Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Oracle Identity Management
• Related Documentation
• Conventions

1 Public Key Infrastructure and OracleAS

• 1.1 What Is a PKI?
  • 1.1.1 Key Pairs
  • 1.1.2 Certification Authority (CA) and Digital Certificates
    • 1.1.2.1 CA Signing
    • 1.1.2.2 Levels of Trust
    • 1.1.2.3 Contents and Uses of a Digital Certificate
    • 1.1.2.4 Containers for PKI Credentials
  • 1.1.3 Registration Authority (RA)
• 1.2 Benefits of a PKI
• 1.3 Introduction to the OracleAS PKI
  • 1.3.1 Earlier Costs and Difficulties
  • 1.3.2 Benefits of the OracleAS PKI
  • 1.3.3 Components of the OracleAS PKI
    • 1.3.3.1 Containers, Oracle Wallets, and Oracle Wallet Manager (OWM)
    • 1.3.3.2 Secure Sockets Layer (SSL)
    • 1.3.3.3 Oracle Internet Directory and Single Sign-on (SSO)
    • 1.3.3.4 Oracle Application Server Certificate Authority

2 Identity Management and OracleAS Certificate Authority Features

• 2.1 Identity Management Components and Architecture
  • 2.1.1 Oracle Identity Management
  • 2.1.2 Leveraging Oracle Identity Management in the Enterprise
  • 2.1.3 Role of Oracle Identity Management in the Oracle Security Architecture
  • 2.1.4 Role of OracleAS Certificate Authority in Oracle Identity Management
  • 2.1.5 Simplified Provisioning through SSO Integration
  • 2.1.6 Third Party PKI Support in Oracle Identity Management
• 2.2 Key Features of Oracle Application Server Certificate Authority
  • 2.2.1 Support for Open Standards
  • 2.2.2 Flexible Policy
  • 2.2.3 Ease of Use for Administrators and End Users
  • 2.2.4 Globalization Support for OCA Screens
  • 2.2.5 Scalability, Performance, and High Availability
  • 2.2.6 Secure Email Through S/MIME Digital Encryption and Signing
• 2.3 Automatic or Manual Provisioning of Certificates
  • 2.3.1 Oracle Single Sign-on Authentication
  • 2.3.2 Certificate-based Authentication Using Secure Socket Layer (SSL)
  • 2.3.3 Manual Approval
• 2.4 Hierarchical Certificate Authority Support

3 OracleAS Certificate Authority Deployment Guidelines

• 3.1 Road Map for Setting up a Certificate Authority
• 3.2 Certificate Requirements and Policies
  • 3.2.1 Define Certificate Requirements and Properties
    • 3.2.1.1 Certificate Provisioning
    • 3.2.1.2 Certificate Types
    • 3.2.1.3 Certificate Properties
    • 3.2.1.4 Certificate Renewal and Revocation
    • 3.2.1.5 Distributing the CA Certificate
  • 3.2.2 Define Certificate Policies and Practices
  • 3.2.3 Define CRL Policies
  • 3.2.4 Define Alerts and Notifications
• 3.3 Planning your OracleAS Certificate Authority Architecture
  • 3.3.1 CA Trust Hierarchy
    • 3.3.1.1 Online and Offline CAs
  • 3.3.2 Securing the CA
• 3.4 Deployment Considerations and Base Scenarios
  • 3.4.1 Required Components for OracleAS Certificate Authority
  • 3.4.2 Default Deployment
  • 3.4.3 Production Deployment
  • 3.4.4 DMZ Deployment
  • 3.4.5 High Availability Deployment Options
    • 3.4.5.1 Cold Failover Cluster
    • 3.4.5.2 Disaster Recovery
    • 3.4.5.3 Cold Failover Cluster and Disaster Recovery
• 3.5 OracleAS Certificate Authority Implementation and Use Case
  • 3.5.1 Implementation Checklist
  • 3.5.2 Use Case: MyPKIsite.com
    • 3.5.2.1 Scenario
    • 3.5.2.2 Administrative Roles
    • 3.5.2.3 CA Hierarchy for MyPKIsite.com
    • 3.5.2.4 User Entries in Oracle Internet Directory
    • 3.5.2.5 Component Instances
    • 3.5.2.6 Certificate Requirements for MyPKIsite.com
    • 3.5.2.7 Security Considerations
    • 3.5.2.8 High Availability Considerations
    • 3.5.2.9 Detailed Implementation Checklist for MyPKIsite.com

4 Introduction to Administration and Certificate Management

• 4.1 Starting and Stopping Oracle Application Server Certificate Authority
• 4.2 Requesting the Administrator Certificate
• 4.3 Replacing the Administrator Certificate
• 4.4 Overview of the OracleAS Certificate Authority Administration Interface
  • 4.4.1 Certificate Management Tab
• 4.5 Managing Certificates
  • 4.5.1 Approving or Rejecting Certificate Requests
    • 4.5.1.1 To Approve a Certificate Request
    • 4.5.1.2 To Reject a Certificate Request
  • 4.5.2 Viewing Details of Certificates
  • 4.5.3 Revoking Certificates
    • 4.5.3.1 Reasons for Revocation
  • 4.5.4 Renewing Certificates
  • 4.5.5 Listing a Single Certificate Request or Issued Certificate
  • 4.5.6 Using Advanced Search
    • 4.5.6.1 Search Certificate Requests using Request Status
    • 4.5.6.2 Search Using Distinguished Name (DN)
    • 4.5.6.3 Search Using Advanced Distinguished Name
    • 4.5.6.4 Search Using Serial Number/Request ID Range
    • 4.5.6.5 Search Using Certificate Status
• 4.6 Updating the Certificate Revocation List (CRL)
• 4.7 Oracle Internet Directory Integration
  • 4.7.1 Retrieving the Certificate Revocation List
• 4.8 Single Sign-on and OracleAS Certificate Authority
  • 4.8.1 Broadcasting the OracleAS Certificate Authority Certificate Request URL to SSO-Authenticated Users
  • 4.8.2 Bringing SSO-Authenticated Users to the OracleAS Certificate Authority Certificate Request URL
  • 4.8.3 User Certificates and SSO Usage
• 4.9 Default Install Values for OracleAS Certificate Authority
  • 4.9.1 Enabling PKI Authentication with SSO and OracleAS Certificate Authority
• 4.10 Routine Administration Tasks

5 Configuring Oracle Application Server Certificate Authority

• 5.1 Structure of the Administration Interface
• 5.2 Configuration Management Tab
  • 5.2.1 Summary of Configuration Tasks
  • 5.2.2 Notification Sub-tab
    • 5.2.2.1 Mail Details
    • 5.2.2.2 Alerts
    • 5.2.2.3 Scheduled Jobs
  • 5.2.3 Email Templates
    • 5.2.3.1 Values for the tokens
  • 5.2.4 General Sub-tab
    • 5.2.4.1 Certificate Publishing
    • 5.2.4.2 SSL and SSO Authentication
    • 5.2.4.3 Default usage for client certificates
    • 5.2.4.4 Subject Alternate Name Extension
    • 5.2.4.5 Logging and Tracing
    • 5.2.4.6 Default Base DN Components
    • 5.2.4.7 Database Settings
    • 5.2.4.8 Directory Settings
• 5.3 View Logs Tab

6 Managing Policies in Oracle Application Server Certificate Authority

• 6.1 Definitions
• 6.2 Overview of Policy Management
• 6.3 Oracle Application Server Certificate Authority Policies
  • 6.3.1 RSAKeyConstraints
  • 6.3.2 ValidityRule
  • 6.3.3 UniqueCertificateConstraint
  • 6.3.4 RevocationConstraints
  • 6.3.5 RenewalRequestConstraint
• 6.4 Policy Sub-tab of Oracle Application Server Certificate Authority
  • 6.4.1 Default Certificate Request Policies
  • 6.4.2 Default Certificate Revocation Policy
  • 6.4.3 Certificate Renewal Policy as Shipped
  • 6.4.4 TrustPointDNCustomRule as Shipped
  • 6.4.5 Policy Actions
    • 6.4.5.1 Edit
    • 6.4.5.2 Enable or Disable
    • 6.4.5.3 Delete
    • 6.4.5.4 Reordering Policies
    • 6.4.5.5 Adding Policies
• 6.5 Predicates in Policy Rules
  • 6.5.1 Multiple Predicate Evaluation
    • 6.5.1.1 Evaluation Example for Multiple Predicates
    • 6.5.1.2 One Further Example of Evaluating Multiple Predicates
    • 6.5.1.3 Reordering Predicates
    • 6.5.1.4 Adding Predicates
• 6.6 Developing a Custom Policy Plug-in
  • 6.6.1 What Processing Does a Policy Do?
  • 6.6.2 Steps in Creating a New Policy Plug-in
  • 6.6.3 Rules for Custom Policies
  • 6.6.4 An Example of a Custom Policy Plug-in
  • 6.6.5 Generic Error Messages

7 OracleAS Certificate Authority Administration: Advanced Topics

• 7.1 Wallet Operations for OracleAS Certificate Authority
  • 7.1.1 Regenerating the CA Signing Wallet
  • 7.1.2 Regenerating the CA SSL and CA S/MIME Wallets
    • 7.1.2.1 The CA SSL Wallet
    • 7.1.2.2 The CA S/MIME Wallet
  • 7.1.3 Renewing Critical Wallets
  • 7.1.4 Changing Passwords
• 7.2 Configuration Operations for OracleAS Certificate Authority
  • 7.2.1 Configuring Oracle HTTP Server to Use a Third Party SSL Wallet
  • 7.2.2 Revoking a Certificate Authority Certificate
  • 7.2.3 Revoking the OracleAS Certificate Authority Web Administrator's Certificate
  • 7.2.4 Configuring Globalization Support for Screens
• 7.3 Performance Tuning for OracleAS Certificate Authority
  • 7.3.1 Tuning Database Connections
  • 7.3.2 Tuning Interactions with OracleAS Single Sign-On
  • 7.3.3 Tuning Maximum Memory
  • 7.3.4 Tuning Oracle Internet Directory Connections
  • 7.3.5 Tuning Other Components
• 7.4 Customization Support
• 7.5 Log or Trace OracleAS Certificate Authority Actions
  • 7.5.1 Clearing Log or Trace Information for OracleAS Certificate Authority
• 7.6 Changing the Infrastructure Services
  • 7.6.1 Changing Identity Management (IM) Services
  • 7.6.2 Changing Metadata Repository (MR) Services
  • 7.6.3 Where Connection Information Is Stored and Displayed
• 7.7 OracleAS Certificate Authority and High-Availability Features
  • 7.7.1 OracleAS Certificate Authority Deployment Using Cold Failover
  • 7.7.2 OracleAS Certificate Authority Deployment Using Real Application Clusters
• 7.8 OracleAS Certificate Authority Backup and Recovery Considerations
• 7.9 Restricting the Realm of Certificate Publication
• 7.10 Replacing the CA and Deinstalling OracleAS Certificate Authority
• 7.11 Directory Integration Tasks

8 End-User Interface of the Oracle Application Server Certificate Authority

• 8.1 Accessing the User Interface
• 8.2 End-User Tabs and Processes
  • 8.2.1 User Certificates Tab
    • 8.2.1.1 Single Sign-on Authentication (SSO)
    • 8.2.1.2 Configuring Your Browser to Trust OracleAS Certificate Authority
    • 8.2.1.3 Secure Sockets Layer (SSL) Authentication
    • 8.2.1.4 Manual Authentication
  • 8.2.2 Certificate Retrieval, Renewal, and Revocation
    • 8.2.2.1 Certificate Retrieval
    • 8.2.2.2 Certificate Renewal
    • 8.2.2.3 Certificate Revocation
  • 8.2.3 Server/SubCA Certificates Tab
  • 8.2.4 Subordinate CA Certificates
• 8.3 Installing a CA Certificate
• 8.4 Handling Certificate Revocation Lists (CRLs)
  • 8.4.1 Installing a CRL into Your Browser
    • 8.4.1.1 Installing the CRL In Netscape 7.x and Mozilla Firefox
    • 8.4.1.2 Installing the CRL In Internet Explorer (IE)
  • 8.4.2 Saving the Binary or BASE64 CRL to Disk
• 8.5 Importing a Newly Issued Certificate to Your Browser
• 8.6 Exporting (Backing up) Your Wallet from Your Browser
• 8.7 Importing a Certificate from Your File System

A Command-Line Administration

• A.1 Command-Line Tool
• A.2 Converting a CA SSL Server Wallet into SSO Form
• A.3 Starting the Oracle Certificate Authority Server
• A.4 Stopping the Oracle Application Server Certificate Authority Server
• A.5 Finding the Status of the Oracle Certificate Authority Services
• A.6 Changing Privileged Passwords
• A.7 Regenerating the Root Certificate Authority's Certificate
• A.8 Regenerating the Certificate Authority's SSL Certificate and Wallet
• A.9 Revoking a Root CA Certificate
• A.10 Generating a Sub CA Signing Wallet from OracleAS Certificate Authority
• A.11 Installing/Importing a Sub CA Signing Wallet
• A.12 Generating a CA SSL Wallet for a Sub CA
• A.13 Clearing Log or Trace Storage
• A.14 Updating OracleAS Certificate Authority Repository Connection Information
• A.15 Setting SSO Authentication (linksso, unlinksso commands)
• A.16 Setting Log/Trace Options

B Setting up a CA Hierarchy

• B.1 Generating a Sub CA Signing Wallet
• B.2 Installing and Using the New Sub CA Signing Wallet
  • B.2.1 Configuring an OracleAS Certificate Authority Instance to Be a Subordinate CA of Another CA
  • B.2.2 Generating CA SSL and CA SMIME Wallets for a Sub CA

C Troubleshooting OracleAS Certificate Authority

• C.1 Problems and Solutions
  • C.1.1 Prerequisite Issues and Warnings
    • C.1.1.1 Key Pair Generation Fails during Certificate Requests on Windows
    • C.1.1.2 Cannot Log in as Administrator after Logging in as Normal User
    • C.1.1.3 Changing Passwords Requires OracleAS Certificate Authority's Command-line Tool ocactl
    • C.1.1.4 Remembering and Restoring the Metadata Repository Password
    • C.1.1.5 Using ocactl raises "Error:Password store missing" message
  • C.1.2 Browser Issues
    • C.1.2.1 Browser issues a warning if the CA SSL Server's CN does not match the machine name
    • C.1.2.2 Certificate list shows all users as "Users"
    • C.1.2.3 Netscape/Mozilla Issues
    • C.1.2.4 Internet Explorer (IE) Issues
  • C.1.3 Network Issues
    • C.1.3.1 Error message when logging on to OracleAS Certificate Authority using SSO username/password
    • C.1.3.2 "Network Error" message
    • C.1.3.3 OracleAS Certificate Authority Stops Working, or Network/Server Messages Appear
  • C.1.4 Certificate Issues
    • C.1.4.1 Installing user certificate does not install CA certificate on Netscape/Mozilla
    • C.1.4.2 Inability to Access or Use the Certificate Management Tab
    • C.1.4.3 Administrator Needs to Work from a Different Machine
    • C.1.4.4 Attribute Error on a Certificate Request
  • C.1.5 Single Sign-on Issues
    • C.1.5.1 Name shown on an SSO certificate appears only as "User"
    • C.1.5.2 VBScript Error Message While Generating Keys
    • C.1.5.3 "Page can not be displayed" Message in Internet Explorer
    • C.1.5.4 Going to SSO login page in IE can get a security warning dialog
    • C.1.5.5 Certificate Acquired with Single Sign-on not Seen for SSL Authentication
  • C.1.6 Backup Protection Issue
    • C.1.6.1 Ensuring Recoverability of the OracleAS Certificate Authority Internal Repository
  • C.1.7 Recovery Issue
    • C.1.7.1 Clicking on the Certificate Management tab from the OracleAS Certificate Authority Administrative page returns a browser 404 error
  • C.1.8 General Issues
    • C.1.8.1 Pages taking too long to load, or hanging
    • C.1.8.2 No SMIME signing certificate in Outlook Express
    • C.1.8.3 Browser warning about CA SSL Server's CN
• C.2 Need More Help?

D Extensions

• D.1 Certificate Usage
  • D.1.1 Policy Application to Certificates

E Enabling SSL and PKI on SSO

• E.1 Enabling SSL on SSO
• E.2 Enabling PKI on SSO
• E.3 Re-registering the Virtual Host with the SSL-Enabled SSO
  • E.3.1 Example of Re-Registration

F External Access to Protected OracleAS Certificate Authority

• F.1 Enabling OracleAS Certificate Authority to Support Proxy Servers
• F.2 Disabling OracleAS Certificate Authority's Support for Proxy Servers

G S/MIME with OracleAS Certificate Authority

• G.1 SMIME Operations
  • G.1.1 Setup
    • G.1.1.1 Getting certificates
    • G.1.1.2 Setting S/MIME parameters
  • G.1.2 Sending Messages
    • G.1.2.1 Outlook Mail Client
    • G.1.2.2 Mozilla/Netscape Mail Client
  • G.1.3 Receiving Messages
    • G.1.3.1 Outlook Mail Client
    • G.1.3.2 Mozilla/Netscape Mail Client
  • G.1.4 Getting Other People's Encryption Certificates

H Configuring OracleAS WebCache for OracleAS Certificate Authority

• H.1 Install OracleAS WebCache
• H.2 Configure OracleAS WebCache for OracleAS Certificate Authority
• H.3 Configure OracleAS Certificate Authority Virtual Hosts for OracleAS WebCache
• H.4 Enable OracleAS WebCache for OracleAS Certificate Authority

I The Oracle Application Server Certificate Authority Web Interface

• I.1 Windows and Fields in the Administration Interface
  • I.1.1 Web Administrator Enrollment--Advanced DN
  • I.1.2 Advanced Screen
  • I.1.3 Certificate Details
  • I.1.4 Certificate Request Rejection
  • I.1.5 Certificate Request Approval - Manual
  • I.1.6 Requests Page
  • I.1.7 Adding Custom Policies
    • I.1.7.1 Related Topics
  • I.1.8 Edit RenewalRequestConstraint
    • I.1.8.1 Parameter Details
    • I.1.8.2 Predicate Details
    • I.1.8.3 Related Topics
  • I.1.9 Edit RevocationConstraintRule
    • I.1.9.1 Parameter Details
    • I.1.9.2 Predicate Details
    • I.1.9.3 Related Topics
  • I.1.10 Edit RSAKeyConstraints
    • I.1.10.1 Parameter Details
    • I.1.10.2 Predicate Details
    • I.1.10.3 Related Topics
  • I.1.11 Edit TrustPointDNCustomRule
  • I.1.12 Edit UniqueCertificateConstraints
  • I.1.13 Edit ValidityRule
  • I.1.14 Configuration Management -- General
  • I.1.15 Configuration Management -- Notification
  • I.1.16 Configuration Management -- Policy
  • I.1.17 Update Certificate Revocation List
  • I.1.18 Welcome to the OracleAS Certificate Authority Administration Pages
  • I.1.19 Web Administrator Enrollment
  • I.1.20 View Logs
• I.2 Windows and Fields in the End-User Interface
  • I.2.1 Advanced Search Screen
  • I.2.2 Authentication Page
  • I.2.3 CA Certificate Details
  • I.2.4 Save CA Certificate
  • I.2.5 Certificate Approval--Single Sign-On, SSL
  • I.2.6 Certificate Details
  • I.2.7 Certificate Request Form
  • I.2.8 Certificate Revocation List
  • I.2.9 Revocation Reason
  • I.2.10 Certificate Request Form--Advanced
  • I.2.11 Server/SubCA Certificates
  • I.2.12 Server / SubCA Certificate Request
  • I.2.13 Certificate Request Form - SSL Authentication
  • I.2.14 SSO Certificate Request Form
  • I.2.15 User Certificates - Manual Authentication
  • I.2.16 User Certificates - SSL Authentication
  • I.2.17 User Certificates - SSO Authentication
  • I.2.18 Welcome to the OracleAS Certificate Authority User Pages

Glossary

Index