Securing OES Production Environments

     Previous  Next    Open TOC in new window    View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

Configuring SSL

OES uses SSL for communications between the Administration Server, remote OES components, and external clients. Installation of OES includes demonstration certificates that can be used get the system up and running in non-production environments.

This document describes how OES uses SSL and provides instructions for replacing the demonstration certificates with those signed by a recognized Certificate Authority. It contains the following topics:

 

OES Component Connections

OES uses one-way or two-way SSL as follows:

 

Demo Keystores and Certificates

Upon installation, two keystores containing demo certificates are used to establish trust between the Administration Server and clients:

 

Replacing the Demo Certificates

For production environments, first configure the Administration Server must be configured to use a keystore containing its private key and corresponding certificate signed by a well-know certificate authority. After this, SSMs can be bound into internal OES 2-way SSL framework by enrolling in secure mode.

Note: Some certificates issued by CA authorities do not strictly comply with Certicom’s Internet X.509 Public Key Infrastructure standard. To use these certificates, you must disable constraints extension checking by adding information to the the enrollment and unenrollment scripts. For instructions, see “Certificates” on page 3-6 of the SSM Installation and Configuration Guide.

Clients enrolling in secure mode will verify the CA certificate against its list of trusted certificate authorities in $JAVA_HOME/lib/security/cacerts and determine that it was signed by a trusted CA by checking for its presence in the cacerts keystore. If the certificate authority is not in the list of trusted CAs, the CA’s certificate must be imported into cacerts.

  1. Rename BEA_HOME\ales32-shared\keys\webserver.jks to demowebserver.jks or a similar name.
    2. Note: This allows you to create the new keystore named webserver.jks. Doing so will minimize modifications that must be made to existing Administration Server config files.
  2. Using the Keytool utility, enter:
    3. keytool -genkey -alias ales-webserver -keyalg RSA -keystore Webserver.jks
  3. When prompted, enter the keystore password and other information about the certificate, (company, contact name, etc.).
  4. When prompted for the key password, enter the same password used for the keystore itself. This can be accomplished by pressing ENTER.
  5. Create a Certificate Signing Request (CSR) as shown below and submit it to the Certificate Authority: 
    6. keytool -certreq -alias ales-webserver -keyalg RSA -file certreq.csr -keystore Webserver.jks
  6. When you receive the signed certificate, download a chain certificate from the CA.
  7. Import the chain certificate and new CA certificate into the keystore:
    8. keytool -import -alias AlesCA -keystore Webserver.jks -trustcacerts -file <chain_certificate_filename> 
    keytool -import -alias ales-webserver -keystore Webserver.jks -trustcacerts -file <certificate_filename>
  8. Copy the new Webserver.jks to the BEA_HOME\ales32-shared\keys directory.
  9. Modify the server’s configuration file as described in the table below.

    10. Container Type
    Instructions
    WebLogic Server
    In BEA_HOME/asiDomain/config.xml, replace the existing <server-private-key-pass-phrase-encrypted> value with the encrypted value of the keystore password used when new webserver.jks keystore was created (see step 3).
    To encrypt the password, you may use the encrypt tool provided with WebLogic Server.
    Tomcat
    Modify TOMCAT_HOME/config/server.xml as follows:
    Add keystorePass=<encrypted_keystore_password> next to the keystoreFile attribute.

  10. Restart the Administration Server.

 

Configuring BLM Clients for One-Way SSL

SSL connections between BLM clients and the BLM server are two-way SSL by default. You can change this to one-way SSL using the following steps:

  1. Open BEA_HOME/ales32-admin/config/WLESblm.properties in an editor and add the following parameter to the bottom of the file:

    2. BLM.sslType=one-way

    Note: If you are using the default properties file, this is already entered as a commented line at the bottom of the file. Simply remove the comment symbol (#).
  2. Restart the server using the following command:

    3. BEA_HOME/ales32-admin/bin/WLESadmin.sh restart

    This is all that is required if the BLM client is on the same machine and the server. You do not need to perform the remaining steps.

  3. If the BLM client is on a separate machine, make a copy of trust.jks in the BEA_HOME/ales32-shared/keys directory and move the copy to an appropriate directory on the BLM client machine.
  4. On the BLM client machine, add the following parameter to the BLM client application:

    5. -Dwles.ssl.trustedCAKeyStore=/<directory_name>/trust.jks

    where

    <directory_name>—name of the directory containing trust.jks.

    Note: No keys are distributed with trust.jks. It contains only the CA public certificate.

 

SSL Diagnosis Utility

The SSL diagnosis tool in a SSM’s ales32-shared/bin directory can be used to troubleshoot SSL connectivity problems between the SSM and the administration server. The tool checks the SSM’s SSL configuration and shows detailed handshake information.

To use the tool:

  1. Make sure the Administration Server is running and using the following debugging settings. If necessary, modify the settings and restart the server.

    2. Server
    File
    Setting
    WebLogic
    WLESWebLogic.conf
    Add or modify these settings in the # Java Additional Parameters section of the file:
    wrapper.java.additional.<n>=-Dssl.debug=true
    wrapper.java.additional.<n>=-Dweblogic.StdoutDebugEnabled=true
    Where:
    <n> — the incremental property number
    log4j.properties
    Add or modify this setting in the file:
    log4j.logger.com.bea.security.ssl = debug
    Tomcat
    WLESTomcat.conf
    Add or modify this setting in the file::
    -Djavax.net.debug=ssl
    log4j.properties
    Add or modify this setting in the file:
    log4j.logger.com.bea.security.ssl = debug

  2. Launch the utility in the SSM’s ales32-shared/bin directory as follows:

    3. ssldiagnosis.bat|sh <demo|secure>

    where

    • demo — use this entry if you are using certificates created by the demo CA certificate
    • secure — use this entry if you are using certificates created by a CA certificate from the cacerts file in BEA_HOME/jdk-version/jre/lib/security.
  3. At the enrollment prompt, enter the Administration Server administrator username and password. (The defaults are admin and password respectively)
  4. Check DEMO CA: the default password for demo CA is "password" and the default ca alias name is "alesdemoca".
  5. Check OES Certificates in keystore files
  6. Check OES components, PD and SCM belongs to SM: give directory of any SSM. For example, Java-SSM location value is BEA_HOME/ales32-ssm/java-ssm

C:\bea_ssms\ales32-shared\bin>ssldiagnosis.bat demo

===============================================================================

AquaLogic Enterprise Security Enrollment/Unenrollment Utility

===============================================================================

Enter admin username :> admin

Enter admin password :>

checking keystore:C:\bea_ssms\ales32-shared/keys/DemoTrust.jks

Enter Demo Trust CA keystore password :>

checking Demo Trust CA Alias

Enter Demo Trust CA Alias:>alesdemoca

checking keystore:C:\bea_ssms\ales32-shared/keys\trust.jks

Enter password of C:\bea_ssms\ales32-shared/keys\trust.jks:>

checking keystore:C:\bea_ssms\ales32-shared/keys\identity.jceks

Enter password of C:\bea_ssms\ales32-shared/keys\identity.jceks:>

checking keystore:C:\bea_ssms\ales32-shared/keys\peer.jks

Enter password of C:\bea_ssms\ales32-shared/keys\peer.jks:>

checking Demo Trust CA certificate

the CA certificate with alias name: alesdemoca is compatible with OES requirement

Checking Admin server: blougee-lap and port number is: 7010

Sending SSL Diagnosis request

Processing ssl diagnosis result

found qualified certificate for certficate with tag:cacert

found qualified certificate for certficate with tag:ssmcert

found qualified certificate for certficate with tag:admincert

found qualified certificate for certficate with tag:trustedcert

check OES component: PD & SCM status

input one of installed SSMs' Location:>C:\bea_ssms\ales32-ssm\java-ssm

PD is working on blougee-lap and port number is 7011

SCM is working on localhost and port number is 7005

C:\bea_ssms\ales32-shared\bin>


  Back to Top       Previous  Next