are issued. In above screen shot certificate of *.oracle.com<\/strong> is identity certificate<\/strong><\/p>\n

7.<\/strong> Certificates (Trusted<\/strong> and Identity<\/strong>) for WebLogic are stored in Keystore<\/strong>. There are various types of Keystore that WebLogic Server Supports. Most common of them is Java Key Store<\/strong> (JKS<\/strong>) , file based repository with extension .jks<\/strong><\/p>\n

8.<\/strong> Java Key Store (JKS) stores two type of keys
\na) Trust Store<\/strong> – to store Trusted Certificates<\/strong> (or certificates of certifying authority)
\nb) Identity Store<\/strong> – to store Identity Certificates<\/strong> (or certificates issues to a server by CA)<\/p>\n

Note<\/strong>: You can keep both Trust Store and Identity Store in same Keystore (JKS) or they can be stored in different Keystore (one jks file for identity certificate and second jks file for trust certificates)<\/span><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

9.<\/strong> WebLogic comes with default (self signed) identity and trust store under $WL_HOME\/server\/lib<\/strong>
\na) DemoIdentity.jks<\/strong> – Identity Store containing certificates of server (identity certificate)
\nb) DemoTrust.jks<\/strong> – Identity Store containing certificates of CA (trusted certificate)<\/p>\n

10.<\/strong> keystore is managed by java utility keytool<\/strong>. keytool is used to generate certificates request, import certificates (issues by CA) or to import CA’s certificates.<\/p>\n

 <\/p>\n

Related<\/strong><\/span><\/p>\n