33 Configuring SSL

This chapter describes how to secure WebCenter Portal applications (including Framework applications and Spaces) and components with SSL.

This chapter includes the following sections:

Note:

The following can use WS-Security with message protection, and consequently have no hard requirement for SSL:

  • BPEL servers - Worklist service

  • WSRP Producers

  • Microsoft Live Communication Server (LCS) - IMP service

  • Oracle WebCenter Portal's Discussion Server - Discussions and Announcements

Audience

The content of this chapter is intended for Fusion Middleware administrators (users granted the Admin role through the Oracle WebLogic Server Administration Console). Users with the Monitor or Operator roles can view security information but cannot make changes. See also, Section 1.8, "Understanding Administrative Operations, Roles, and Tools."

33.1 Securing the Browser Connection to Spaces with SSL

Securing the browser connection to Spaces with SSL consists of the following steps:

33.1.1 Creating the Custom Keystore

The first step is to generate a custom keystore for Spaces.

To create a custom keystore:

  1. Go to JDK_HOME/bin/ and open a command prompt.

  2. Using keytool, generate a key pair:

    keytool -genkeypair -keyalg RSA -dname "dname" -alias alias -keypass key_password -keystore keystore -storepass keystore_password -validity days_valid
    

    Where:

    • dname is the DN (distinguished name) to use (for example, cn=customidentity,dc=example,dc=com)

    • alias is the alias to use (for example, webcenter_wls)

    • key_password is the password for the new public key, (for example, welcome1)

    • keystore is the keystore name, (for example, webcenter_wls.jks)

    • keystore_password is the keystore password, (for example, welcome1)

    • days_valid is the number of days for which the key password is valid (for example, 360).

    Note:

    You must use the -keyalg parameter and specify RSA as its value as shown above as the default algorithm (DSA) used by keytool for generating the key is incompatible with Oracle WebServices Security Manager requirements.

  3. Export the certificate containing the public key so Spaces clients can import it into their trust store:

    keytool -exportcert -v -alias alias -keystore keystore 
    -storepass keystore_password -rfc -file certificate_file
    

    Where:

    • alias is the Spaces alias (for example, webcenter_wls)

    • keystore is the keystore name, (for example, webcenter_wls.jks)

    • keystore_password is the keystore password, (for example, welcome1)

    • certificate_file is the file name for the certificate to export the key to (for example, webcenter_wls.cer)

  4. Determine the trust store to use:

    Since you are using a self-signed certificate, you must update it as a trusted certificate in the server trust store. To do this, you must determine your trust store by going to the server:

    1. Log into the WebLogic Server Administration Console.

    2. In the Domain Structure pane, expand Environments and click Servers.

    3. In the list of servers, click WC_Spaces.

    4. Open the Configuration tab, and the Keystores subtab.

      The Keystores Settings pane displays (see Figure 33-1).

      Figure 33-1 Keystores Settings Pane

      Description of Figure 33-1 follows
      Description of "Figure 33-1 Keystores Settings Pane"

    5. Note down the location of the server in the Java Standard Trust Keystore field (shown in Figure 33-1).

      Note that the cacerts file may be "read only", in which case you must change its permissions so that it's writable.

  5. Import the self-signed certificate generated above in this trust store:

    keytool -importcert -trustcacerts -alias alias -file certificate_file 
    -keystore cacerts -storepass changeit
    

    Where:

    • alias is the Spaces alias (for example, webcenter_wls)

    • certificate_file is the file name for the certificate to export the key to (for example, webcenter_wls.cer)

    When prompted whether to trust the self-signed certificate, answer yes.

33.1.2 Configuring the Custom Identity and Java Trust Keystores

The next step is to configure the Custom Identity and Java Trust keystores on the Spaces server.

To configure the identity and trust keystores:

  1. Log in to the WebLogic Server Administration Console.

    For information on logging into the WebLogic Server Administration Console, see Section 1.13.2, "Oracle WebLogic Server Administration Console."

  2. In the Domain Structure pane, expand Environment and click Servers.

    The Summary of Servers pane displays (see Figure 33-2).

    Figure 33-2 Summary of Servers Pane

    Description of Figure 33-2 follows
    Description of "Figure 33-2 Summary of Servers Pane"

  3. Click the Spaces server (WC_Spaces) to configure the identity and trust keystores.

    The Settings pane for the Spaces server displays (see Figure 33-3).

    Figure 33-3 Settings Pane for Spaces Server

    Description of Figure 33-3 follows
    Description of "Figure 33-3 Settings Pane for Spaces Server"

  4. Open the Configuration tab, and then the Keystores subtab.

    The Keystores pane displays (see Figure 33-4).

    Figure 33-4 Keystores Pane

    Description of Figure 33-4 follows
    Description of "Figure 33-4 Keystores Pane"

  5. For Keystores, select Custom Identity and Java Standard Trust and click Save.

  6. Under Identity, enter the path and filename of the Custom Identity Keystore you created in Section 33.1.1, "Creating the Custom Keystore."

  7. Enter JKS as the Custom Identity Keystore Type.

  8. Enter and confirm the Custom Identity Keystore password.

  9. Under Trust, enter and confirm the Java Standard Trust Keystore password (typically set to changeit).

  10. Click Save to save your entries.

  11. Open the SSL tab.

  12. Enter the Private Key Alias (for example, webcenter_wls).

  13. Enter the Private Key Passphrase (for example, welcome1)

  14. Click Save to save your entries.

33.1.3 Configuring the SSL Connection

To configure the SSL connection:

  1. On the Settings pane for the Spaces server, open the Configuration tab and then the General subtab.

    The General Configuration pane displays (see Figure 33-5).

    Figure 33-5 General Configuration Pane

    Description of Figure 33-5 follows
    Description of "Figure 33-5 General Configuration Pane"

  2. Check SSL Listen Port Enabled.

  3. Enter an SSL Listen Port number and click Save.

  4. Open the SSL subtab and expand the Advanced options at the bottom of the page.

    The SSL advanced options are displayed (see Figure 33-6).

    Figure 33-6 Advanced SSL Configuration Settings

    Description of Figure 33-6 follows
    Description of "Figure 33-6 Advanced SSL Configuration Settings"

  5. Check that the Two Way Client Cert Behavior option is set to Client Certs Not Requested and click Save.

  6. Open the Control tab.

    The Control Settings pane displays (see Figure 33-7).

    Figure 33-7 Control Settings Pane

    Description of Figure 33-7 follows
    Description of "Figure 33-7 Control Settings Pane"

  7. Click Restart SSL.

  8. Restart the WebLogic Server and open the SSL Spaces URL.

    For a development or test environment only (that is, not for a production environment), if the hostname in the certificate does not match the host name, then the server must be started with:

    -Dweblogic.security.SSL.ignoreHostnameVerification=true

  9. Accept the certificate for the session and log in.

33.2 Securing the Browser Connection to a Framework Application with SSL

Securing the browser connection to a Framework application uses the same configuration steps as for securing the browser connection to Spaces. The only difference is that the configuration occurs on the managed server that is hosting the Framework application deployment rather than the WC_Spaces server. For more information, see Section 33.1, "Securing the Browser Connection to Spaces with SSL."

33.3 Securing the Connection from Oracle HTTP Server to Spaces with SSL

Securing the connection between the Oracle HTTP Server (OHS) and Spaces is described in the following sections:

33.3.1 Configuring the Identity and Trust Keystores

For instructions on how to configure the Identity and Trust keystores, see Section 33.1, "Securing the Browser Connection to Spaces with SSL."

33.3.2 Configuring the SSL Connection

To configure the SSL Connection:

  1. On the Settings pane for the Spaces server, open the Configuration tab and then the General subtab.

    The General Configuration pane displays (see Figure 33-8).

    Figure 33-8 General Configuration Pane

    Description of Figure 33-8 follows
    Description of "Figure 33-8 General Configuration Pane"

  2. Check SSL Listen Port Enabled.

  3. Enter an SSL Listen Port number and click Save.

  4. On the Configuration tab, open the SSL subtab, and then expand the Advanced options at the bottom of the page.

    The SSL advanced options are displayed (see Figure 33-9).

    Figure 33-9 Advanced SSL Configuration Settings

    Description of Figure 33-9 follows
    Description of "Figure 33-9 Advanced SSL Configuration Settings"

  5. Set the Two Way Client Cert Behavior option to Client Certs Not Requested and click Save.

  6. Open the Control tab on the Settings pane, and select the Start/Stop subtab.

  7. Click Restart SSL.

  8. Open the SSL Spaces URL.

  9. Accept the certificate for the session and log in.

  10. In the WSL Administration Console, click View Changes and Restarts on the Change Center pane and restart any affected servers or components.

33.3.3 Installing the Oracle HTTP Server

To install the Oracle HTTP Server:

  1. Install the WebTier.

    • Do not select WebCache; only select the HTTP Server.

    • Uncheck the checkbox to associate a WebLogic server during install.

  2. Navigate to the WT_ORACLE_HOME/instances/<your_instance>/bin directory and start OHS using the following command:

    ./opmnctl startall
    
  3. Check the status of OHS using the following command:

    ./opmnctl status -l
    

33.3.4 Wiring the Spaces Ports to the HTTP Server

To wire the Spaces ports to the HTTP server:

  1. Open the file WT_ORACLE_HOME/instances/<your_instance>/config/OHS/ohs1/mod_wl_ohs.conf.

  2. Add the following entry to mod_wl_ohs.conf to make Spaces work with OHS:

    <IfModule mod_weblogic.c>
            WebLogicHost host_id
            WebLogicPort port
            Debug OFF
            WLLogFile /tmp/ohs.log
            MatchExpression *.jsp
         </IfModule>
     
         <Location />
           SetHandler weblogic-handler
         </Location>
    

    Replacing host_id and port with the Spaces server ID and port number.

  3. Open the file WT_ORACLE_HOME/instances/<your_instance>/config/OHS/ohs1/ssl.conf.

  4. Add the following entry to ssl.conf to make Spaces run on the OHS SSL port:

    <Location />
            WebLogicHost host_id
            WebLogicPort port
            SetHandler weblogic-handler
            SecureProxy ON
            WLLogFile /tmp/ohs_ssl.log
            Debug ALL
            WlSSLWallet SSL_wallet
    </Location>
     
    <Location /webcenter>
          SetHandler weblogic-handler
            WebLogicHost host_id
            WebLogicPort port
          SecureProxy ON
            WLLogFile /tmp/ohs_ssl.log
            Debug ALL
            WlSSLWallet SSL_wallet
    </Location>
    
    <Location /webcenterhelp>
          SetHandler weblogic-handler
            WebLogicHost host_id
            WebLogicPort port
            SecureProxy ON
            WLLogFile /tmp/ohs_ssl.log
            Debug ALL
            WlSSLWallet SSL_wallet
    </Location>
    
    <Location /rsscrawl>
          SetHandler weblogic-handler
            WebLogicHost host_id
            WebLogicPort port
            SecureProxy ON
            WLLogFile /tmp/ohs_ssl.log
            Debug ALL
            WlSSLWallet SSL_wallet
    </Location>
     
    <Location /sesUserAuth>
          SetHandler weblogic-handler
            WebLogicHost host_id
            WebLogicPort port
            SecureProxy ON
            WLLogFile /tmp/ohs_ssl.log
            Debug ALL
            WlSSLWallet SSL_wallet
    </Location>
     
    <Location /rss>
          SetHandler weblogic-handler
            WebLogicHost host_id
            WebLogicPort port
            SecureProxy ON
            WLLogFile /tmp/ohs_ssl.log
            Debug ALL
            WlSSLWallet SSL_wallet
    </Location>
    

    Replacing host_id and port with the WebCenter Portal SSL server ID and port number (typically 8788), and SSL_wallet with the path to the WebLogic SSL wallet (for example, WT_ORACLE_HOME/instances/<your_instance>/config/OHS/ohs1/keystores/default).

    Note:

    SSL should be configured at the server level rather than within the Location/directory sections. So, for example, instead of having:

    <Location /mylocation>
      WLSSLWallet <walletfile>
      SecureProxy ON
    </Location>
    

    use:

    SecureProxy ON
    WlSSLWallet <walletfile>
    

    at the server level (i.e., outside the Location/directory sections).

  5. Go to WT_ORACLE_HOME/instances/<your_instance>/bin and start and check the status of OHS using the following commands:

    ./opmnctl stopall
     
    ./opmnctl startall
    ./opmnctl status -l
    

33.3.5 Configuring the SSL Certificates

To configure the SSL certificates:

  1. For OHS to trust WebCenter Portal's certificate, the WC_Spaces certificate must be imported into the OHS trust store. Export the certificate from the WC_Spaces identity keystore:

    keytool -exportcert -v -alias webcenter_wls -keystore webcenter_wls.jks 
    -storepass <password> -rfc -file webcenter_wls.cer
    
  2. Import the certificate into the wallet on the OHS side using orapki:

    orapki wallet add -wallet . -trusted_cert -cert webcenter_wls.cer -auto_login_only
    
  3. For WebCenter Portal to trust OHS certificates, export the user certificate from OHS wallet and import it as a trusted certificate in the WebLogic trust store.

    orapki wallet export -wallet . -cert cert.txt  -dn 'CN=\"Self-signed Certificate for ohs1 \",OU=EXAMPLEORGUNIT,O=EXAMPLEORG,L=EXAMPLELOCATION,ST=CA,C=US'
    
  4. Import the above certificate into the WC_Spaces managed server trust store available in /scratch/wcwlsinstall/0408/wlshome/jrockit_160_05_R27.6.2-20/jre/lib/security/cacerts:

    keytool -file cert.txt -importcert -trustcacerts -alias ohs_cert 
    -keystore cacerts -storepass changeit
    
  5. Restart OHS and the WC_Spaces server.

    You should now be able to access the SSL OHS, as well as the non-SSL OHS.

33.4 Securing the Browser Connection to the Discussions Service with SSL

Securing the browser connection to the Discussions service with SSL is described in the following sections:

33.4.1 Creating the Custom Keystore

The first step is to generate a custom keystore as shown below:

  1. Go to JDK_HOME/bin/ and open a command prompt.

  2. Using keytool, generate a key pair:

    keytool -genkeypair -keyalg RSA -dname "dname" -alias owc_discussions 
    -keypass key_password -keystore owc_discussions.jks -storepass keystore_password -validity days_valid
    

    Where:

    • dname is the DN (distinguished name) to use (for example, cn=customidentity,dc=owc_discussions,dc=example,dc=com)

    • key_password is the password for the new public key, (for example, welcome1)

    • keystore_password is the keystore password, (for example, welcome1)

    • days_valid is the number of days for which the key password is valid (for example, 360).

    Note:

    You must use the -keyalg parameter and specify RSA as its value as shown above as the default algorithm (DSA) used by keytool for generating the key is incompatible with Oracle WebServices Security Manager requirements.

  3. Export the certificate containing the public key:

    keytool -exportcert -v -alias owc_discussions -keystore owc_discussions.jks 
    -storepass keystore_password -rfc -file owc_discussions.cer
    

    Where:

    • keystore_password is the keystore password, (for example, welcome1)

  4. Determine the trust store to use:

    Since you are using a self-signed certificate, you must update it as a trusted certificate in the server trust store. To do this, you must determine your trust store by going to the server:

    1. Log into the WebLogic Server Administration Console.

    2. In the Domain Structure pane, expand Environments and click Servers.

    3. In the list of servers, click WC_Collaboration.

    4. Open the Configuration tab, and the Keystores subtab.

      The Keystores Settings pane displays (see Figure 33-10).

      Figure 33-10 Keystores Subtab for WC_Collaboration

      Description of Figure 33-10 follows
      Description of "Figure 33-10 Keystores Subtab for WC_Collaboration"

    5. Note down the location of the server in the Java Standard Trust Keystore field (shown in Figure 33-1).

      Note that the cacerts file may be "read only", in which case you must change its permissions so that it's writable.

  5. Import the self-signed certificate generated above in this trust store:

    keytool -importcert -trustcacerts -alias owc_discussions 
    -file owc_discussions.cer -keystore cacerts -storepass changeit
    

    When prompted to trust the self-signed certificate, say yes.

33.4.2 Configuring the Identity and Trust Key Stores

To configure the identity and trust key stores:

  1. Log in to the WebLogic Server Administration Console.

    For information on logging into the WebLogic Server Administration Console, see Section 1.13.2, "Oracle WebLogic Server Administration Console."

  2. In the Domain Structure pane, expand Environment and click Servers.

    The Summary of Servers pane displays (see Figure 33-11).

    Figure 33-11 Summary of Servers Pane

    Description of Figure 33-11 follows
    Description of "Figure 33-11 Summary of Servers Pane"

  3. Click the Collaboration server (WC_Collaboration) to configure the identity and trust keystores.

    The Settings pane for the services server displays (see Figure 33-12).

    Figure 33-12 Settings Pane for Services Server

    Description of Figure 33-12 follows
    Description of "Figure 33-12 Settings Pane for Services Server"

  4. Open the Configuration tab, and then the Keystores subtab.

    The Keystores pane displays (see Figure 33-13).

    Figure 33-13 Keystores Pane

    Description of Figure 33-13 follows
    Description of "Figure 33-13 Keystores Pane"

  5. For Keystores, select Custom Identity and Java Standard Trust.

  6. Under Identity, specify the keystore as owc_discussions.jks.

  7. Set the keystore type to JKS.

  8. Enter and confirm the keystore passphrase, (for example, welcome1)

  9. Under Trust, set the Java Standard Trust Keystore Passphrase to changeit (this is fixed value) and click Save.

  10. From the WLS Administration console, go to Servers -> WC_Collaboration and open the Configuration tab, and then the General subtab.

  11. Check SSL Port enabled, specify a port that you want, and save your settings.

  12. From the WLS Administration console, go to Servers -> WC_Collaboration and open the Configuration tab, and then the SSL subtab.

  13. Specify the private key alias as owc_discussions, and set the password to welcome1.

  14. Open the Control tab.

    The Control Settings pane displays (see Figure 33-14).

    Figure 33-14 Control Settings Pane

    Description of Figure 33-14 follows
    Description of "Figure 33-14 Control Settings Pane"

  15. Click Restart SSL.

33.4.3 Configuring the SSL Connection

To configure the SSL connection:

  1. On the Settings pane for the Services server, open the Configuration tab and then the General subtab.

    The General Configuration pane displays (see Figure 33-15).

    Figure 33-15 General Configuration Pane

    Description of Figure 33-15 follows
    Description of "Figure 33-15 General Configuration Pane"

  2. Check SSL Listen Port Enabled.

  3. Enter an SSL Listen Port number and click Save.

  4. On the Configuration tab, open the SSL subtab, and then expand the Advanced options at the bottom of the page.

    The SSL advanced options are displayed (see Figure 33-16).

    Figure 33-16 Advanced SSL Configuration Settings

    Description of Figure 33-16 follows
    Description of "Figure 33-16 Advanced SSL Configuration Settings"

  5. Set the Two Way Client Cert Behavior option to Client Certs Not Requested and click Save.

  6. Restart the WC_Collaboration server and open the SSL Discussions URL at https://host:port/owc_discussions.

  7. Accept the certificate for the session and log in.

33.5 Securing the Spaces Connection to Portlet Producers with SSL

Securing the connection to WSRP and PDK-Java portlet producers with SSL is described in the following sections:

33.5.1 Configuring the Identity and Trust Key Stores

To configure the identity and trust key stores:

  1. Log in to the WebLogic Server Administration Console.

    For information on logging into the WebLogic Server Administration Console, see Section 1.13.2, "Oracle WebLogic Server Administration Console."

  2. In the Domain Structure pane, expand Environment and click Servers.

    The Summary of Servers pane displays (see Figure 33-17).

    Figure 33-17 Summary of Servers Pane

    Description of Figure 33-17 follows
    Description of "Figure 33-17 Summary of Servers Pane"

  3. Click the Portlet server (for example, WC_Portlet) to configure the identity and trust keystores.

    The Settings pane for the Portlet server displays (see Figure 33-18).

    Figure 33-18 Settings Pane for Portlet Server

    Description of Figure 33-18 follows
    Description of "Figure 33-18 Settings Pane for Portlet Server"

  4. Open the Configuration tab, and then the Keystores subtab.

    The Keystores pane displays (see Figure 33-19).

    Figure 33-19 Keystores Pane

    Description of Figure 33-19 follows
    Description of "Figure 33-19 Keystores Pane"

  5. For Keystores, select Custom Identity and Java Standard Trust and click Save.

  6. Open the Control tab.

    The Control Settings pane displays (see Figure 33-20).

    Figure 33-20 Control Settings Pane

    Description of Figure 33-20 follows
    Description of "Figure 33-20 Control Settings Pane"

  7. Click Restart SSL.

33.5.2 Configuring the SSL Connection

To configure the SSL connection:

  1. In the Domain Structure pane, expand Environment and select Servers.

  2. Click the Portlet server (for example, WC_Utilities) for which you want to configure SSL.

  3. Select Configuration.

  4. Check SSL Listen Port Enable.

  5. Enter a listen port number.

  6. Select Configuration > SSL, and then open the Advanced options at the bottom of the page.

  7. Select the Two Way Client Cert Behavior attribute and choose the Client Certs Not Requested option.

  8. Click Save.

  9. Restart the WebLogic Server and open the SSL URL.

  10. Accept the certificate for the session and log in.

33.5.3 Registering the SSL-enabled WSRP Producer and Running the Portlets

To register the SSL-enabled WSRP producer and run the portlets:

  1. Configure the Spaces managed server to use the Custom Identity and Java Standard Trust store. This also uses the certificates in JDK_HOME/jre/lib/security/cacerts.

  2. Download the certificate of the HTTPS producer URL and save it in .PEM format.

    Use Firefox 3.0 or later to download the certificate directly to .PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see "der2pem" in the Oracle Fusion Middleware Command Reference for Oracle WebLogic Server. Note that WebLogic does not recognize any other format other than .PEM format.

  3. Import the certificate into the cacerts file in JDK_HOME/jre/lib/security using the following keytool command:

    keytool -importcert -alias portlet_cert -file HOME/portlet_pem -keystore ./cacerts -storepass password
    

    Where:

    • portlet_cert is the portlet certificate alias

    • portlet_pem is the portlet certificate file (for example, portlet_cert.pem)

    • password is the keystore password

  4. Restart WC_Spaces.

  5. Start WLST as described in Section 1.13.3.1, "Running Oracle WebLogic Scripting Tool (WLST) Commands."

  6. Connect to the Administration Server for the target domain with the following command:

    connect('user_name','password, 'host_id:port')
    

    Where:

    • user_name is the name of the user account with which to access the WC_Spaces server (for example, weblogic)

    • password is the password with which to access the WC_Spaces server

    • host_id is the host ID of the Administration Server

    • port is the port number of the Administration Server (for example, 7001).

  7. Run the registerWSRPProducer WLST command to register the producer:

    registerWSRPProducer('webcenter', 'sslwsrpprod','producer_wsdl)
    

    Where:

    • sslwsrpprod is the name of the SSL-enabled WSRP producer

    • producer_wsdl is the WSDL URL of the SSL-enabled WSRP producer

    For example:

    registerWSRPProducer('webcenter', 'sslwsrpprod','https://example.oracle.com:7004/richtextportlet/portlets/wsrp2?WSDL')
    
  8. Navigate to the HTTP or HTTPS WebCenter Portal URL.

  9. Create a page and go to the Portlets link.

  10. Go to the registered WSRP producer.

  11. Add the portlet to the page.

  12. Go to the view mode of the page and check that the WSRP portlet renders correctly.

33.5.4 Registering the SSL-enabled PDK-Java Producer and Running the Portlets

To register the SSL-enabled PDK-Java Producer and run the portlets:

  1. Configure the Spaces managed server to use the Demo Identity and Trust store. This also uses the certificates in JDK_HOME/jre/lib/security/cacerts.

  2. Log in to the WebLogic Server Administration Console.

    For information on logging into the WebLogic Server Administration Console, see Section 1.13.2, "Oracle WebLogic Server Administration Console."

  3. On the Domain Structure pane, expand Environment and click Servers.

    The Summary of Servers pane displays (see Figure 33-21).

    Figure 33-21 Summary of Servers Pane

    Description of Figure 33-21 follows
    Description of "Figure 33-21 Summary of Servers Pane"

  4. Click WC_Spaces in the servers list.

    The Settings pane displays (see Figure 33-22).

    Figure 33-22 Settings Pane (WC_Spaces Server)

    Description of Figure 33-22 follows
    Description of "Figure 33-22 Settings Pane (WC_Spaces Server)"

  5. Open the Configuration tab and select the Keystores tab.

  6. Make sure that the value for Demo Identity and Demo Trust is either jks or left blank.

  7. Click Save.

  8. Download the certificate of the HTTPS producer URL and save it in .PEM format.

    Use Firefox 3.0 or later to download the certificate directly to .PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see "der2pem" in the Oracle Fusion Middleware Command Reference for Oracle WebLogic Server. Note that WebLogic does not recognize any other format other than .PEM format.

  9. Import the certificate into the cacerts file in JDK_HOME/jre/lib/security using the following keytool command:

    keytool -importcert HOME/portlet_cert.pem -keystore ./cacerts -storepass changeit
    
  10. Restart WC_Spaces.

  11. Start WLST as described in Section 1.13.3.1, "Running Oracle WebLogic Scripting Tool (WLST) Commands."

  12. Connect to the Administration Server for the target domain with the following command:

    connect('user_name','password, 'host_id:port')
    

    where:

    • user_name is the name of the user account with which to access the WC_Spaces server (for example, weblogic)

    • password is the password with which to access the WC_Spaces server

    • host_id is the host ID of the Administration Server

    • port is the port number of the Administration Server (for example, 7001).

  13. Run the registerPDKJavaProducer command:

    registerPDKJavaProducer('webcenter', 'ssljpdkprod', 'producer_wsdl')
    

    Where:

    • ssljpdkprod is the name of the SSL-enabled PDK-Java producer

    • producer_wsdl is the WSDL URL of the SSL-enabled PDK-Java producer

    This enables one-way SSL for a Web producer. That is, only the server side (web producer) uses certificates. The Web producer code also uses a shared key feature (discussed later) for client authentication.

  14. Go to the HTTP or HTTPS WebCenter Portal URL.

  15. Create a page and go to the Portlets link.

  16. Go to the registered PDK-Java producer.

  17. Add the portlet to the page.

  18. Go to the view mode of the page and check that the PDK-Java portlet renders correctly.

33.6 Securing the Spaces Connection to the LDAP Identity Store

To configure the LDAP server port for SSL, refer to the appropriate administration documentation for the LDAP server. For Oracle Internet Directory (OID), an SSL port is installed by default. To use this port for LDAP communication from WebCenter Portal, the identity store should be configured for authentication with the appropriate authenticator. See Chapter 29, "Configuring the Identity Store" for the steps to do this for the identity store.

Note:

When entering the Provider Specific information, be sure to specify an SSL port and to check the SSL Enabled checkbox.

If the CA is unknown to the Oracle WebLogic server, complete the two additional steps described in the following subsections:

33.6.1 Exporting the OID Certificate Authority (CA)

If the CA is unknown to the Oracle WebLogic server (the command prompts the user to enter the keystore password) you must use orapki to create a certificate. The following example shows how to use this command to create the certificate serverTrust.cert:

orapki wallet export -wallet CA -dn "CN=myCA" -cert oid_server_trust.cert

33.6.2 Setting Up the WebLogic Server

If the CA is unknown to the Oracle WebLogic server, use the utility keytool to import the Oracle Internet Directory's CA into the WebLogic trust store. The following example shows how to use keytool to import the file oid_server_trust.cert into the server trust store cacerts:

keytool -importcert -v -trustcacerts -alias oid_server_trust -file 
oid_server_trust.cer -keystore cacerts -storepass changeit

33.7 Securing the Spaces Connection to Content Server with SSL

If Content Server and the Spaces application in which you intend to create a repository connection are not on the same system or the same trusted private network, then identity propagation is not secure. To ensure secure identity propagation you must also configure SSL on Content Server.

Securing Content Server with SSL involves the following tasks:

You can also refer to "SSL Properties" in Content Integration Suite Administration Guide available at https://download.oracle.com/docs/cd/E10316_01/ouc.htm. Perform these procedures if you use self-signed certificates.

In a production environment, it is recommended that you use real certificates. For information about how to configure keystores when using real certificates, see the "Using Security Providers" chapter in the Security Providers Component Administration Guide available at https://download.oracle.com/docs/cd/E10316_01/ouc.htm.

33.7.1 Configuring a Keystore and Key on the Client Side

To configure a keystore on the WebCenter Portal application (client) side:

  1. Go to the location, for example jdk/bin, where the keytool is located, and open the command prompt.

  2. Generate the client keystore by running the following keytool command:

    keytool -genkey -keyalg RSA -validity 5000 -alias Client private key alias -keystore client-keystore.jks 
    -dname "cn=client" -keypass Private key password -storepass KeyStore password
    
  3. To verify that the keys have been correctly created, you can optionally run the following keytool command:

    keytool -list -keystore client-keystore.jks -storepass KeyStore password
    
  4. To use the key, sign it by running the following keytool command:

    keytool -selfcert -validity 5000 -alias Client private key alias -keystore client-keystore.jks 
    -keypass Private key password -storepass KeyStore password
    
  5. Export the client public key by running the following keytool command:

    keytool -export -alias Client private key alias -keystore client-keystore.jks 
    -file client.pubkey -keypass Private key password -storepass KeyStore password
    

33.7.2 Configuring a Keystore and Key on the Server Side

To configure a keystore on the Content Server side:

  1. Go to the location, for example jdk/bin, where the keytool is located, and open the command prompt.

  2. Generate the server keystore by running the following keytool command:

    keytool -genkey -keyalg RSA -validity 5000 -alias Server public key alias 
    -keystore server-keystore.jks -dname "cn=server" -keypass Private server key password -storepass KeyStore password
    
  3. To verify that the key has been correctly created, run the following keytool command:

    keytool -list -keystore server-keystore.jks -keypass Server private key password -storepass KeyStore password
    
  4. To use the key, sign it by running the following keytool command:

    keytool -selfcert -validity 5000 -alias Server public key alias -keystore server-keystore.jks 
    -keypass Private server key password -storepass KeyStore password
    
  5. Export the server public key to the server keystore by running the following keytool command:

    keytool -export -alias Server public key alias -keystore server-keystore.jks 
    -file server.pubkey -keypass Server private key password -storepass KeyStore password
    

33.7.3 Verifying Signatures of Trusted Clients

To verify signatures of trusted clients, import the client public key into the server keystore:

  1. Go to the location, for example jdk/bin, where the keytool is located, and open the command prompt.

  2. To verify the signature of trusted clients, import the client's public key in to the server keystore by running the following keytool command:

    keytool -import -alias Client public key alias -file client.pubkey -keystore 
    server-keystore.jks -keypass Private server key password -storepass KeyStore password
    
  3. Import the server public key into the client keystore by running the following keytool command:

    keytool -import -alias Server public key alias -file server.pubkey -keystore 
    client-keystore.jks -keypass Private key password -storepass KeyStore password
    

    When the tool prompts you if the key is self-certified, you must enter Yes. Example 33-1 shows a sample output that is generated after this procedure is completed successfully.

    Example 33-1 Sample Output Generated by the Keytool

    [user@server]$ keytool -import -alias client -file client.pubkey
    -keystore server-keystore.jks -keypass Server private key password -storepass Keystore password
    Owner: CN=client
    Issuer: CN=client
    Serial number: serial number, for example, 123a19cb
    Valid from: Date, Year, and Time until: Date, Year, and Time
    Certificate fingerprints:
            ...
    Trust this certificate? [no]:  yes
    Certificate was added to keystore.
    

33.7.4 Securing Identity Propagation

To secure identity propagation, you must configure SSL on Content Server.

  1. Log on to Content Server as an administrator.

  2. From Administration, choose Providers.

  3. On the Create a New Provider page, click Add for sslincoming.

  4. On the Add Incoming Provider page, in Provider Name, enter a name for the provider, for example, sslincomingprovider.

    When the new provider is set up, a directory with the provider name is created as a subdirectory of the CONTENT_SERVER_HOME/data/providers directory.

  5. In Provider Description, briefly describe the provider, for example, SSL Incoming Provider for securing the Content Server.

  6. In Provider Class, enter the class of the sslincoming provider, for example, idc.provider.ssl.SSLSocketIncomingProvider.

    Note:

    You can add a new SSL keepalive incoming socket provider or a new SSL incoming socket provider. Using a keepalive socket improves the performance of a session and is recommended for most implementations.

  7. In Connection Class, enter the class of the connection, for example, idc.provider.KeepaliveSocketIncomingConnection.

  8. In Server Thread Class, enter the class of the server thread, for example, idc.server.KeepaliveIdcServerThread.

  9. In Server Port, enter an open server port, for example, 5555.

  10. Select the Require Client Authentication checkbox.

  11. In Keystore password, enter the password to access the keystore.

  12. In Alias, enter the alias of the keystore.

  13. In Alias password, enter the password of the alias.

  14. In Truststore password, enter the password of the trust store.

  15. Click Add.

    The new incoming provider is now added.

  16. Go to the new provider directory that was created in step 4.

  17. To specify truststore and keystore, create a file named sslconfig.hda.

  18. Copy the server keystore to the server.

  19. Configure the sslconfig.hda file. Example 33-2 shows how the .hda file should look after you include the truststore and keystore information.

    Example 33-2 Sample sslconfig.hda File

    @Properties LocalData
    TruststoreFile=/tmp/ssl/server_keystore
    KeystoreFile=/tmp/ssl/server_keystore
    @end
    

33.8 Securing the Spaces Connection to IMAP and SMTP with SSL

Before reconfiguring the mail server connection, you must first import the certificate into the trust store. Follow the steps below to put the certificate in the trust store and configure Spaces to use the trust store.

To secure the Spaces connection to IMAP and SMTP with SSL:

  1. Open a browser and connect to your IMAP server with the following command:

    https://imapserver:ssl_port
    

    For example:

    https:mailserver.example:993 
    
  2. Place your cursor on the page, right-click, and select Properties.

  3. Click Certificate.

  4. In the popup window, click the Details tab and click Copy to File...

    Be sure to use the DER encoded binary(X.509) format and copy to a file.

  5. Convert the .DER format certificate to .PEM format.

    Use Firefox 3.0 or later to download the certificate directly to.PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see "der2pem" in the Oracle Fusion Middleware Command Reference for Oracle WebLogic Server. Note that WebLogic does not recognize any other format other than .PEM format.

  6. Import the certificate into the cacerts in the JDK_HOME using the following command:

    keytool -import -alias imap_cer -file cert_file.cer -keystore cacerts -storepass changeit
    

    Where cert_file is the name of the certificate file you downloaded.

  7. Register the mail server connection as described in Section 17.4, "Registering Mail Servers."

  8. Restart Spaces.

  9. Log into Spaces and provide your mail credentials.

33.9 Securing a Framework Application's Connection to IMAP and SMTP with SSL

To secure the connection to IMAP and SMTP with SSL for a Framework application:

  1. Follow the steps in Section 33.8, "Securing the Spaces Connection to IMAP and SMTP with SSL" up to and including step 7.

  2. Add the following property to the truststore:

    -Djavax.net.ssl.trustStore=C:\jive\mailtool\jssecacerts
    -Djavax.net.ssl.trustStorePassword=changeit
    

    For example:

    set JAVA_PROPERTIES=-Dplatform.home=%WL_HOME% -Dwls.home=%WLS_HOME% 
    -Dweblogic.home=%WLS_HOME% 
    -Djavax.net.ssl.trustStore=C:\jive\mailtool\jssecacerts 
    -Djavax.net.ssl.trustStorePassword=changeit
    
  3. Restart the Framework application.

  4. Log into the application and provide your mail credentials.

33.10 Securing the Connection to Oracle SES with SSL

Before registering the SES connection, you must first import the certificate into the trust store. Follow the steps below to put the certificate in the trust store and register the Oracle Secure Enterprise Search (SES) connection.

To download the certificate of the HTTPS URL and save it:

  1. Use your browser to navigate to the Web Services URL that Oracle Secure Enterprise Search exposes to enable search requests at:

    http://host:port/search/query/OracleSearch
    

    For example:

    https://example.com:7777/search/query/OracleSearch
    
  2. Place your cursor on the page, right-click with your mouse, and select Properties.

  3. Click Certificate.

  4. In the popup window, open the Details tab, and click Copy to File...

    Use DER encoded binary(X.509) format and copy the certificate to a file.

  5. Convert the .DER format certificate to .PEM format.

    Use Firefox 3.0 or later to download the certificate directly to.PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see "der2pem" in the Oracle Fusion Middleware Command Reference for Oracle WebLogic Server. Note that WebLogic does not recognize any other format other than .PEM format.

  6. Import the certificate into DemoTrustKeyStore.jks or cacerts in the JDK_HOME using one of the following commands:

    keytool -import -alias ses_cer -file cert_file.cer -keystore cacerts -storepass changeit
    

    where cert_file is the name of the certificate file you downloaded.

  7. Register the SES connection as described in Section 22.4.1, "Registering Oracle Secure Enterprise Search Servers."

  8. Restart Spaces or Framework application.

33.11 Securing the Spaces Connection to Microsoft Live Communication Server and Office Communication Server with SSL

To secure the Spaces connection to Microsoft Live Communication Server (LCS) or Office Communication Server 2007 (OCS) with SSL, follow the steps below to import the certificate into the trust store, and point Spaces to use the trust store. Note that securing the Spaces connection to Microsoft Live Communication Server or Office Communication Server with SSL is optional since they can be configured with confidentiality using WS-Security.

Before registering the LCS or OCS connection, you must first import the certificate into the trust store. Follow the steps below to put the certificate in the trust store:

  1. Open your browser and go to the communication server (for example, https://example.com/RTC)

  2. Place your cursor on the page, right-click, and select Properties.

  3. Click Certificate.

  4. In the popup window, open the Details tab and click Copy to File...

    Use Firefox 3.0 or later to download the certificate directly to.PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see "der2pem" in the Oracle Fusion Middleware Command Reference for Oracle WebLogic Server. Note that WebLogic does not recognize any other format other than .PEM format.

  5. Import the certificate into the cacerts using the following keytool command:

    keytool -import -alias lcs_cer -file cert_file.cer -keystore cacerts -storepass changeit
    

    where cert_file is the name of the certificate file you downloaded.

  6. Locate the cacerts file used by the communication server in the installation, and also update the communication server referenced cacerts file with this certificate:

    keytool -import -alias lcs_cer -file cert_file.cer -keystore cacerts -storepass changeit
    
  7. Register the communication server connection as described in Section 16.3, "Registering Instant Messaging and Presence Servers."

  8. Restart the Spaces server.

33.12 Securing the Spaces Connection to an External BPEL Server with SSL

This section describes how to secure the Spaces connection to a BPEL server when the BPEL server resides in an external SOA domain.

Note:

When SOA is installed in an external domain, the Identity Asserter and Authenticator should be configured exactly as for WebCenter Portal. For more information on configuring the Identity Asserter and Authenticator for an external LDAP identity store, see Section 29.1, "Reassociating the Identity Store with an External LDAP Server."

To secure the Spaces connection to an external BPEL server with SSL:

  1. Copy the public certificate (webcenter_wls.cer) from WebCenter Portal into the SOA domain.

  2. Go to JDK_HOME/bin/ and open a command prompt.

  3. Generate a custom keystore on the SOA domain naming the keystore soa_server1.jks, and the alias soa_server1 using the following keytool command:

    keytool -genkeypair -keyalg RSA -dname dname -alias soa_soa_server1 -keypass 
    key_pass -keystore soa_server1.jks -storepass keystore_password -validity days_valid
    

    Where:

    • dname is the DN (distinguished name) to use (for example, cn=customidentity,dc=example,dc=com)

    • key_pass is the password for the new public key, (for example, welcome1)

    • keystore_password is the keystore password, (for example, welcome1)

    • days_valid is the number of days for which the key password is valid (for example, 360).

  4. Export the certificate from soa_wls.jks using the following command:

    keytool -exportcert -v -alias soa_server1 -keystore soa_server1.jks 
    -storepass keystore_password -rfc -file soa_server1.cer
    

    Where:

    • keystore_password is the keystore password, (for example, welcome1)

  5. Log in to the WebLogic Server Administration Console on the SOA domain.

    For information on logging into the WebLogic Server Administration Console, see Section 1.13.2, "Oracle WebLogic Server Administration Console."

  6. In the Navigation pane, expand Environment and click Servers.

    The Summary of Servers pane displays (see Figure 33-23).

    Figure 33-23 Summary of Servers Pane

    Description of Figure 33-23 follows
    Description of "Figure 33-23 Summary of Servers Pane"

  7. From the Configuration tab, click soa_server1 in the list of servers.

    The Settings page for soa_server1 displays (see Figure 33-24).

    Figure 33-24 Settings Page for soa_server1

    Description of Figure 33-24 follows
    Description of "Figure 33-24 Settings Page for soa_server1"

  8. Open the Keystores tab.

    The Keystore settings for soa_server1 displays (see Figure 33-25).

    Figure 33-25 Keystore Settings for soa_server1

    Description of Figure 33-25 follows
    Description of "Figure 33-25 Keystore Settings for soa_server1"

  9. For Keystores, select Custom Identity and Java Standard Trust.

  10. Specify the path and filename of keystore (soa_server1.jks) created above.

  11. Go to the directory containing the java standard trust (cacerts file) specified in the Java Standard Trust Keystores field and import the SOA and WebCenter Portal public certificates into this file so they may be trusted by the server:

    keytool -importcert -trustcacerts -alias webcenter_wls -file webcenter_wls.cer 
    -keystore cacerts -storepass keystore_password
    
    keytool -importcert -trustcacerts -alias soa_server1 -file soa_server1.cer 
    -keystore cacerts -storepass keystore_password
    

    Where:

    • keystore_password is the keystore password, (for example, welcome1)

    Say yes when prompted to trust the certificate.

  12. From the WLS Administration Console on the SOA domain, open the SSL tab.

    The SSL settings for soa_server1 display (see Figure 33-26).

    Figure 33-26 SSL Settings for soa_server1

    Description of Figure 33-26 follows
    Description of "Figure 33-26 SSL Settings for soa_server1"

  13. Specify soa_server1 as the Private Key Alias.

  14. Enter and confirm the password for the private key (for example, welcome1) and click Save.

  15. Open the General tab.

    The General settings for soa_server1 display (see Figure 33-27).

    Figure 33-27 General Settings for soa_server1

    Description of Figure 33-27 follows
    Description of "Figure 33-27 General Settings for soa_server1"

  16. Make sure that Listen Port Enabled is not selected.

  17. Select SSL Listen Port Enabled, specify the SSL Listen Port, and click Save.

  18. Open the Control tab, and then open the Start/Stop sub-tab.

    The Start/Stop settings for soa_server1 display (see Figure 33-28).

    Figure 33-28 Start/Stop Settings for soa_server1

    Description of Figure 33-28 follows
    Description of "Figure 33-28 Start/Stop Settings for soa_server1"

  19. Select soa_server1 from the list of servers, and click Restart SSL.

  20. Restart the soa_server1 Managed Server on the SOA domain.

  21. From the WebCenter Portal domain, import the soa_server1.cer certificate as a trusted certificate to the server trust store (cacerts) using the following keytool commands:

    keytool -importcert -trustcacerts -alias soa_server1 -file soa_server1.cer 
    -keystore cacerts -storepass changeit
    

    Say yes when prompted to trust the certificate.

  22. Add the Worklist connection on the WebCenter Portal domain as described in Section 23.4.2, "Registering Worklist Connections" specifying the host:ssl_port settings for soa_server1 when defining the BPEL URL.

  23. Restart the WC_Spaces Managed Server.