BEA Systems, Inc.

Type-Safe Access to BEA WebLogic Server 9.2 MBeans (Deprecated)

(Methods marked with @since 9.0.0.0 are not available through the deprecated MBeanHome interface.)


weblogic.management.configuration
Interface SSLMBean

All Superinterfaces:
ConfigurationMBean, weblogic.descriptor.DescriptorBean, DynamicMBean, MBeanRegistration, NotificationBroadcaster, weblogic.descriptor.SettableBean, weblogic.management.WebLogicMBean

public interface SSLMBean
extends ConfigurationMBean

This MBean represents the configuration of the SSL protocol.

Deprecation of MBeanHome and Type-Safe Interfaces

This is a type-safe interface for a WebLogic Server MBean, which you can import into your client classes and access through weblogic.management.MBeanHome. As of 9.0, the MBeanHome interface and all type-safe interfaces for WebLogic Server MBeans are deprecated. Instead, client classes that interact with WebLogic Server MBeans should use standard JMX design patterns in which clients use the javax.management.MBeanServerConnection interface to discover MBeans, attributes, and attribute types at runtime. For more information, see "Developing Manageable Applications with JMX" on http://www.oracle.com/technology/documentation/index.html.


Field Summary
static String BUILTIN_SSL_VALIDATION_AND_CERT_PATH_VALIDATORS
          Indicates that the built-in SSL certificate validation should be used to complete and validate the peer's certificate chain then the configured CertPathValidator security providers should be used to perform extra validation on the chain.
static String BUILTIN_SSL_VALIDATION_ONLY
          Indicates that only the built-in SSL certificate validation should be used to complete and validate the peer's certificate chain.
static String IDENTITY_AND_TRUST_LOCATIONS_FILES_OR_KEYSTORE_PROVIDERS
           
static String IDENTITY_AND_TRUST_LOCATIONS_KEYSTORES
           
 
Fields inherited from interface weblogic.management.configuration.ConfigurationMBean
DEFAULT_EMPTY_BYTE_ARRAY
 
Method Summary
 String[] getCiphersuites()
          Indicates the cipher suites being used on a particular WebLogic Server.
 int getExportKeyLifespan()
          Indicates the number of times WebLogic Server can use an exportable key between a domestic server and an exportable client before generating a new key.
 String getHostnameVerifier()
          The name of the class that implements the weblogic.security.SSL.HostnameVerifier interface.
 String getIdentityAndTrustLocations()
          Indicates where SSL should find the server's identity (certificate and private key) as well as the server's trust (trusted CAs).
 String getInboundCertificateValidation()
          Indicates the client certificate validation rules for inbound SSL.
 int getListenPort()
          The TCP/IP port at which this server listens for SSL connection requests.
 int getLoginTimeoutMillis()
          Specifies the number of milliseconds that WebLogic Server waits for an SSL connection before timing out.
 String getOutboundCertificateValidation()
          Indicates the server certificate validation rules for outbound SSL.
 int getPeerValidationEnforced()
          Deprecated. 6.1.0.0 this is an unused attribute.
 String getServerCertificateChainFileName()
          Deprecated. 7.0.0.0 server certificates (and chains) should be stored in keystores.
 String getServerCertificateFileName()
          Deprecated. 8.1.0.0 server certificates (and chains) should be stored in keystores.
 String getServerKeyFileName()
          Deprecated. 8.1.0.0 private keys should be stored in keystores.
 String getServerPrivateKeyAlias()
          The string alias used to store and retrieve the server's private key in the keystore.
 String getServerPrivateKeyPassPhrase()
          The passphrase used to retrieve the server's private key from the keystore.
 byte[] getServerPrivateKeyPassPhraseEncrypted()
          The encrypted passphrase used to retrieve the server's private key from the keystore.
 String getTrustedCAFileName()
          Deprecated. 8.1.0.0 trusted CAs should be stored in keystores.
 boolean isClientCertificateEnforced()
          Indicates whether or not clients must present digital certificates from a trusted certificate authority to WebLogic Server.
 boolean isEnabled()
          Indicates whether the server can be reached through the default SSL listen port.
 boolean isHostnameVerificationIgnored()
          Specifies whether to ignore the installed implementation of the weblogic.security.SSL.HostnameVerifier interface (when this server is acting as a client to another application server).
 boolean isSSLRejectionLoggingEnabled()
          Indicates whether warning messages are logged in the server log when SSL connections are rejected.
 boolean isTwoWaySSLEnabled()
          The form of SSL that should be used.
 boolean isUseServerCerts()
          Sets whether the client should use the server certificates/key as the client identity when initiating a connection over https.
 void setCertAuthenticator(String classname)
          Sets the value of the CertAuthenticator attribute.
 void setCiphersuites(String[] ciphers)
          Sets the value of the Ciphersuites attribute.
 void setClientCertificateEnforced(boolean enforce)
          Sets the value of the ClientCertificateEnforced attribute.
 void setEnabled(boolean enable)
           
 void setExportKeyLifespan(int lifespan)
          Sets the value of the ExportKeyLifespan attribute.
 void setHostnameVerificationIgnored(boolean ignoreFlag)
          Sets the value of the HostnameVerificationIgnored attribute.
 void setHostnameVerifier(String classname)
          Sets the value of the HostnameVerifier attribute.
 void setIdentityAndTrustLocations(String locations)
          Sets the value of the IdentityAndTrustLocations attribute.
 void setInboundCertificateValidation(String validationStyle)
          Sets the value of the InboundCertificateValidation attribute.
 void setListenPort(int port)
          Set the value of the ListenPort attribute.
 void setLoginTimeoutMillis(int millis)
          Sets the value of the LoginTimeoutMillis attribute.
 void setOutboundCertificateValidation(String validationStyle)
          Sets the value of the OutboundCertificateValidation attribute.
 void setPeerValidationEnforced(int checkLevel)
          Sets the value of the PeerValidationEnforced attribute.
 void setServerCertificateChainFileName(String fileName)
          Deprecated. 7.0.0.0 Server certificates (and chains) should be stored in keystores.
 void setServerCertificateFileName(String fileName)
          Deprecated. 8.1.0.0 server certificates (and chains) should be stored in keystores.
 void setServerKeyFileName(String fileName)
          Deprecated. 8.1.0.0 private keys should be stored in keystores.
 void setServerPrivateKeyAlias(String alias)
          Sets the value of the ServerPrivateKeyAlias attribute.
 void setServerPrivateKeyPassPhrase(String phrase)
          Sets the value of the ServerPrivateKeyPassPhrase attribute.
 void setServerPrivateKeyPassPhraseEncrypted(byte[] phraseEncrypted)
          Sets the value of the ServerPrivateKeyPassPhrase attribute.
 void setSSLRejectionLoggingEnabled(boolean enabled)
          Sets the value of the SSLRejectionLoggingEnabled attribute.
 void setTrustedCAFileName(String fileName)
          Deprecated. 8.1.0.0 trusted CAs should be stored in keystores.
 void setTwoWaySSLEnabled(boolean enabled)
          Sets the value of the TwoWaySSLEnabled attribute.
 void setUseServerCerts(boolean enabled)
          Indicates that an https client running within WebLogic server should use the server's certificate and key as the client identity
 
Methods inherited from interface weblogic.management.configuration.ConfigurationMBean
freezeCurrentValue, getName, getNotes, isSet, restoreDefaultValue, setComments, setDefaultedMBean, setName, setNotes, setPersistenceEnabled, unSet
 
Methods inherited from interface weblogic.management.WebLogicMBean
getMBeanInfo, getObjectName, getParent, getType, isCachingDisabled, isRegistered, setParent
 
Methods inherited from interface javax.management.DynamicMBean
getAttribute, getAttributes, invoke, setAttribute, setAttributes
 
Methods inherited from interface javax.management.MBeanRegistration
postDeregister, postRegister, preDeregister, preRegister
 
Methods inherited from interface javax.management.NotificationBroadcaster
addNotificationListener, getNotificationInfo, removeNotificationListener
 
Methods inherited from interface weblogic.descriptor.DescriptorBean
addBeanUpdateListener, addPropertyChangeListener, createChildCopy, createChildCopyIncludingObsolete, getDescriptor, getParentBean, isEditable, removeBeanUpdateListener, removePropertyChangeListener
 

Field Detail

BUILTIN_SSL_VALIDATION_AND_CERT_PATH_VALIDATORS

public static final String BUILTIN_SSL_VALIDATION_AND_CERT_PATH_VALIDATORS
Indicates that the built-in SSL certificate validation should be used to complete and validate the peer's certificate chain then the configured CertPathValidator security providers should be used to perform extra validation on the chain.

See Also:
Constant Field Values

BUILTIN_SSL_VALIDATION_ONLY

public static final String BUILTIN_SSL_VALIDATION_ONLY
Indicates that only the built-in SSL certificate validation should be used to complete and validate the peer's certificate chain.

See Also:
Constant Field Values

IDENTITY_AND_TRUST_LOCATIONS_FILES_OR_KEYSTORE_PROVIDERS

public static final String IDENTITY_AND_TRUST_LOCATIONS_FILES_OR_KEYSTORE_PROVIDERS
See Also:
Constant Field Values

IDENTITY_AND_TRUST_LOCATIONS_KEYSTORES

public static final String IDENTITY_AND_TRUST_LOCATIONS_KEYSTORES
See Also:
Constant Field Values
Method Detail

getCiphersuites

public String[] getCiphersuites()

Indicates the cipher suites being used on a particular WebLogic Server.

The possible values are:

The default is TLS_RSA_EXPORT_WITH_RC4_40_MD5.

Returns:
The ciphersuites value

getExportKeyLifespan

public int getExportKeyLifespan()

Indicates the number of times WebLogic Server can use an exportable key between a domestic server and an exportable client before generating a new key. The more secure you want WebLogic Server to be, the fewer times the key should be used before generating a new key.

Returns:
The exportKeyLifespan value

getHostnameVerifier

public String getHostnameVerifier()

The name of the class that implements the weblogic.security.SSL.HostnameVerifier interface.

This class verifies whether the connection to the host with the hostname from URL should be allowed. The class is used to prevent man-in-the-middle attacks. The weblogic.security.SSL.HostnameVerifier has a verify() method that WebLogic Server calls on the client during the SSL handshake.

Returns:
The hostnameVerifier value

getIdentityAndTrustLocations

public String getIdentityAndTrustLocations()

Indicates where SSL should find the server's identity (certificate and private key) as well as the server's trust (trusted CAs).

Domains created in WebLogic Server version 8.1 or later, default to KEYSTORES. Domains created before WebLogic Server version 8.1, default to FILES_OR_KEYSTORE_PROVIDERS.

Returns:
The identityAndTrustLocations value

getInboundCertificateValidation

public String getInboundCertificateValidation()

Indicates the client certificate validation rules for inbound SSL.

This attribute only applies to ports and network channels using 2-way SSL.

Returns:
a String containing the validation style.

getListenPort

public int getListenPort()

The TCP/IP port at which this server listens for SSL connection requests.

Returns:
The listenPort value
See Also:
isEnabled(), ServerMBean.getListenPort(), ServerMBean.getAdministrationPort(), NetworkAccessPointMBean.getListenPort()

getLoginTimeoutMillis

public int getLoginTimeoutMillis()

Specifies the number of milliseconds that WebLogic Server waits for an SSL connection before timing out. SSL connections take longer to negotiate than regular connections.

If clients are connecting over the Internet, raise the default number to accommodate additional network latency.

Returns:
The loginTimeoutMillis value
See Also:
ServerMBean.getLoginTimeoutMillis(), NetworkChannelMBean.getLoginTimeoutMillisSSL()

getOutboundCertificateValidation

public String getOutboundCertificateValidation()

Indicates the server certificate validation rules for outbound SSL.

This attribute always applies to outbound SSL that is part of WebLogic Server (that is, an Administration Server talking to the Node Manager). It does not apply to application code in the server that is using outbound SSL unless the application code uses a weblogic.security.SSL.ServerTrustManager that is configured to use outbound SSL validation.

Returns:
a String containing the validation style.

getPeerValidationEnforced

public int getPeerValidationEnforced()
Deprecated. 6.1.0.0 this is an unused attribute.

Returns:
The peerValidationEnforced value

getServerCertificateChainFileName

public String getServerCertificateChainFileName()
Deprecated. 7.0.0.0 server certificates (and chains) should be stored in keystores.

The full directory location and name of the file containing an ordered list of certificate authorities trusted by WebLogic Server.

The .pem file extension indicates that method that should be used to read the file. Note that as of WebLogic Server version 7.0, the digital certificate for WebLogic Server should not be stored in a file.

Returns:
The serverCertificateChainFileName value

getServerCertificateFileName

public String getServerCertificateFileName()
Deprecated. 8.1.0.0 server certificates (and chains) should be stored in keystores.

The full directory location of the digital certificate file (.der or .pem) for the server.

The pathname should either be absolute or relative to the directory from which the server is booted. This field provides backward compatibility for security configurations that stored digital certificates in files.

The file extension ( .der or .pem) tells WebLogic Server how to read the contents of the file.

Returns:
The serverCertificateFileName value

getServerKeyFileName

public String getServerKeyFileName()
Deprecated. 8.1.0.0 private keys should be stored in keystores.

The full directory location of the private key file (.der or .pem) for the server.

The pathname should either be absolute or relative to the directory from which the server is booted. This field provides backward compatibility for security configurations that store private keys in files. For a more secure deployment, BEA recommends saving private keys in keystores.

The file extension (.der or .pem) indicates the method that should be used to read the file.

Returns:
The serverKeyFileName value

getServerPrivateKeyAlias

public String getServerPrivateKeyAlias()

The string alias used to store and retrieve the server's private key in the keystore. This private key is associated with the server's digital certificate.

Returns:
The serverPrivateKeyAlias value

getServerPrivateKeyPassPhrase

public String getServerPrivateKeyPassPhrase()

The passphrase used to retrieve the server's private key from the keystore. This passphrase is assigned to the private key when it is generated.

Returns:
The serverPrivateKeyPassPhrase value

getServerPrivateKeyPassPhraseEncrypted

public byte[] getServerPrivateKeyPassPhraseEncrypted()

The encrypted passphrase used to retrieve the server's private key from the keystore. This passphrase is assigned to the private key when it is generated.

To set this attribute, use weblogic.management.EncryptionHelper.encrypt() to encrypt the value. Then set this attribute to the output of the encrypt() method.

To compare a password that a user enters with the encrypted value of this attribute, go to the same WebLogic Server instance that you used to set and encrypt this attribute and use weblogic.management.EncryptionHelper.encrypt() to encrypt the user-supplied password. Then compare the encrypted values.

Returns:
The encrypted serverPrivateKeyPassPhrase value
See Also:
weblogic.management.EncryptionHelper

getTrustedCAFileName

public String getTrustedCAFileName()
Deprecated. 8.1.0.0 trusted CAs should be stored in keystores.

The full directory location of the file that specifies the certificate authorities trusted by the server.

The pathname should either be absolute or relative to the directory from which the server is booted. This field provides backward compatibility for security configurations that store trusted certificate authorities in files.

The file specified in this attribute can contain a single digital certificate or multiple digital certificates. The file extension ( .der or .pem) tells WebLogic Server how to read the contents of the file.

Returns:
The trustedCAFileName value

isClientCertificateEnforced

public boolean isClientCertificateEnforced()

Indicates whether or not clients must present digital certificates from a trusted certificate authority to WebLogic Server.

Returns:
The clientCertificateEnforced value

isEnabled

public boolean isEnabled()

Indicates whether the server can be reached through the default SSL listen port.

If the administration port is enabled for the WebLogic Server domain, then administrative traffic travels over the administration port and application traffic travels over the Listen Port and SSL Listen Port. If the administration port is disabled, then all traffic travels over the Listen Port and SSL Listen Port.

Returns:
The enabled value

isHostnameVerificationIgnored

public boolean isHostnameVerificationIgnored()

Specifies whether to ignore the installed implementation of the weblogic.security.SSL.HostnameVerifier interface (when this server is acting as a client to another application server).

Returns:
The hostnameVerificationIgnored value

isSSLRejectionLoggingEnabled

public boolean isSSLRejectionLoggingEnabled()

Indicates whether warning messages are logged in the server log when SSL connections are rejected.

Returns:
The sSLRejectionLoggingEnabled value

isTwoWaySSLEnabled

public boolean isTwoWaySSLEnabled()

The form of SSL that should be used.

By default, WebLogic Server is configured to use one-way SSL (implied by the Client Certs Not Requested value). Selecting Client Certs Requested But Not Enforced enables two-way SSL. With this option, the server requests a certificate from the client, but the connection continues if the client does not present a certificate. Selecting Client Certs Requested And Enforced also enables two-way SSL and requires a client to present a certificate. However, if a certificate is not presented, the SSL connection is terminated.

Returns:
The twoWaySSLEnabled value

isUseServerCerts

public boolean isUseServerCerts()
Sets whether the client should use the server certificates/key as the client identity when initiating a connection over https.


setCertAuthenticator

public void setCertAuthenticator(String classname)
                          throws InvalidAttributeValueException

Sets the value of the CertAuthenticator attribute.

Parameters:
classname - The new certAuthenticator value
Throws:
InvalidAttributeValueException
See Also:
getCertAuthenticator()

setCiphersuites

public void setCiphersuites(String[] ciphers)
                     throws InvalidAttributeValueException

Sets the value of the Ciphersuites attribute.

Parameters:
ciphers - The new ciphersuites value
Throws:
InvalidAttributeValueException - if the array is null or contains null elements.
See Also:
getCiphersuites()

setClientCertificateEnforced

public void setClientCertificateEnforced(boolean enforce)

Sets the value of the ClientCertificateEnforced attribute.

Parameters:
enforce - The new clientCertificateEnforced value
See Also:
isClientCertificateEnforced()

setEnabled

public void setEnabled(boolean enable)
                throws InvalidAttributeValueException
Parameters:
enable - The new enabled value
Throws:
InvalidAttributeValueException
See Also:
isEnabled()

setExportKeyLifespan

public void setExportKeyLifespan(int lifespan)
                          throws InvalidAttributeValueException

Sets the value of the ExportKeyLifespan attribute.

Parameters:
lifespan - The new exportKeyLifespan value
Throws:
InvalidAttributeValueException
See Also:
getExportKeyLifespan()

setHostnameVerificationIgnored

public void setHostnameVerificationIgnored(boolean ignoreFlag)
                                    throws InvalidAttributeValueException

Sets the value of the HostnameVerificationIgnored attribute.

Parameters:
ignoreFlag - The new hostnameVerificationIgnored value
Throws:
InvalidAttributeValueException
See Also:
isHostnameVerificationIgnored()

setHostnameVerifier

public void setHostnameVerifier(String classname)
                         throws InvalidAttributeValueException

Sets the value of the HostnameVerifier attribute.

Parameters:
classname - The new hostnameVerifier value
Throws:
InvalidAttributeValueException
See Also:
getHostnameVerifier()

setIdentityAndTrustLocations

public void setIdentityAndTrustLocations(String locations)

Sets the value of the IdentityAndTrustLocations attribute.

Parameters:
locations - The new identityAndTrustLocations value
See Also:
getIdentityAndTrustLocations()

setInboundCertificateValidation

public void setInboundCertificateValidation(String validationStyle)

Sets the value of the InboundCertificateValidation attribute.

Parameters:
validationStyle - the new validation style
See Also:
getInboundCertificateValidation()

setListenPort

public void setListenPort(int port)

Set the value of the ListenPort attribute.

Parameters:
port - The new listenPort value
See Also:
getListenPort()

setLoginTimeoutMillis

public void setLoginTimeoutMillis(int millis)

Sets the value of the LoginTimeoutMillis attribute.

Parameters:
millis - The new loginTimeoutMillis value
See Also:
getLoginTimeoutMillis()

setOutboundCertificateValidation

public void setOutboundCertificateValidation(String validationStyle)

Sets the value of the OutboundCertificateValidation attribute.

Parameters:
validationStyle - the new validation style
See Also:
getOutboundCertificateValidation()

setPeerValidationEnforced

public void setPeerValidationEnforced(int checkLevel)
                               throws InvalidAttributeValueException

Sets the value of the PeerValidationEnforced attribute.

Parameters:
checkLevel - The new peerValidationEnforced value
Throws:
InvalidAttributeValueException
See Also:
getPeerValidationEnforced()

setServerCertificateChainFileName

public void setServerCertificateChainFileName(String fileName)
Deprecated. 7.0.0.0 Server certificates (and chains) should be stored in keystores.

Sets the value of the ServerCertificateChainFileName attribute.

Parameters:
fileName - The new serverCertificateChainFileName value
See Also:
getServerCertificateChainFileName()

setServerCertificateFileName

public void setServerCertificateFileName(String fileName)
Deprecated. 8.1.0.0 server certificates (and chains) should be stored in keystores.

Sets the value of the ServerCertificateFileName attribute.

Parameters:
fileName - The new serverCertificateFileName value
See Also:
getServerCertificateFileName()

setServerKeyFileName

public void setServerKeyFileName(String fileName)
Deprecated. 8.1.0.0 private keys should be stored in keystores.

Sets the value of the ServerKeyFileName attribute.

Parameters:
fileName - The new serverKeyFileName value
See Also:
getServerKeyFileName()

setServerPrivateKeyAlias

public void setServerPrivateKeyAlias(String alias)

Sets the value of the ServerPrivateKeyAlias attribute.

Parameters:
alias - The new serverPrivateKeyAlias value
See Also:
getServerPrivateKeyAlias()

setServerPrivateKeyPassPhrase

public void setServerPrivateKeyPassPhrase(String phrase)

Sets the value of the ServerPrivateKeyPassPhrase attribute.

As of 8.1 sp4, when you get the value of this attribute, WebLogic Server does the following:

  1. Retrieves the value of the ServerPrivateKeyPassPhraseEncrypted attribute.
  2. Decrypts the value and returns the unencrypted passphrase as a String.

When you set the value of this attribute, WebLogic Server does the following:

  1. Encrypts the value.
  2. Sets the value of the ServerPrivateKeyPassPhraseEncrypted attribute to the encrypted value.

Using this attribute (ServerPrivateKeyPassPhrase) is a potential security risk because the String object (which contains the unencrypted passphrase) remains in the JVM's memory until garbage collection removes it and the memory is reallocated. Depending on how memory is allocated in the JVM, a significant amount of time could pass before this unencrypted data is removed from memory.

Instead of using this attribute, use getServerPrivateKeyPassPhraseEncrypted.

Parameters:
phrase - The new serverPrivateKeyPassPhrase value
See Also:
getServerPrivateKeyPassPhrase(), setServerPrivateKeyPassPhraseEncrypted(byte[])

setServerPrivateKeyPassPhraseEncrypted

public void setServerPrivateKeyPassPhraseEncrypted(byte[] phraseEncrypted)

Sets the value of the ServerPrivateKeyPassPhrase attribute.

Parameters:
phraseEncrypted - The new encrypted serverPrivateKeyPassPhrase value
See Also:
#setServerPrivateKeyPassPhraseEncrypted()

setSSLRejectionLoggingEnabled

public void setSSLRejectionLoggingEnabled(boolean enabled)

Sets the value of the SSLRejectionLoggingEnabled attribute.

Parameters:
enabled - The new sSLRejectionLoggingEnabled value
See Also:
isSSLRejectionLoggingEnabled()

setTrustedCAFileName

public void setTrustedCAFileName(String fileName)
                          throws InvalidAttributeValueException
Deprecated. 8.1.0.0 trusted CAs should be stored in keystores.

Sets the value of the TrustedCAFileName attribute.

Parameters:
fileName - The new trustedCAFileName value
Throws:
InvalidAttributeValueException
See Also:
getTrustedCAFileName()

setTwoWaySSLEnabled

public void setTwoWaySSLEnabled(boolean enabled)

Sets the value of the TwoWaySSLEnabled attribute.

Parameters:
enabled - The new twoWaySSLEnabled value
See Also:
isTwoWaySSLEnabled()

setUseServerCerts

public void setUseServerCerts(boolean enabled)
Indicates that an https client running within WebLogic server should use the server's certificate and key as the client identity

Parameters:
enabled - Uses the server identity for the client

Documentation is available at
http://download.oracle.com/docs/cd/E13222_01/wls/docs92
Copyright 2006 BEA Systems Inc.