Installing Digital Certificates for SSL/TLS Encryption on Oracle WebLogic

This section describes how to install digital certificates for SSL/TLS encryption for the Oracle WebLogic environment and discusses how to:

  • Generate and import public keys.

  • Generate private keys and CSRs.

  • Submit CSRs to CAs for signing.

  • Import signed private keys into keystores.

  • Set up gateway private keys.

  • Set up Oracle WebLogic Console for SSL.

Generating and Importing Public Keys (WebLogic)

Before you can generate and import public keys into PeopleSoft, you must access and download the signed public key from your CA. The process for accessing and downloading the signed public key varies, depending on your CA. Contact your CA for information on how to perform these tasks.

To generate and import public keys:

  1. Place the public key from your CA in the keystore. The location of the keystore is:

    <PIA_HOME>\webserv\<DOMAIN>\piaconfig\keystore

  2. Open a command prompt and navigate to the keystore:

    <PIA_HOME>\webserv\peoplesoft\piaconfig\keystore

  3. Enter the following at the prompt:

    pskeymanager -import

  4. At the Enter current keystore password prompt, enter the password and press Enter.

  5. At the Specify an alias for this certificate prompt, enter the alias name and press Enter.

    The alias name you enter must be the same one you entered when you generated the private key.

  6. At the Enter the name of the certificate file to import prompt, enter the path and name of the certificate to import, and press Enter.

  7. At the Trust this certificate prompt, enter Yes and press Enter.

Generating Private Keys and CSRs (WebLogic)

You use PSKeyManager to generate private keys. PSKeyManager is a wrapper to Sun Microsystem's Keytool for managing keys and certificates.

While using PSKeyManager, press the Enter key to select any of the default values presented.

To generate the private key and the CSR on Oracle WebLogic:

  1. Open a command prompt and navigate to the keystore:

    <PIA_HOME>\webserv\peoplesoft\piaconfig\keystore

  2. Enter the following at the prompt:

    pskeymanager -create

  3. Enter the current keystore password and press Enter.

  4. At the Specify an Alias for this Certificate <host_name>? prompt, enter the certificate alias and press Enter.

    The default certificate alias is the local machine name.

  5. At the What is the common name for this certificate <host_name>? prompt, enter the host name for the certificate. For example: 

    <host_name>.corp.example.com

    Press Enter.

    Enter the exact name as it will be accessed in a browser URL. For example, for a URL of https://server.example.com/ps/signon.html, enter server.example.com. The default common name is the same as the alias.

  6. At the What is the Subject Alternate Name for this certificate? prompt, enter one or more host names.

    Enter a Subject Alternate Name (SAN) in the format type:value, where type can be any of domain name server (DNS), IP address, EMAIL, URI, or an arbitrary object identifier (OID). For example, DNS:server.example.com or IP:192.0.2.1. The default SAN is DNS:common_name.

    To enter more than one value, separate the type:value entries with commas and no spaces. For example: DNS:server.example.com,DNS:server2.example.com,IP:192.0.2.1.

  7. Enter the appropriate information at the following prompts. Press Enter after each entry.

    1. Organization unit.

    2. Organization.

    3. City of locality.

    4. State or province.

      You must spell out the entire state name. Do not enter an abbreviation.

    5. Country code.

    6. Number of days the certificate should be valid.

      The default value is 90.

    7. Key size to use.

      The default value is 1024.

    8. Key algorithm.

      The default value is RSA.

    9. Signing algorithm.

      The default value is SHA256withRSA.

  8. At the Enter a private key password prompt, enter the password or press Enter to use the keystore password.

  9. Verify that the values you entered are correct, and press Enter. To go back and change any values, enter No and press Enter.

PSKeyManager generates a private key and provides the certificate signing request (CSR) that you will provide to the CA for signing. The following example shows a sample CSR.

-----BEGIN NEW CERTIFICATE REQUEST----- MIIBtDCCAR0CAQAwdDELMAk
GAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxFD
ASxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxDV
QQxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx43
lCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxMGfk
/jYxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx2F
zdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxEE
BQxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxqI
hoxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxQT
qsxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxaxYI= 
-----END NEW CERTIFICATE REQUEST-----

The CSR is written in as a text file to the <PIA_HOME>\webserv\peoplesoft directory. The file name is <host_name>_certreq.txt.

Submitting CSRs to CAs for Signing (WebLogic)

After you generate the private key and a certificate signing request (CSR), you must submit the CSR to the certificate authority (CA) for signing.

The process of obtaining the signature varies, depending on the CA that you select. Typically, a CA requires you to paste the content of the PEM-formatted CSR into a form that you submit online. However, the CA may send the signed public key (root) certificate to you by email or require you to download it from a specified web page. The CA may also provide its root certificate or instructions for retrieving it.

Use the appropriate method to submit a CSR for signing as determined by your CA.

When you do submit the CSR for signing the content you provide must include the begin section (-----BEGIN NEW CERTIFICATE REQUEST-----) and the end section (-----END NEW CERTIFICATE REQUEST-----) of the CSR.

The CA will return the signed certificate to you that you must import into the keystore.

Importing Signed Private Keys into Keystores (WebLogic)

You use PSKeyManager to import a server-side private key into the keystore.

  1. Open a command prompt and navigate to the keystore:

    <PIA_HOME>\webserv\peoplesoft\piaconfig\keystore

  2. Enter the following at the prompt:

    pskeymanager -import

  3. At the Enter current keystore password prompt, enter the password and press Enter.

  4. At the Specify an alias for this certificate prompt, enter the alias name and press Enter.

    The alias name you enter must be the same one you entered when you generated the private key.

  5. At the Enter the name of the certificate file to import prompt, enter the path and name of the certificate to import, and press Enter.

  6. At the Trust this certificate prompt, enter Yes and press Enter.

Setting Up Gateway Private Keys (WebLogic)

To set up private keys for gateways, follow the procedures outlined in the following topics presented earlier in this section:

  • Generating Private Keys and CSRs.

  • Submitting CSRs to CAs for Signing.

  • Importing Server-Side Private Keys into Keystores.

The only difference is that for the following prompts you enter names that are gateway-specific:

Prompt Sample Values

Certificate alias.

Enter an alias, such as PT860GATEWAY.

Common name for this certificate.

Enter a name, such as PT860GATEWAY.

Setting Up Oracle WebLogic for SSL/TLS Encryption

This section describes how to set up Oracle WebLogic for SSL/TLS encryption.

Note:

Several pages and fields mentioned in this section reference only SSL. These pages and fields are also used for setting up TLS.

To set up Oracle WebLogic for SSL/TLS:

  1. With the PIA server running, sign in to the WebLogic Remote Console.

    See System and Server Administration: Using WebLogic Remote Console

  2. Click the Edit Tree tile, and select Environment, and then Servers, and then PIA.

  3. On the General tab, ensure the option SSL Listen Port Enabled is selected, and that the SSL Listen Port number is entered correctly.

  4. Select Environment, and then Servers, and then PIA, and then Security, and then Keystore from the left navigation panel.

  5. Select Custom Identity and Custom Trust from the Keystores drop-down list.

  6. Update the fields on the Keystores page as follows:

    • Custom Identity Key Store File Name — piaconfig/keystore/pskey

      This entry sets the pskey location as <PS_CFG_HOME>/webserv/<domain_name>/piaconfig/keystore/pskey.

    • Custom Identity Key Store Type — PKCS12.

    • Custom Identity Key Store Pass Phrase — Enter the password that you entered when creating or importing the certificate.

    • Custom Trust Key Store File Name — piaconfig/keystore/pskey

    • Custom Trust Key Store Type — PKCS12

    • Custom Trust Key Store Pass Phrase — Enter the password that you entered when creating or importing the certificate.

  7. Select the Security SSL tab.

  8. Update the fields on the SSL page as follows:

    • Identity and Trust Locations — Enter Keystores.

    • Server Private Key Alias — Enter your server name or the alias name you specified when creating the certificate.

    • Server Private Key Pass Phrase — Enter the password that you entered when creating or importing the certificate.

  9. Click Save.

  10. Select the Show Advanced Fields check box.

  11. Enable the options Two Way SSL Enabled and Client Cert Enforced.

    Note:

    Set this option only if the node is set up for certificate-based authentication or non-repudiation, or if required for two-way SSL.

  12. Click Save.

    Click the Shopping Cart icon to check for pending changes and commit them if necessary.

  13. Restart the web server.

    Note:

    It is necessary to restart the web server after changing from the Demo trust key to custom.