This chapter describes how to configure Node Manager per the EDG recommendations. Oracle Fusion Middleware EDG recommends using host name verification for the communications between Node Manager and the Administration Server. This requires the use of certificates for the different addresses communicating with the Administration Server. In this chapter, the steps for configuring SOAHOST1 and SOAHOST2 certificates for host name verification are provided. Similar steps are required for WCHOST1 and WCHOST2. Although the appropriate host name changes in the steps are required for WCHOST1 and WCHOST2, the procedure and syntax are exactly the same.
This chapter includes the following sections:
Section 7.2, "Enabling Host Name Verification Certificates for Node Manager in SOAHOST1"
Section 7.4, "Enabling Host Name Verification Certificates for the Node Manager in SOAHOST2"
The Node Manager enables you to start and stop the Administration Server and the managed servers.
The passwords used in this guide are used only as examples. Use secure passwords in a production environment. For example, use passwords that include both uppercase and lowercase characters as well as numbers.
Perform these steps to set up host name verification certificates for communication between the Node Manager and the Administration Server.
Step 1: Generating Self-Signed Certificates Using the utils.CertGen Utility
Step 2: Creating an Identity Keystore Using the utils.ImportPrivateKey Utility
Step 4: Configuring Node Manager to Use the Custom Keystores
Follow these steps to create self-signed certificates on SOAHOST1.mycompany.com. These certificates should be created using the network name/alias. For information on on using trust CA certificates instead, see "Configuring Identity and Trust" in Oracle Fusion Middleware Securing Oracle WebLogic Server.
Set up your environment by running the ORACLE_BASE/product/fmw/wlserver_10.3/server/bin/setWLSEnv.sh
script:
In the Bourne shell, run the following command:
SOAHOST1> . setWLSEnv.sh
Verify that the CLASSPATH environment variable is set:
SOAHOST1> echo $CLASSPATH
Create a user-defined directory for the certificates. For example, create a directory called certs under the ORACLE_BASE/product/fmw/
directory. Note that certificates can be shared across WLS domains.
SOAHOST1> cd ORACLE_BASE/product/fmw SOAHOST1> mkdir certs
Change directory to the user-defined directory.
SOAHOST1> cd certs
Run the utils.CertGen
tool from the user-defined directory to create the certificates for both SOAHOST1 and SOAHOST1VHN1.
Syntax:
java utils.CertGen
<key_passphrase> <cert_file_name> <key_file_name>
[export | domestic] [hostname]
Examples:
SOAHOST1> java utils.CertGen welcome1 SOAHOST1_cert SOAHOST1_key domestic SOAHOST1.mycompany.com SOAHOST1> java utils.CertGen welcome1 VIPHOST1_cert VIPHOST1_key domestic SOAHOST1VHN1.mycompany.com
Follow these steps to create an Identity Keystore on SOAHOST1.mycompany.com.
Create a new identity keystore called appIdentityKeyStore using the utils.ImportPrivateKey utility.
Create this keystore under the same directory as the certificates (that is, ORACLE_BASE/product/fmw/certs
).
Note:
The Identity Store is created (if none exists) when you import a certificate and the corresponding key into the Identity Store using theutils.ImportPrivateKey
utility.Import the certificate and private key for both SOAHOST1 and VIPHOST1 into the Identity Store. Make sure that you use a different alias for each of the certificate/key pair imported.
Syntax:
java utils.ImportPrivateKey
<keystore_file> <keystore_password> <certificate_alias_to_use> <private_key_passphrase> <certificate_file> <private_key_file>
[
<keystore_type>
]
Examples:
SOAHOST1> java utils.ImportPrivateKey appIdentityKeyStore.jks welcome1 appIdentity1 welcome1 ORACLE_BASE/product/fmw/certs/SOAHOST1_cert.pem ORACLE_BASE/product/fmw/certs/SOAHOST1_key.pem SOAHOST1> java utils.ImportPrivateKey appIdentityKeyStore.jks welcome1 appIdentity2 welcome1 ORACLE_BASE/product/fmw/certs/VIPHOST1_cert.pem ORACLE_BASE/product/fmw/certs/VIPHOST1_key.pem
Follow these steps to create the Trust Keystore on SOAHOST1.mycompany.com.
Create a new trust keystore called appTrustKeyStore using the keytool
utility:
bash-3.00$ keytool -keystore appTrustKeyStore.jks -genkey -keyalg RSA -alias appTrustKey -dname "cn=appTrustKey,ou=FOR TESTING ONLY,o=MyOrganization,L=MyTown,ST=MyState,C=US" Enter keystore password: Re-enter new password: Enter key password for <appTrustKey> (RETURN if same as keystore password): bash-3.00$ _
Note:
Use the standard Java keystore to create the new trust keystore because it already contains most of the needed root CA certificates. Do not to modify the standard Java trust key store directly.You will be asked a series of questions. The keystore is created after you respond to these questions.
Tip:
Make a note of the information that you provide on the command line and in the subsequent dialog box, because you will need this information to define gateway policy steps.Change the default password for the standard Java keystore utility using the keytool
utility. Use the following syntax to change the default password:
keytool -storepasswd
-keystore
<TrustKeyStore>
Copy the standard Java keystore called cacerts, which is located in the ORACLE_BASE/product/fmw/wlserver_10.3/server/lib
directory, to the same directory as the certificates. Copy cacerts as follows:
SOAHOST1> cp ORACLE_BASE/product/fmw/wlserver_10.3/server/lib/cacerts ORACLE_BASE/product/fmw/certs/appTrustKeyStore.jks
Import the CA certificate called CertGenCA.der into the appTrustKeyStore using the keytool
utility. This certificate, which is located in the ORACLE_BASE/product/fmw/wlserver_10.3/server/lib
directory, is used to sign all certificates generated by utils.CertGen tool. Import CertGenCA.der using the following syntax:
keytool -import -v -noprompt -trustcacerts -alias
<AliasName>
-file
<CAFileLocation>
-keystore
<KeyStoreLocation>
To configure the Node Manager to use the custom keystores, add the following lines to the end of the nodemanager.properties
file located in the ORACLE_BASE/product/fmw/wlserver_10.3/common/nodemanager
directory:
KeyStores=CustomIdentityAndCustomTrust CustomIdentityKeyStoreFileName=<Identity KeyStore> CustomIdentityKeyStorePassPhrase=<Identity KeyStore Passwd> CustomIdentityAlias=<Identity Key Store Alias> CustomIdentityPrivateKeyPassPhrase=<Private Key used when creating Certificate> Make sure to use the correct value for CustomIdentityAlias on each node. For example on SOAHOST1, use appIdentity1, and on VIPHOST1, use appIdentity2. Example for Node 1: KeyStores=CustomIdentityAndCustomTrust CustomIdentityKeyStoreFileName=ORACLE_BASE/product/fmw/certs/ appIdentityKeyStore.jks CustomIdentityKeyStorePassPhrase=welcome1 CustomIdentityAlias=appIdentity1 CustomIdentityPrivateKeyPassPhrase=welcome1
The passphrase entries in the nodemanager.properties
file get encrypted when you start Node Manager as described in Section 7.3, "Starting the Node Manager on SOAHOST1." For security reasons, you want to minimize the time the entries in the nodemanager.properties
file are left unencrypted. After you edit the file, you should start Node Manager as soon as possible so that the entries get encrypted.
When using a common/shared storage installation for FMW_HOME, Node Manager is started from different nodes using the same base configuration (nodemanager.properties). In that case, it is required to add the certificate for all the nodes that share the binaries to the appIdentityKeyStore.jks identity store. To do this, create the certificate for the new node and import it to appIdentityKeyStore.jks as described above. Once the certificates are available in the store, each node manager needs to point to a different identity alias to send the correct certificate to the administration server. To do this, set different environment variables before starting Node Manager in the different nodes:
SOAHOST1>cd ORACLE_BASE/product/fmw/wlserver_10.3/server/bin SOAHOST1>export JAVA_OPTIONS=-DCustomIdentityAlias=appIdentitySOAHOST1 SOAHOSTn>cd ORACLE_BASE/product/fmw/wlserver_10.3/server/bin SOAHOSTn>export JAVA_OPTIONS=-DCustomIdentityAlias=appIdentitySOAHOSTn
Run these commands to start Node Manager on SOAHOST1:
Note:
If you have not configured and started Node Manager for the first time yet, run the setNMProps.sh script as specified in section Section 4.10, "Starting Node Manager on SOAHOST1." This will enable the use of the start script which is required for SOA.SOAHOST1> cd ORACLE_BASE/product/fmw/wlserver_10.3/server/bin SOAHOST1> ./startNodeManager.sh
Perform these steps to set up SSL for communication between the Node Manager and the Administration Server:
Step 1: Generating Self-Signed Certificates Using the utils.CertGen Utility
Step 2: Creating an Identity Keystore Using the "utils.ImportPrivateKey" Utility
Step 4: Configuring Node Manager to Use the Custom Keystores
Follow these steps to create self-signed certificates on SOAHOST2.mycompany.com. These certificates should be created using the network name/alias.
Set up your environment by running the ORACLE_BASE/product/fmw/ wlserver_10.3/server/bin/setWLSEnv.sh
script:
In the Bourne shell, run the following command:
SOAHOST2> . setWLSEnv.sh
Verify that the CLASSPATH environment variable is set:
SOAHOST2> echo $CLASSPATH
Create a user-defined directory for the certificates. For example, create a directory called certs under the ORACLE_BASE/product/fmw/
directory. Note that certificates can be shared across WLS domains.
SOAHOST2> cd ORACLE_BASE/product/fmw SOAHOST2> mkdir certs
Change directory to the user-defined directory.
SOAHOST2> cd certs
Run the utils.CertGen tool from the user-defined directory to create the certificates for both SOAHOST2 and VIPHOST1.
Syntax:
java utils.CertGen
<key_passphrase> <cert_file_name> <key_file_name>
[export | domestic] [hostname]
Examples:
SOAHOST2> java utils.CertGen welcome1 SOAHOST2_cert SOAHOST2_key domestic SOAHOST2.mycompany.com SOAHOST2> java utils.CertGen welcome1 VIPHOST1_cert VIPHOST1_key domestic SOAHOST1VHN1.mycompany.com
Follow these steps to create an Identity Keystore on SOAHOST2.mycompany.com.
Create a new identity keystore called "appIdentityKeyStore" using the "utils.ImportPrivateKey" utility.
Create this keystore under the same directory as the certificates (that is, ORACLE_BASE/product/fmw/certs).
Note that the Identity Store is created (if none exists) when you import a certificate and the corresponding key into the Identity Store using the "utils.ImportPrivateKey" utility.
Import the certificate and private key for both SOAHOST2 and VIPHOST1 into the Identity Store. Make sure that you use a different alias for each of the certificate/key pair imported.
Syntax:
java utils.ImportPrivateKey
<keystore_file> <keystore_password> <certificate_alias_to_use> <private_key_passphrase> <certificate_file> <private_key_file>
[
<keystore_type>
]
Examples:
SOAHOST2> java utils.ImportPrivateKey appIdentityKeyStore.jks welcome1 appIdentity1 welcome1 ORACLE_BASE/product/fmw/certs/SOAHOST2_cert.pem ORACLE_BASE/product/fmw/certs/SOAHOST2_key.pem SOAHOST2> java utils.ImportPrivateKey appIdentityKeyStore.jks welcome1 appIdentity2 welcome1 ORACLE_BASE/product/fmw/certs/VIPHOST1_cert.pem ORACLE_BASE/product/fmw/certs/VIPHOST1_key.pem
Follow these steps to create the Trust Keystore on SOAHOST2.mycompany.com.
Create a new trust keystore called appTrustKeyStore using the keytool
utility:
bash-3.00$ keytool -keystore appTrustKeyStore.jks -genkey -keyalg RSA -alias app TrustKey -dname "cn=appTrustKey,ou=FOR TESTING ONLY,o=MyOrganization,L=MyTown,ST=MyState,C=US" Enter keystore password: Re-enter new password: Enter key password for <appTrustKey> (RETURN if same as keystore password): bash-3.00$ _
Note:
Use the standard Java keystore to create the new trust keystore because it already contains most of the needed root CA certificates. Do not to modify the standard Java trust key store directly.You will be asked a series of questions. The keystore is created after you respond to these questions.
Tip:
Make a note of the information that you provide on the command line and in the subsequent dialog box, because you will need this information to define gateway policy steps.Change the default password for the standard Java keystore utility using the keytool
utility. Use the following syntax to change the default password:
keytool -storepasswd
-keystore
<TrustKeyStore>
Copy the standard Java keystore called cacerts, which is located in the ORACLE_BASE/product/fmw/wlserver_10.3/server/lib
directory, to the same directory as the certificates. Copy cacerts as follows:
SOAHOST2> cp ORACLE_BASE/product/fmw/wlserver_10.3/server/lib/cacerts ORACLE_BASE/product/fmw/certs/appTrustKeyStore.jks
Import the CA certificate called CertGenCA.der into the appTrustKeyStore using the keytool
utility. This certificate, which is located in the ORACLE_BASE/product/product/fmw/wlserver_10.3/server/lib
directory, is used to sign all certificates generated by utils.CertGen tool. Import CertGenCA.der using the following syntax:
keytool -import -v -noprompt -trustcacerts -alias
<AliasName>
-file
<CAFileLocation>
-keystore
<KeyStoreLocation>
Follow these steps to configure the Node Manager to use the custom keystores.
Add the following lines to the end of the nodemanager.properties
file located in the ORACLE_BASE/product/fmw/wlserver_10.3/common/nodemanager
directory.
KeyStores=CustomIdentityAndCustomTrust
CustomIdentityKeyStoreFileName=
<Identity KeyStore>
CustomIdentityKeyStorePassPhrase=
<Identity KeyStore Passwd>
CustomIdentityAlias=
<Identity Key Store Alias>
CustomIdentityPrivateKeyPassPhrase=
<Private Key used when creating Certificate>
Make sure to use the correct value for CustomIdentityAlias
on each node. For example on SOAHOST2, use "appIdentity2", and on VIPHOST1, use "appIdentity2".
Example for Node 1:
KeyStores=CustomIdentityAndCustomTrust
CustomIdentityKeyStoreFileName=ORACLE_BASE/product/fmw/certs/appIdentityKeyStore.jks
CustomIdentityKeyStorePassPhrase=welcome1
CustomIdentityAlias=appIdentity1
CustomIdentityPrivateKeyPassPhrase=welcome1
Note:
The passphrase entries in thenodemanager.properties
file get encrypted when you start Node Manager, as described in Section 7.5, "Starting the Node Manager on SOAHOST2."
For security reasons, you want to minimize the time the entries in the nodemanager.properties
file are left unencrypted. After you edit the file, you should start Node Manager as soon as possible so that the entries get encrypted.
Run these commands to start Node Manager on SOAHOST2:
Note:
If you have not configured and started Node Manager for the first time yet, run the setNMProps.sh script as specified in section Section 4.14, "Starting Node Manager on SOAHOST2." This will enable the use of the start script which is required for SOA.SOAHOST2> cd ORACLE_BASE/product/fmw/wlserver_10.3/server/bin SOAHOST2> ./startNodeManager.sh