D
Secure Socket Layer (SSL) Support

D.1.1 Mobile Server in Standalone Mode

The Mobile Server running in standalone mode does not support SSL. If you try to set SSL=YES in webtogo.ora, the Mobile Server will not work.

In a standalone running mode, if you try to connect from the browser to the Mobile Server in the SSL mode, you will not be able to connect to the Mobile Server.

D.1.2 Oracle9iAS Configuration:

Oracle9iAS comes with pre-configured SSL support. After installing Oracle9iAS, make sure that the httpd.conf file has the following entries :

##

##  SSL Support

##

##  When we also provide SSL we have to listen to the 

##  standard HTTP port (see above) and to the HTTPS port

##


Listen 80

Listen 443


#   SSL Engine Switch:

#   Enable/Disable SSL for this virtual host.

SSLEngine on

#   SSL Cipher Suite:

#   List the ciphers that the client is permitted to negotiate.

#   See the mod_ssl documentation for a complete list.

# SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL


#   Server Certificate:

#   Point SSLCertificateFile at a PEM encoded certificate.  If

#   the certificate is encrypted, then you will be prompted for a

#   pass phrase.  Note that a kill -HUP will prompt again. A test

#   certificate can be generated with `make certificate' under

#   built time. Keep in mind that if you've both a RSA and a DSA

#   certificate you can configure both in parallel (to also allow

#   the use of DSA ciphers, etc.)

SSLCertificateFile \conf\ssl.crt\server.crt
#   For UNIX, use the following format:

#   SSLCertificateFile /conf/ssl.crt/server.crt


#   Server Private Key:

#   If the key is not combined with the certificate, use this

#   directive to point at the key file.  Keep in mind that if

#   you've both a RSA and a DSA private key you can configure

#   both in parallel (to also allow the use of DSA ciphers, etc.)

SSLCertificateKeyFile conf\ssl.key\server.key
#   For UNIX, use the following format:

#   SSLCertificateKeyFile conf/ssl.key/server.key

D.1.3 Mobile Server Configuration

To run the Mobile Server in SSL mode, add the SSL configuration parameter in the WEBTOGO section of the webtogo.ora configuration file and set the SSL parameter's value as follows:

[WEBTOGO]

# ssl mode 

SSL=YES

D.1.4 Setting up the CA Certificate

After the Mobile Server is configured for SSL, and it is running in SSL mode, you should upload the SSL CA certificate to the Mobile Server Repository. To set up the CA certificate from the Mobile Server Control Center, upload the Server certificate used for SSL communication in Oracle9iAS to the Mobile Server Repository.

To upload the CA certificate, go to the Mobile Server Control Center -> Server -> Server Certificate and upload the CA certificate.

To get more information about the type of SSL Cipher Suites that are supported, refer to the documentation regarding "Oracle Implementation of Java SSL" in Oracle Advanced Security Administrator's Guide.

D.2.1 Communication between the Mobile Client and the Mobile Server

There are two different situations regarding the configuration of the communication for SSL between the Mobile Client for Web-to-Go and the Mobile Server, depending on whether or not you download the Mobile Client for Web-to-Go from the Mobile Server running in SSL.

If you download the Mobile Client for Web-to-Go from the URL https://<mobile_server_name>/setup, then the Mobile Client for Web-to-Go is automatically configured for SSL, and no manual configuration is required. The Mobile Client can communicate with the Mobile Server over SSL.

Note that you must type https, not http. (The bold style is used in the previous sentence for emphasis only.)

If you do not download the Mobile Client for Web-to-Go from the Mobile Server running in SSL mode, then you must modify the SERVER_URL parameter in the configuration file webtogo.ora on the client side as follows:

SERVER_URL=https://<mobile_server_name>:<port_number>/webtogo

Note that you must type https, not http.

https://<mobile_server_name>:<port_number>/setup

D.2.2 Connection between the Browser and the Mobile Client for Web-to-Go

If you try to connect from the browser to the Mobile Client for Web-to-Go in SSL Mode, you will not be able to connect to the Mobile Client even if both of the following two conditions exist:

1. The Mobile Server is running in SSL as a module of Oracle9iAS.

2. The Mobile Client for Web-to-Go is also running in SSL mode.

Although, in this case, the communication between the client and the server is over HTTPS (that is, SSL), you still need to specify HTTP and not HTTPS in the client URL to connect to the Mobile Client for Web-to-Go from the browser.

For example:

http://<client machine>/webtogo