{"id":5027,"date":"2013-02-10T09:41:08","date_gmt":"2013-02-10T13:41:08","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=5027"},"modified":"2017-03-24T09:05:24","modified_gmt":"2017-03-24T13:05:24","slug":"ssl-in-weblogic-server-part-ii-create-keystore-generate-csr-import-cert-and-configure-keystore-with-weblogic","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/02\/10\/ssl-in-weblogic-server-part-ii-create-keystore-generate-csr-import-cert-and-configure-keystore-with-weblogic\/","title":{"rendered":"SSL in WebLogic Server – Part II : Create KeyStore, generate CSR, Import CERT and configure KeyStore with WebLogic"},"content":{"rendered":"

This is part II of SSL in WebLogic Server<\/strong> that covers creating KeyStore<\/strong>, generating Certificate Signing Request (CSR)<\/strong>, importing Certificate in KeyStore<\/strong>, and finally using this keyStore with WebLogic Server<\/strong>. I strongly recommend to go through Part I “SSL in WebLogic KeyStore, Identity & Trust Store, Root and Intermediate CA<\/strong>“<\/a><\/p>\n

 <\/p>\n

High Level Steps to configure SSL in WebLogic Server are<\/strong><\/p>\n

1.<\/strong> Create Java KeyStore (JKS) and generate key
\n2.<\/strong> Generate Certificate Signing Request \u00a0(CSR)
\n3.<\/strong> Send this certificate request file to CA to issue certificate
\n4.<\/strong> Import Root CAs certificate
\n5.<\/strong> Import intermediate CAs certificate (If any)
\n6.<\/strong> Import certificate issued by CA
\n7.<\/strong> List content of keystore
\n8.<\/strong> Configure SSL in WebLogic Server
\n—8.1<\/strong> Change KeyStore type in WebLogic Server
\n—8.2<\/strong> Specify path of Identity KeyStore and Trust KeyStore
\n—8.3<\/strong> Specify Private Key Alias in WebLogic Server
\n—8.4<\/strong> Enable SSL in WebLogic Server
\n9.<\/strong> Test SSL in WebLogic Server<\/p>\n

 <\/p>\n

Low Level Steps to configure SSL in WebLogic Server<\/strong><\/span><\/p>\n

1. Create Java KeyStore and generate key<\/strong>: First step is to create KeyStore and private key (If you already have a keyStore then you can use that to generate key<\/span>)<\/p>\n

keytool -genkey -alias myAlias<\/strong> -keyalg RSA -keysize 2048 -dname “CN=serverName, OU=MyOrganizationUnit, O=myOrganization,L=myLocation, ST=myState, C=myCountry” -keypass [privat_key_password] -keystore [keystore_name].jks -storepass [keystore_password]<\/p>\n

____<\/p>\n

[aiam@innowave21 ~]$ keytool -genkey -alias innowave21 -keyalg RSA -keysize 2048 -dname “CN=innowave21.focusthread.com, OU=DBATeam, O=onlineAppsDBA, L=London, ST=London,C=GB” -keypass welcome1 -keystore innowave21.jks -storepass welcome1<\/span><\/p>\n

[aiam@innowave21 ~]$ ls *.jks<\/span>
\ninnowave21.jks<\/span><\/p>\n

_____<\/p>\n

Note:
\na)<\/strong> This step will create Keystore [keystore_name].jks
\nb)<\/strong> keytool utility is a Key and Certificate Management Tool and is available in $JAVA_HOME\/bin
\nc)<\/strong> -genkey option signifies that we are generating private keys
\nd)<\/strong> -alias myAlias : Each entry in KeyStore (JKS) is represented by Alias. When you import signed certificate (issued by CA) in KeyStore then you should use same alias (used during key generation)<\/span>
\ne)<\/strong> -keyalg RSA : is algorithm used to generate keyPair (default algorithm is DSA)
\nf)<\/strong> -keysize 2048 : is size of key used to generate private key
\ng)<\/strong> -dname : represents name of server to which certificate key is created. If you are generating keys for server innowave21.focusthread.com then use CN=innowave21.focusthread.com, OU=………<\/strong><\/p>\n

2. Generate Certificate Signing Request: <\/strong>Next step it so generate Certificate Signing Request (CSR) for Key (with alias innowave21) generated in previous step<\/p>\n

keytool -certreq -alias myAlias -keystore\u00a0[keystore_name].jks \u00a0-storepass [keystore_password]\u00a0-file [certificate_request].csr<\/p>\n

_____<\/p>\n

keytool -certreq -alias innowave21 -keystore innowave21.jks -storepass welcome1 -file innowave21.csr<\/span><\/p>\n

[aiam@innowave21 ~]$ ls *csr<\/span>
\ninnowave21.csr<\/span><\/p>\n

_____
\na)<\/strong> This step will create certificate signing request file
\nb)<\/strong> -certreq signifies that we are generating certificate signing request file
\nc)<\/strong> -alias myAlias must be same as one used during key generation in previous step<\/p>\n

 <\/p>\n

3. Send this certificate request file to Certifying Authority (CA) to issue certificate<\/strong><\/p>\n

4. Import Root CA certificate.<\/strong>
\nOnce you receive certificate for your server then you must import certificate of Authority issued the certificate (before importing certificate issued by CA)<\/p>\n

keytool -import -trustcacerts -alias rootcacert -keystore [keystore_name].jks -file rootCA.cer -storepass [keyStorePassword]
\n<\/strong><\/p>\n

a)<\/strong> This step will import certificate of Certifying Authority (CA) with alias as rootcacert in KeyStore
\nb)<\/strong> -import signifies that we are importing certificate in keystore
\nc)<\/strong> -trustcacerts\u00a0signifies that we are importing trusted certificates<\/strong> (In this case KeyStore is acting as trust Store, remember trust store<\/strong> and identity store<\/strong> discussed in part I ??<\/span>). If you don’t use option -trustcacerts then it will try to import certificate as Identity Certificate
\nd)<\/strong> -alias must be different<\/strong>\u00a0from one used during key generation
\ne)<\/strong> -file rootCA.cer is file that contains certificate of Root Certifying Authority (remember Root and Intermediate Certifying Authority discussed in part I ??<\/span>\u00a0)<\/p>\n

 <\/p>\n

5. Import intermediate CA (If Any) certificate<\/strong><\/p>\n

If there are more than one Certifying Authority (CA) then you must import any intermediate CA<\/p>\n

keytool -import -trustcacerts -alias intermediatecacert -keystore [keystore_name].jks -file intermediateCA.cer -storepass [keyStorePassword]<\/strong><\/p>\n

a)<\/strong> -import signifies that we are importing certificate in keystore
\nb)<\/strong> -trustcacerts\u00a0signifies that we are importing\u00a0trusted certificates<\/strong>\u00a0(In this case KeyStore is acting as trust Store, remember\u00a0trust store<\/strong>\u00a0and\u00a0identity store<\/strong>\u00a0discussed in part I ??). If you don’t use option -trustcacerts then it will try to import certificate as Identity Certificate
\nc)<\/strong> -alias must be\u00a0different<\/strong>\u00a0from one used during key generation or while importing root CA
\nd)<\/strong> -file intermediateCA.cer is file that contains certificate of Intermediate Certifying Authority<\/p>\n

 <\/p>\n

6. Import Server Certifucate<\/strong><\/p>\n

Next step is to import Server Certifictae<\/p>\n

keytool -import -alias myAlias -keystore [keystore_name].jks -file servercert.cer -keypass [keyPassword]\u00a0-storepass [keyStorePassword]<\/strong><\/p>\n

\n

a)<\/strong> -import signifies that we are importing certificate in keystore
\nb)<\/strong> -alias myAlias should match<\/strong> with Alias used during generation of Key
\nc)<\/strong> -file servercert.cer is file that contains certificate of server issue by CA<\/p>\n

<\/div>\n<\/div>\n
7. List content of keystore<\/strong><\/div>\n

If you want to view certificate stored in KeyStore then you can use option -list like below<\/p>\n

keytool -list -v \u00a0-keystore [keystore_name].jks -storepass [keyStorePassword]<\/strong><\/p>\n

 <\/p>\n

8. Configure SSL in WebLogic Server<\/strong><\/p>\n

In steps above Trust Store<\/strong> (store containing Root and Intermediate CA<\/span>) and Identity Store<\/strong> (store containing Server Certificate<\/span>) are same i.e. \u00a0[keystore_name].jks . <\/strong><\/p>\n

8.1<\/strong> Change KeyStore type from “Demo Identity and Demo Trust”<\/strong> to “Custom Identity and Custom Trust<\/strong>”<\/p>\n

WebLogic Server Console -> Name of Server (for which you wish to configure SSL) -> Configuration -> KeyStores -> change (next to Key Stores)<\/p>\n

\"\"<\/a><\/p>\n

8.2 Specify path of Identity KeyStore and Trust KeyStore<\/strong><\/p>\n

In steps above Trust Store (store containing Root and Intermediate CA) and Identity Store (store containing server certificate) are same i.e. \u00a0[keystore_name].jks <\/strong>(innowave21.jks in my case)<\/span>.<\/strong><\/p>\n