Friday, June 25, 2010

Configuring Two way SSL in Weblogic 10.3.3

This involves the following steps -
  • Creation of Identity for Weblogic Server
  • Creation of Personal Identity for the user
  • Creating trust for the Personal Identity for the user in WebLogic Server
  • Configuring SSL
Creation of Identity for Weblogic Server

This involves the following steps
  • Creation of Identity Keystore, Key and Certificate
  • Configuration of Keystore in WebLogic Server
Creation of Identity Keystore, Key and Certificate

D:\Oracle\Middleware\user_projects\domains\sandesh_domain\servers\AdminServer\security\identity>keytool -genkey -alias server.identity -dname "CN=,OU=ORG,O=Company" -keypass server.identity.password -keystore identity.jks -storepass identity.password

Configuration of Keystore in WebLogic Server

Go to Weblogic Admin Console
Click Environments
Click Servers
Click the Server (for example AdminServer)
Click KeyStores tab
Click Change button for Keystores and select Custom Identity and Java Standard Trust
Click Save
Enter the location for identity.jks in Custom Identity Keystore
Enter JKS for Custom Identity Keystore Type
Enter identity.password for Custom Identity Keystore Passphrase and its confirmation

Creation of Personal Identity for the user

This involves the following steps
  • Creation of Client Personal Identity Key pair
  • Getting the Key pair signed by a CA
  • Generate a PKCS12 Keystore to import into Internet Explorer
  • Installing the Key in a browser for 2-way SSL
Creation of Client Personal Identity Key pair

Goto WebLogic domain config directory and run setDomainEnv.cmd in the bin directory

D:\Oracle\Middleware\user_projects\domains\sandesh_domain\servers\AdminServer\security\trust>java utils.CertGen -certfile robert.brown.identity.cert -keyfile robert.brown.identity.key -keyfilepass robert.brown.identity.key.password -cn robert.brown

Generating a certificate with common name robert.brown and key strength 1024 issued by CA with certificate from D:\Oracle\MIDDLE~1\WLSERV~1.3\server\lib\CertGenCA.der file and key from D:\Oracle\MIDDLE~1\WLSERV~1.3\server\lib\CertGenCAKey.der file

The following files are created -

robert.brown.identity.cert.der
robert.brown.identity.cert.pem
robert.brown.identity.key.der
robert.brown.identity.key.pem

Please note that this step signs the certificates with a WebLogic test CA

Generate a PKCS12 Keystore to import into Internet Explorer

D:\Oracle\Middleware\user_projects\domains\sandesh_domain\servers\AdminServer\security\trust>java utils.ImportPrivateKey -keystore robert.brown.identity.p12 -storepass robert.brown.identity.password -storetype pkcs12 -keypass robert.brown.identity.password -alias robert.brown.identity -certfile robert.brown.identity.cert.pem -keyfile robert.brown.identity.key.pem -keyfilepass robert.brown.identity.key.password

Imported private key robert.brown.identity.key.pem and certificate robert.brown.identity.cert.pem into a new keystore robert.brown.identity.p12 of type pkcs12 under alias robert.brown.identity

The following file is created

robert.brown.identity.p12

Installing the Key in a browser for 2-way SSL

Open Internet Explorer
Open Tools
Click Content Tab
Click Certificates button in Certificates section
Click Trusted Root Certification Authorities tab
Click Import and in the Certificate Import Wizard import D:\Oracle\Middleware\wlserver_10.3\server\lib\CertGenCA.der
You should be able to see a self-signed certificate installed in the Trusted Root Certification Authorities issued to CertGenCab
Click Personal tab
Click Import and in the Certificate Import Wizard import robert.brown.identity.p12 and enter password robert.brown.identity.password
You should be able to see an entry in the Personal tab Issued to robert.brown Issued by CertGenCab

Creating trust for the Personal Identity for the user in WebLogic Server

This involves the following steps
  • Installing the WebLogic test CA in the truststore
  • Installing the Client certificate in the truststore
  • Configuration of Truststore in WebLogic Server
Installing the WebLogic test CA in the truststore

D:\Oracle\Middleware\user_projects\domains\sandesh_domain\servers\AdminServer\security\trust>keytool -importcert -trustcacerts -alias ca -file D:\Oracle\Middleware\wlserver_10.3\server\lib\CertGenCA.der -keystore trust.jks -storepass trust.password

Owner: CN=CertGenCAB, OU=FOR TESTING ONLY, O=MyOrganization, L=MyTown, ST=MyState, C=USIssuer: CN=CertGenCAB, OU=FOR TESTING ONLY, O=MyOrganization, L=MyTown, ST=MySta
te, C=US
Serial number: 234b5559d1fa0f3ff5c82bdfed032a87
Valid from: Thu Oct 24 23:54:45 CST 2002 until: Tue Oct 25 23:54:45 CST 2022
Certificate fingerprints:
MD5: A2:18:4C:E0:1C:AB:82:A7:65:86:86:03:D0:B3:D8:FE
SHA1: F8:5D:49:A4:12:54:78:C7:BA:42:A7:14:3E:06:F5:1E:A0:D4:C6:59
Signature algorithm name: MD5withRSA
Version: 3

Extensions:

#1: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
Key_CertSign
]

#2: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:true
PathLen:1
]

Trust this certificate? [no]: yes
Certificate was added to keystore

Installing the Client certificate in the truststore

D:\Oracle\Middleware\user_projects\domains\sandesh_domain\servers\AdminServer\security\trust>keytool -importcert -trustcacerts -alias robert.brown -file robert.brown.identity.cert.der -keystore trust.jks -storepass trust.password

Certificate was added to keystore

Configuration of Truststore in WebLogic Server

Go to Weblogic Admin Console
Click Environments
Click Servers
Click the Server (for example AdminServer)
Click KeyStores tab
Click Change button for Keystores and select Custom Identity and Custom Trust
Click Save
Enter the location for trust.jks in Custom Trust Keystore
Enter JKS for Custom Trust Keystore Type
Enter trust.password in Custom Trust Keystore Passphrase and its confirmation
Click Save

Configuring 2-way SSL

Click SSL tab
Enter server.identity in Private Key Alias
Enter server.identity.password in Private Key Passphrase and its confirmation
Click Save
Click Advanced
Select Client Certs Requested and Enforced in Two Way Client Cert Behavior
[Note : Ensure that Listen Port Enabled (clear port is enabled, just in case you need to login using clear if SSL configuration does not work)

To test, open Internet Explorer and open the URL https://localhost:7002/console. If you have multiple client certificates on the browser, browser will prompt which certificate to use. Also, since, the server certificate is not in the trusted list, there will be a warning.

36 Comments:

Anonymous Anonymous said...

Hi Sandesh,

I am stuck with one thing..During creation of identity keystore,I am not able to find Identity folder in my weblogic 10.3.3..(as mentioned location of Identity folder is "D:\Oracle\Middleware\user_projects\domains\sandesh_domain\servers\AdminServer\security\identity")

Could you please help for the same..
Thanks
Shweta

2:35 PM  
Blogger Shweta G said...

This comment has been removed by the author.

7:10 PM  
Anonymous Anonymous said...

Hi Sandesh,

Its working fine for me.
thanks alot.

shweta

7:13 PM  
Anonymous Tim said...

Excellent steps to set up 2 way SSL! Thanks a lot.

9:39 PM  
Anonymous Anonymous said...

In dividing line, in some Parkinson's patients toughened with high doses of dopamine idiopathic Parkinson's disease having
no specific known crusade.

Review my web page :: Parkinson's disease specialists Cliffside Park
My webpage: Parkinson'S Disease Specialists Cliffside Park

11:29 PM  
Anonymous Anonymous said...

Customers can cull which of the subprogram are simply two of the many different
things that you can do to maintain both your HDL to LDL ratio and your sum cholesterol ratio mastered.
This can hateful walking, this pocket-size
tidbit of worthful info.

Also visit my homepage ... cholesterolverse.com

2:45 PM  
Anonymous Anonymous said...

The surmise is not speechmaking with nature, correct?
The installment commences as Garth Robin hospital ward will growth
your potency at Blogging and grounds your Web log to go very popular and successful.
Earning money from blogging is one of the best
ways peed in the woods?no14. Our findings on monetisation and tax income propagation are in Day to vote down the Excusitis and go second to blogging over again!


My website :: click here

8:11 PM  
Blogger CH Ramesh said...

Hi Sandesh,
When i tried to run the below command in the terminal :
java utils.CertGen -certfile robert.brown.identity.cert -keyfile robert.brown.identity.key -keyfilepass robert.brown.identity.key.password -cn robert.brown
getting below error:
Exception in thread "main" java.lang.NoClassDefFoundError: utils/CertGen
Caused by: java.lang.ClassNotFoundException: utils.CertGen
at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
Could not find the main class: utils.CertGen. Program will exit.

how to solve the above problem..what i need to have ..
Thanks in advance

Regards,
Ramesh

5:54 PM  
Anonymous Anonymous said...

Excellent article ..if it contains screenshots it will help a lot

8:15 PM  
Anonymous Anonymous said...

I have been exploring ffor a little bit for any high-quality articles or weblog
posts in this sort of space . Exploring in Yahoo I ultimately stumbled
upon this web site. Reading this information So i'm glad to
express thatt I've an incrediibly just right uncanny feeling
I discovered exactly what I needed. I such a lott surely will make sure to don?t put out of your mind thius site and give it a looik regularly.


Take a look at my web site paint sprayer reviews

9:18 PM  
Anonymous Anonymous said...

magnificeոt submit, very informative. I ρonder wɦy the other experts ߋf this sector don't undеrstand this.
You must proceed your writіng. I'm confіdent, you've a great readers' base already!


mʏ site garcinia cambogia extract pure

9:21 PM  
Anonymous Anonymous said...

Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter
updates. I've been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this.

Please let me know if you run into anything. I truly enjoy reading your blog
and I look forward to your new updates.

- cliquez ici
- cliquez ici
- cliquez ici
- cliquez ici
- cliquez ici
- cliquez ici

Here is my page - cliquez ici

9:37 PM  
Anonymous Anonymous said...

Hello i am kavin, its my first time to commenting anyplace, when i read this article i thought i could also make comment due to this good
paragraph.

Also visit my blog :: disabled veterans tuition waiver

3:14 AM  
Anonymous Anonymous said...

This piece of writing provides clear idea for the new
viewers of blogging, that actually how to do blogging and site-building.


My homepage :: replica watches

3:14 AM  
Anonymous Anonymous said...

No matter if some one searches for his essential thing, therefore
he/she wishes to be available that in detail, therefore that thing is
maintained over here.

Check out my website: plumbing companies Gilbert

2:19 AM  
Anonymous Anonymous said...

Facebook apps are the hottest things of these days.
We've all seen it, people who have set up a Facebook personal profile for their business
- usually through ignorance of how Facebook works.
In my opinion, making a web-based dating profile could be the #1 concern given that you are exposed to similar feelings you get
from presenting and public speaking.

Feel free to visit my homepage; how to hack a facebook account without downloading

4:45 AM  
Anonymous Anonymous said...

First off I want to say fantastic blog! I had a quick question in which
I'd like to ask if you do not mind. I was interested to know how you
center yourself and clear your thoughts prior to writing.
I have had a hard time clearing my mind in getting my ideas out.
I truly do enjoy writing however it just seems like the first 10 to 15
minutes tend to be wasted simply just trying
to figure out how to begin. Any ideas or tips? Cheers!

my homepage :: save My marriage today by amy waterman pdf

12:59 PM  
Anonymous Anonymous said...

Simply take a better commercial than candy crush
saga cheat the previous integrating the later stage.

So, for example: waiting for patrolling cats to disappear before
you played it. Unbelievable as it seems the
Spanish candy crush saga cheat much prefer free-play games.



my weblog ... Candy crush saga hacks that work

1:07 PM  
Anonymous Anonymous said...

Hi there, yup this post is truly pleasant and I have learned
lot of things from it concerning blogging. thanks.


Also visit my web blog - free music downloads

4:22 PM  
Anonymous Anonymous said...

Hello, Neat post. There is a problem along with your site in web explorer, may check this?

IE nonetheless is the marketplace leader
and a huge component to other folks will miss your wonderful writing because of
this problem.

Here is my blog post ... source

3:21 AM  
Anonymous Anonymous said...

Prom dresses have a lot of style that you can choose.
Cocktail dresses is a great form of sass clothing and due to their rebirth, designers now headed back
to bring the wide range of different cocktail dress styles.
Dress up for the
win as if you have already become the victor, showing up every day as the victor.
Many professionals I coach want to tell me all the reasons why they shouldn't have a top-notch image.

5:21 AM  
Blogger Unknown said...

The pain center, possibly will deal with heaps of personal injury attorneys and be able to grant a list for you along with setting up interviews.Car Accident Lawyer

4:25 PM  
Blogger Unknown said...

Online hongkongslot : Online blackjacktipups : Online lifetimesportmemories : Online rummystop : Online bigtitspoker : Online carminpoker : Online manualepoker : Online Free blackjackround : Online Free javacasino : Online Free play4roulette : Online Free worldbingoreview : Online Free slotguidance : Online Games Casnio

9:49 PM  
Blogger Unknown said...

huangqihang0603fitflops outlet
michael kors handbags
michael kors bags
kate spade uk
ralph lauren outlet
oakley sunglasses
michael kors outlet
chanel handbags
true religion outlet
chanel online shop
ray ban uk
christian louboutin outlet
burberry sale
abercrombie outlet
kate spade
fitflops sale clearance
gucci outlet online
michael kors
gucci uk
tory burch outlet online
ralph lauren
toms shoes
burberry outlet online
coach outlet online
oakley sunglass
ray ban outlet
nike air max
ray bans
ray ban sunglasses
michael kors outlet online
oakley sunglasses wholesale
chanel outlet
michael kors handbag
true religion
toms outlet
q

2:53 PM  
Blogger chenlina said...

chenlina20150624
fitflops sale
michael kors outlet
toms wedges
air jordans
burberry outlet
louis vuitton
air max 95
michael kors outlet
ray ban glasses
ray ban sunglasses
abercrombie fitch
michael kors
coach factory online
tory burch outlet
abercrombie kids
ralph lauren sale
abercrombie
ralph lauren outlet
adidas outlet
chanel outlet online
gucci outlet
gucci bags
louis vuitton handbags
jordan 4 toro
true religion
gucci outlet online
ray ban sunglasses outlet
michael kors uk
louboutin shoes
coach outlet
ray ban outlet
tods outlet store
cheap jordans
louis vuitton
true religion outlet
dior bags
michael kors handbags
cheap ray bans
prada
michael kors

10:45 AM  
Blogger sfsd said...


MCM Backpack Outlet
air jordan release dates
Nike Air Huarache
UGG Boots Clearance
ugg boots outlet
polo outlet online
Toms Shoes Outlet
The North Face Outlet
Michael Kors Outlet Canada
polo outlet
New Balance Shoes Outlet
Coach Online Outlet
burberry outlet online
shop.coachfactory.com
burberry outlet online
michael kors outlet
ralph lauren outlet online
longchamp outlet
mcm backpack
cheap oakley sunglasses

4:00 PM  
Anonymous serrurier said...

serrurier paris
depannage serrurier paris
serrurerie paris
http://www.serrurier-paris-artisan.fr/serrurier-paris-1/
http://www.serrurier-paris-artisan.fr/serrurier-paris-2/
http://www.serrurier-paris-artisan.fr/serrurier-paris-3/
http://www.serrurier-paris-artisan.fr/serrurier-paris-4/
http://www.serrurier-paris-artisan.fr/serrurier-paris-5/
http://www.serrurier-paris-artisan.fr/serrurier-paris-6-ouverture-porte/
http://www.serrurier-paris-artisan.fr/serrurier-paris-7/
http://www.serrurier-paris-artisan.fr/serrurier-paris-8/
http://www.serrurier-paris-artisan.fr/serrurier-paris-9/
http://www.serrurier-paris-artisan.fr/serrurier-paris-10/
http://www.serrurier-paris-artisan.fr/serrurier-paris-11/
http://www.serrurier-paris-artisan.fr/serrurier-paris-12/
http://www.serrurier-paris-artisan.fr/serrurier-paris-13/
http://www.serrurier-paris-artisan.fr/serrurier-paris-14/
http://www.serrurier-paris-artisan.fr/serrurier-paris-15/
http://www.serrurier-paris-artisan.fr/serrurier-paris-16/
http://www.serrurier-paris-artisan.fr/serrurier-paris-17/
http://www.serrurier-paris-artisan.fr/serrurier-paris-18/
http://www.serrurier-paris-artisan.fr/serrurier-paris-19/
http://www.serrurier-paris-artisan.fr/serrurier-paris-20/
http://www.serrurier-paris-artisan.fr/

7:50 PM  
Anonymous plombier said...

plombier paris
depannage plombier paris
plomberie paris
http://www.plombier-paris-artisan.fr/plombier-paris-1/
http://www.plombier-paris-artisan.fr/plombier-paris-2/
http://www.plombier-paris-artisan.fr/plombier-paris-3/
http://www.plombier-paris-artisan.fr/plombier-paris-4/
http://www.plombier-paris-artisan.fr/plombier-paris-5/
http://www.plombier-paris-artisan.fr/plombier-paris-6/
http://www.plombier-paris-artisan.fr/plombier-paris-7/
http://www.plombier-paris-artisan.fr/plombier-paris-8/
http://www.plombier-paris-artisan.fr/plombier-paris-9/
http://www.plombier-paris-artisan.fr/plombier-paris-10/
http://www.plombier-paris-artisan.fr/plombier-paris-11/
http://www.plombier-paris-artisan.fr/plombier-paris-12/
http://www.plombier-paris-artisan.fr/plombier-paris-13/
http://www.plombier-paris-artisan.fr/plombier-paris-14/
http://www.plombier-paris-artisan.fr/plombier-paris-15/
http://www.plombier-paris-artisan.fr/plombier-paris-16/
http://www.plombier-paris-artisan.fr/plombier-paris-17/
http://www.plombier-paris-artisan.fr/plombier-paris-18/
http://www.plombier-paris-artisan.fr/plombier-paris-19/
http://www.plombier-paris-artisan.fr/plombier-paris-20/
http://www.plombier-paris-artisan.fr/

7:51 PM  
Blogger Unknown said...

ugg outlet
ugg boots
moncler outlet
canada goose jackets
belstaff jackets
woolrich outlet
barbour coats
parajumpers coats
wellensteyn jackets
canada goose jackets
nobis outlet
barbour coats
moncler jackets
black friday deals
black friday 2015
cyber monday deals
cyber monday 2015
winter coats
winter jackets
snow boots
ugg boots
ugg outlet
ugg outlet
ugg sale
ugg australia
discount ugg boots
cheap ugg boots
michael kors factory outlet
canada goose outlet
canada goose jackets
canada goose jackets
canada goose outlet
ray ban sunglasses
cheap ray ban sunglasses
coach outlet store
swarovski outlet
achang1212

2:30 PM  
Blogger John said...

coach outlet store online
canada goose jackets
pandora jewelry
michael kors outlet online
cheap oakley sunglasses
michael kors outlet
michael kors outlet online
uggs outlet
toms outlet
christian louboutin outlet
louis vuitton
nike roshe run
canada goose outlet
ugg boots outlet
abercrombie outlet
louis vuitton outlet online
coach outlet
coach factory outlet
nike air huarache
cheap ugg boots
replica watches for sale
retro jordans
hollister kids
ugg outlet store
michael kors outlet online
hollister
ed hardy clothing
gucci shoes
toms
ugg boots
oakley sunglasses
20151226yuanyuan

11:07 AM  
Blogger Unknown said...

An Offer Follow Up :
Professional Appearance :
Target Customers Marketing :
market.alliantsmallbusiness.com :
business.whitepinebusinesspark.com :
finance.webologymarketing.net :
news.marketsocialism.net :
updates.retailcashback.org :
news.criteriamediaexchange.net :
news.globalbusinessgateways.net :
cominghomecenter.org :
pannhomeservicesma.com :
adhomega3.org :
alliantsmallbusiness.com :
whitepinebusinesspark.com

9:52 PM  
Blogger chenlili said...

chenlili20160324
michael kors outlet
louis vuitton
coach outlet
louis vuitton outlet stores
louis vuitton purses
ray ban sunglasses
louis vuitton outlet stores
timberlands
louis vuitton handbags
uggs boots
retro jordans 13
abercrombie and fitch
coach outlet store online
cheap toms
asics shoes for men
moncler coats
lebron james basketball shoes
insanity workout
giuseppe zanotti outlet
air jordan homme
coach outlet
marc jacobs outlet
retro 11
ralph lauren outlet
cheap jordans
coach factory outlet online
nfl jerseys wholesale
louis vuitton outlet online
prada outlet
hollister clothing store
michael kors outlet
ray ban eyeglasses
michael kors handbags
michael kors outlet online
air force 1 trainers
rolex watches
rolex watches
nike roshe run

9:57 AM  
Anonymous Anonymous said...

2016-4-21 xiaozhengm
toms shoes outlet online
ray bans
cheap jerseys wholesale
replica watches
fitflops sale clearance
cheap oakley sunglasses
true religion jeans
louis vuitton outlet
ralph lauren
hollister clothing
cartier watches
adidas outlet
tods shoes
designer handbags
coach outlet
ralph lauren outlet
michael kors outlet
cheap oakley sunglasses
cheap jordans
michael kors
louis vuitton outlet
tory burch outlet
jordan 8
jordans
kobe 11
michael kors handbags
michael kors uk
nike air jordan
adidas shoes
gucci outlet
oakley sunglasses
nike air max
louis vuitton outlet online
ray ban outlet
ray ban wayfarer
coach factory outlet
air jordans
nike trainers
caoch outlet
nike roshe runs

12:00 PM  
Blogger oakleyses said...

christian louboutin uk, louis vuitton outlet, christian louboutin shoes, michael kors pas cher, louis vuitton outlet, sac longchamp pas cher, prada handbags, gucci handbags, tiffany and co, polo ralph lauren outlet online, christian louboutin outlet, cheap oakley sunglasses, longchamp outlet, uggs on sale, polo outlet, louis vuitton, nike air max, oakley sunglasses, longchamp outlet, nike free, nike outlet, longchamp outlet, longchamp pas cher, chanel handbags, nike air max, oakley sunglasses, nike free run, tiffany jewelry, oakley sunglasses wholesale, louboutin pas cher, ray ban sunglasses, ugg boots, replica watches, air max, louis vuitton outlet, oakley sunglasses, nike roshe, louis vuitton, tory burch outlet, ray ban sunglasses, jordan shoes, christian louboutin, prada outlet, polo ralph lauren, burberry pas cher, ugg boots, jordan pas cher, kate spade outlet, ray ban sunglasses

8:33 AM  
Blogger yanmaneee said...

nike basketball shoes
air max 97
kobe shoes
curry 6 shoes
cheap mlb jerseys
michael kors outlet online
christian louboutin outlet
nike kd 11
ferragamo belts
nike air max

3:44 PM  
Blogger yanmaneee said...

bape hoodie
cheap jordans
supreme clothing
yeezy boost 350 v2
adidas yeezy
calvin klein outlet
balenciaga shoes
jordan 11
hermes belt
supreme clothing

11:41 PM  

Post a Comment

<< Home