Obtaining the Identity Store

Creating Identity Store with Self-Signed Certificates

Self-signed certificates are acceptable for use in a testing or development environment. Oracle Financial Services does not recommend the use of self-signed certificates in a production environment.

In order to create a self-signed certificate, the genkeypair option provided by the keytool utility of Sun Java 8 needs to be utilized

Creation of Self-Signed Certificate

Browse to the bin folder of JRE from the command prompt and type the following command:

keytool -genkeypair -alias alias -keyalg RSA -keysize 1024
                    -sigalg SHA1withRSA -validity 365 -keystore keystore

In the above command:

alias is used to identify the public and private key pair created. This alias is required later when configuring the SSL attributes for the managed servers in Oracle Weblogic Server.
keystore is used to specify the location of the JKS file. If no JKS file is present in the path provided, one will be created.

The command will prompt for the following attributes of the certificate and keystore:

Keystore Password: Specify a password that will be used to access the keystore. This password needs to be specified later, when configuring the identity store in Oracle Weblogic Server.
Key Password: Specify a password that will be used to access the private key stored in the keystore. This password needs to be specified later, when configuring the SSL attributes of the managed server(s) in Oracle Weblogic Server.
First and Last Name (CN): Enter the domain name of the machine used to access OBCLPM, for instance, www.example.com.
Name of your Organizational Unit: The name of the department or unit making the request, for example, BPD. Use this field to further identify the SSL Certificate you are creating, for example, by department or by physical server.
Name of your Organization: The name of the organization making the certificate request, for example, Oracle Financial Services. It is recommended to use the company or organization's formal name, and this name entered here must match the name found in official records.
Name of your City or Locality: The city in which your organization is physically located, for example Mumbai.
Name of your State or Province: The state/province in which your organization is physically located, for example Maharashtra.
Two-Letter Country Code for this Unit: The country in which your organization is physically located, for example US, UK, IN, and so on.

Note:

The key generation algorithm has been specified as RSA, the key size as 1024 bits, the signature algorithm as SHA1withRSA, and the validity days as 365. These can be changed to suitable values if the need arises. For further details, please refer to the documentation of the keytool utility in the JDK utilized by Oracle Weblogic Server

Example

Listed below is the result of a sample execution of the command:

D:\Oracle\weblogic11g\jrockit_160_05_R27.6.2-20\bin>keytool - genkeypair -alias selfcert -keyalg RSA -keysize 1024 -sigalg SHA1withRSA -validity 365 -keystore
D:\keystores\AdminOBCLPMKeyStore.jks

Enter keystore password: <Enter a password to protect the keystore> 

Re-enter new password: <Confirm the password keyed above>

What is your first and last name?
[Unknown]: cvrhp0729.oracle.com

What is the name of your organizational unit?
[Unknown]: BPD

What is the name of your organization?
[Unknown]: Oracle Financial Services

What is the name of your City or Locality?
[Unknown]: Mumbai

What is the name of your State or Province?
[Unknown]: Maharashtra

What is the two-letter country code for this unit?
[Unknown]: IN

Is CN=cvrhp0729.i-flex.com, OU=BPD, O=Oracle Financial Services, L=Mumbai, ST=Maharashtra, C=IN correct? [no]: yes

Enter key password for <selfcert>

RETURN if same as keystore password): <Enter a password to protect the key> 

Re-enter new password: <Confirm the password keyed above>

Keystore Creation

keytool -genkeypair -keystore <keystore_name.jks>
                -alias <alias_name> -dname "CN=<hostname>, OU=<Organization Unit>,
                O=<Organization>, L=<Location>, ST=<State>,
                C=<Country_Code>" -keyalg <Key Algorithm> -sigalg <Signature
                Algorithm> -keysize <key size> -validity <Number of Days> -keypass
                <Private key Password> -storepass <Store Password>

For example: keytool -genkeypair -keystore AdminOBCLPMKeyStore.jks -alias OBCLPMCert -dname "CN=ofss00001.oracle.com, OU=OFSS, O=OFSS, L=Chennai, ST=TN, C=IN" -keyalg "RSA" -sigalg "SHA1withRSA" -keysize 2048 -validity 3650 -keypass Password@123 -storepass Password@123

Note:

CN=ofss00001.oracle.com is the Host Name of the weblogic server

Creating Identity Store with Trusted Certificates Issued by CA

Creation of Public and Private Key Pair

Browse to the bin folder of JRE from the command prompt and type the following command:

keytool -genkeypair -alias alias -keyalg keyalg -keysize keysize - sigalg sigalg -validity valDays -keystore keystore

In the above command,

The alias is used to identify the public and private key pair created. This alias is required later when configuring the SSL attributes for the managed servers in Oracle Weblogic Server.
The keyalg is the key algorithm used to generate the public and private key pair. The RSA key algorithm is recommended.
The keysize is the size of the public and private key pairs generated. A key size of 1024 or more is recommended. Please consult with your CA on the key size support for different types of certificates.
The sigalg is the algorithm used to generate the signature. This algorithm should be compatible with the key algorithm and should be one of the values specified in the Java Cryptography API Specification and Reference.
The keystore is used to specify the location of the JKS file. If no JKS file is present in the path provided, one will be created.

The command will prompt for the following attributes of the certificate and keystore:

Keystore Password: Specify a password that will be used to access the keystore. This password needs to be specified later, when configuring the identity store in Oracle Weblogic Server.
Key Password: Specify a password that will be used to access the private key stored in the keystore. This password needs to be specified later, when configuring the SSL attributes of the managed server(s) in Oracle Weblogic Server
First and Last Name (CN): Enter the domain name of the machine used to access OBCLPM, for instance, www.example.com
Name of your Organizational Unit: The name of the department or unit making the request, for example, BPD. Use this field to further identify the SSL Certificate you are creating, for example, by department or by physical server.
Name of your Organization: The name of the organization making the certificate request, for example, Oracle Financial Services. It is recommended to use the company or organization's formal name, and this name entered here must match the name found in official records.
Name of your City or Locality: The city in which your organization is physically located, for example Mumbai.
Name of your State or Province: The state/province in which your organization is physically located, for example Maharashtra.

Two-letter Country Code for this Unit: The country in which your organization is physically located, for example US, UK, IN, and so on.

Example: Listed below is the result of a sample execution of the command:


D:\Oracle\weblogic11g\jrockit_160_05_R27.6.2-20\bin>keytool - genkeypair -alias cvrhp0729 -keyalg RSA -keysize 1024 -sigalg SHA1withRSA -validity 365 -keystore D:\keystores\AdminOBCLPMKeyStore.jks

Enter keystore password: <Enter a password to protect the keystore>

Re-enter new password: <Confirm the password keyed above>

What is your first and last name?
[Unknown]: cvrhp0729.i-flex.com 

What is the name of your organizational unit?
[Unknown]: BPD 

What is the name of your organization? 
[Unknown]: Oracle Financial Services  

What is the name of your City or Locality? 
[Unknown]: Mumbai  

What is the name of your State or Province? 
[Unknown]: Maharashtra  

What is the two-letter country code for this unit? 
[Unknown]: IN  

Is CN=cvrhp0729.i-flex.com, OU=BPD, O=Oracle Financial Services, L=Mumbai, ST=Maharashtra, C=IN correct? [no]: yes Enter key password for <cvrhp0729>  

RETURN if same as keystore password): <Enter a password to protect the key> 

Re-enter new password: <Confirm the password keyed above>

Generating CSR

To purchase an SSL certificate, you must generate a Certificate Signing Request (CSR) for the server where the certificate will be installed.

A CSR is generated from the server and is the server's unique "fingerprint". The CSR includes the server's public key, which enables server authentication and secure communication.

Note:

If the keystore file or the password is lost and a new one is generated, the SSL certificate and the private key will no longer match. A new SSL Certificate will have to be requested.

The CSR is created by running the following command in the bin directory of the JRE:

keytool -certreq -alias alias –file certreq_file -keystore keystore

In the above command:

The alias is used to identify the public and private key pair. The private key associated with the alias will be utilized to create the CSR. Specify the alias of the key pair created in the previous step.
The certreq_file is the file in which the CSR will be stored.
The keystore is the location of the keystore containing the public and private key pair.
Example: Listed below is the result of a sample execution of the command:
D:\Oracle\Weblogic11g\jrockit_160_05_R27.6.2-20\bin>keytool -certreq -alias cvrhp0729 -file D:\keystores\certreq.csr –keystore
D:\keystores\AdminOBCLPMKeyStore.jks
Enter keystore password: [Enter the password used to access the keystore]
Enter key password for <cvrhp0729> [Enter the password used to access the key in the keystore]

Export Private Key as Certificate

keytool -export -v -alias <alias_name> -file <export_certificate_file_name_with_location.cer> - keystore <keystore_name.jks> > -keypass <Private key Password> -storepass <Store Password>

For example:keytool -export -v -alias OBCLPMCert -file AdminOBCLPMCert.cer -keystore AdminOBCLPMKeyStore.jks -keypass Oracle123 -storepass Oracle123If successful, the following message will be displayed: Certificate stored in file < AdminOBCLPMCert.cer>

Obtaining Trusted Certificate from CA

The processes of obtaining a trusted certificate vary from one CA to another. The CA might perform additional offline verification. Consult the CA issuing the certificate for details on the process to be followed for submission of the CSR and for obtaining the certificate

Importing Certificate into Identity Store

Store the certificate obtained from the CA in the previous step, in a file, preferably in PEM format. Other formats like the p7b file format would require conversion to the PEM format. Details on performing the conversion are not listed here. Please refer to the Oracle Weblogic Server documentation on Securing Oracle Weblogic Server, for details on converting a Microsoft p7b file to the PEM format.

The command to be executed for importing a certificate into the identity store depend on whether the trust store chosen (in the earlier step; see section 2 of this document). It is highly recommended to verify the trust path when importing a certificate into the identity store. The commands provided below assume the use of the Java Standard Trust store.

Importing the Intermediate CA Certificate

Most Certificate Authorities do not use the root CA certificates to issue identity certificates for use by customers. Instead, Intermediate CAs issue identity certificates in response to the submitted CSRs.

If the Intermediate CA certificate is absent in the Java Standard Trust store, the trust path for the certificate will be incomplete for the certificate, resulting in warnings issued by Weblogic Server during runtime. To avoid this, the intermediate CA certificate should be imported into the identity keystore. Although the intermediate CA certificate can be imported into the Java Standard Trust store, this is not recommended unless the intermediate CA can be trusted.

The following command must be executed to import the intermediate CA certificate into the keystore

keytool -importcert -alias alias -file cert_file
                        -trustcacerts -keystore keystore

In the above command,

The alias is used to identify the public and private key pair. Specify the alias of the key pair used to create the CSR in the earlier step.
The cert_file is the location of the file containing the intermediate CA certificate in a PKCS#7 format (PEM or DER file).
The keystore is the location of the keystore containing the public and private key pair.

Note:

The trustcacerts flag is used to consider other certificates (higher intermediaries and the root CA) in the chain of trust. If no chain of trust is established during verification, the certificate will be displayed and one would be prompted to verify it. It is recommended that due diligence be observed, when the prompt is displayed to verify a certificate when a chain of trust is absent.

Listed below is a sample execution of the command:

D:\Oracle\weblogic11g\jrockit_160_05_R27.6.2-20\bin>keytool - importcert -alias verisigntrialintermediateca -file D:\keystores\VerisignIntermediateCA.cer -trustcacerts -keystore D:\keystoreworkarea\AdminOBCLPMKeyStore.jks

Enter keystore password: <Enter the password used to access the keystore>

Certificate was added to keystore

Importing the Identity Certificate

The following command should be executed to import the identity certificate into the keystore

keytool -importcert -alias alias -file cert_file -
                        trustcacerts –keystore keystore

In the above command:

The alias is used to identify the public and private key pair. Specify the alias of the key pair used to create the CSR in the earlier step.
The cert_file is the location of the file containing the PKCS#7 formatted reply from the CA, containing the signed certificate.
The keystore is the location of the keystore containing the public and private key pair.

The trustcacerts flag is used to consider other certificates (intermediate CAs and the root CA) in the chain of trust. If no chain of trust is established during verification, the certificate will be displayed and one would be prompted to verify it. It is recommended that due diligence be observed, when the prompt is displayed to verify a certificate when a chain of trust is absent.

Listed below is a sample execution of the command

D:\Oracle\weblogic11g\jrockit_160_05_R27.6.2-20\bin>keytool - importcert -alias cvrhp0729 -file D:\keystores\cvrhp0729.cer - trustcacerts –keystore 

D:\keystoreworkarea\AdminOBCLPMKeyStore.jks 

Enter keystore password: <Enter the password used to access the keystore> 

Enter key password for <cvrhp0729>: <Enter the password used to access the private key> 

Certificate reply was installed in keystore

Note:

The previous set of commands assumed the presence of the appropriate root CA certificate (in the chain of trust) in the Java Standard Trust store, i.e. in the cacerts file. If the CA issuing the identity certificate (for the Weblogic Server) does not have the root CA certificate in the Java Standard Trust store, one can opt to import the root CA certificate into cacerts, or into the identity store, depending on factors including trustworthiness of the CA, necessity of transporting the trust store across machine, among others.

Import as Trusted Certificate

keytool -import -v -trustcacerts -alias rootcacert -file
                <export_certificate_file_name_with_location.cer> -keystore
                <keystore_name.jks> > -keypass <Private key Password> -storepass
                <Store Password>

For example:keytool -import -v -trustcacerts -alias rootcacert -file AdminOBCLPMCert.cer -keystore AdminOBCLPMKeyStore.jks -keypass Oracle123 -storepass Oracle123