CertificateManagementMBean

Overview

Provides configuration for the WebLogic Certificate Management Service.

Related MBeans

This section describes attributes that provide access to other MBeans.

CertificateIssuerPlugins

Returns the CertificateIssuerPlugins for this Domain.

ConfigurationProperties

Specifies the list of properties that are associated with this container object.

Attributes

This section describes the following attributes:

CachingDisabled

Private property that disables caching in proxies.

CertificateAuthorityKeyProfile

Returns the configured Certificate Authority key profile.

The dynamic profile is used for a future Domain or Machine Certificate Authority generation or rollover. Updating it does not alter existing CA material or force regeneration.

CertificateAuthoritySignatureAlgorithm

Returns the configured signature algorithm for Certificate Authorities.

A future Certificate Authority uses this algorithm to sign both its self-signed certificate and the leaf certificates it issues. An existing Certificate Authority continues to use its current signer until it is regenerated or rolled over.

CertificateAuthorityValidityPeriod

Returns the validity period (certificate lifetime) that the Domain Certificates Issuer should set when generating a new Certificate Authority certificate. The validity period is expressed in days.

CertificateCheckInterval

Returns the certificate check interval -- how often the Certificate Management Service should check for/refresh expiring certificates (in days).

CertificateCheckTime

Returns the optional local server time at which the Certificate Management Service begins each certificate check. The value uses {@code H:mm} format, with an hour from {@code 0} through {@code 23} and a two-digit minute.

If this value is not set, the service retains its legacy fixed-rate scheduling behavior. If it is set, the first check is scheduled for this local time after the configured certificate check interval , and subsequent checks use the same calendar-day interval.

CertificateCheckTimeMaximumOffset

Returns the maximum random offset, in seconds, added to a configured certificate check time. The service samples one offset from zero through this value when the schedule is established, then reuses it for that scheduling lifecycle. An offset can move a check into the next local calendar date, but is always less than one day.

CertificateKeyProfile

Returns the configured leaf certificate key profile.

The dynamic profile is used when a future leaf certificate is generated or renewed. Updating it does not alter existing certificate material or force regeneration.

CertificateRefreshWindow

Returns the certificate refresh window. The Certificate Management Service will refresh an expiring certificate when its remaining lifetime is less than this number of days.

CertificateValidityPeriod

Returns the validity period (certificate lifetime) that the Domain Certificates Issuer should set when generating a new certificate. The validity period is expressed in days.

DynamicallyCreated

Return whether the MBean was created dynamically or is persisted to config.xml

Enabled

Returns true or false to indicate whether the Certificate Management Service is enabled or not.

ExpiredCertificateAuthorityRetentionDays

Returns the number of days an expired Certificate Authority remains trusted in the Admin Server's {@code domain-trust} or {@code provisioned-trust} source store before automatic cleanup removes it.

A value of {@code 0} disables automatic Certificate Authority cleanup. It does not disable Administrator-initiated cleanup.

Id

Return the unique id of this MBean instance

IncludeRootCertificateInChain

Whether the Domain Certificates Issuer should include the self-signed root CA in the certificate chain for a generated certificate.

JavaStandardTrustEnabled

Whether or not the domain should trust the Java Standard Trust certificates, in addition to the Domain Certificate Authority certificate(s) and any Provisioned Trust certificates. Java Standard Trust is a collection of well-known, trusted root certificate authorities distributed (and updated) as part of the JDK.

For more information, see:

• ServerTemplateMBean#getJavaStandardTrustKeyStorePassPhrase()

KeystoreFileLockingEnabled

Returns whether WebLogic Server uses cross-process file locks when accessing shared Certificate Management keystores.

This process-lifetime setting requires a server restart. Node Manager uses the matching {@code KeystoreFileLockingEnabled} property in {@code nodemanager.properties}. The {@code weblogic.keystore.filelock.enabled} system property is a bootstrap override and takes precedence when specified. If locking is disabled, it must be disabled consistently in every process that accesses the same machine keystores.

KeystoreFileLockTimeout

Returns the maximum number of milliseconds WebLogic Server waits to acquire a cross-process Certificate Management keystore file lock.

This process-lifetime setting requires a server restart. Node Manager uses the matching {@code KeystoreFileLockTimeout} property in {@code nodemanager.properties}. The {@code weblogic.keystore.filelock.timeout} system property is a bootstrap override and takes precedence when specified.

KeystoreFileWatchingEnabled

Returns whether WebLogic Server watches Certificate Management keystore files for changes made by another process.

This process-lifetime setting requires a server restart. Node Manager uses the matching {@code KeystoreFileWatchingEnabled} property in {@code nodemanager.properties}. The {@code weblogic.keystore.filewatch.enabled} system property is a bootstrap override and takes precedence when specified.

WebLogic Server and Node Manager enable watching by default. Set the matching Node Manager property to {@code false} to disable both file watching and managed-identity revision polling. When enabled, Node Manager restarts after identity replacement or removal so a removed listener credential is not retained.

MBeanInfo

Returns the MBean info for this MBean.

Deprecated.

Name

The user-specified name of this MBean instance.

This name is included as one of the key properties in the MBean's javax.management.ObjectName:

Name=user-specified-name

Notes

Optional information that you can include to describe this configuration.

WebLogic Server saves this note in the domain's configuration file (config.xml) as XML PCDATA. All left angle brackets (<) are converted to the XML entity <. Carriage returns/line feeds are preserved.

Note: If you create or edit a note from the Administration Console, the Administration Console does not preserve carriage returns/line feeds.

ObjectName

Returns the ObjectName under which this MBean is registered in the MBean server.

Deprecated.

Parent

Return the immediate parent for this MBean

ProvisionedCertificatesIssuerEnabled

Returns true or false to indicate whether the Provisioned Certificates Issuer is enabled or not.

Registered

Returns false if the MBean represented by this object has been unregistered.

Deprecated.

SinglePurposeCertificatesEnabled

Returns the single purpose certificates enabled value: whether the Domain Certificates Issuer should generate separate, single-purpose certificates for different purposes (server authentication, client authentication, signing and encryption), or generate one certificate that supports all those purposes.

SubjectAlternativeNames

A space- or comma-separated list of words representing the Subject Alternative Names that the Domain Certificates Issuer should include when generating a server certificate.

Each word must be one of the subject name constants defined by the CertificateConfigurationConstants interface. When generating a certificate, the Certificate Management Service replaces each constant with the corresponding value(s) obtained from the target server's configuration or the host it's running on.

Virtual host names are included only when the virtual host is targeted to the server for which the certificate is issued. A named virtual host, listen address, or network channel listen address that is not configured for that server is omitted without causing certificate issuance to fail.

The preferred endpoint identity selected by SubjectCommonName() is included even if it is not explicitly configured here. When no fully qualified hostname is available, the authenticated host address is included as an IP Subject Alternative Name when permitted by the configured subject name policy.

SubjectCommonName

The fully qualified endpoint identity the Domain Certificates Issuer should prefer for a server certificate's Subject common name and first Subject Alternative Name: either the local hostname (hostname) or the server's listen address (listen_address).

If no fully qualified listen address is configured for the server, the fully qualified hostname will be used instead, regardless of the value set here. If neither is available, the authenticated host address is used as an IP Subject Alternative Name when permitted by the configured subject name policy.

When a fully qualified hostname is available, the Subject uses that value in {@code CN=fully-qualified-hostname} and identifies the server in {@code OU=Server: server-name}. When no fully qualified hostname is available, the Subject instead identifies the server in {@code CN=Server: server-name} and omits the server organizational unit. The domain organizational unit is present in both forms.

SubjectNamePolicy

Controls which host names and literal IP addresses the Domain Certificates Issuer may place in a certificate subject.

{@code CONFIGURED_ONLY} permits a server's configured listen address, network-channel listen addresses, and targeted virtual-host names. For a machine certificate it permits the configured Node Manager listen address. {@code CONFIGURED_PLUS_HOST} additionally permits the hostname and address authenticated in the certificate request. {@code CONFIGURED_PLUS_ANY} retains legacy behavior and permits any requested identity. The {@code localhost} DNS name and numeric loopback addresses are permitted in every mode.

A server certificate request fails if its preferred endpoint identity or any requested Subject Alternative Name is not permitted. A machine certificate request silently discards names that are not permitted. It prefers a permitted fully qualified hostname for the Subject common name. If none is available, a permitted authenticated host address is placed in an IP Subject Alternative Name and the Subject identifies the machine in {@code CN=Machine: machine-name} without the machine organizational unit. Under {@code CONFIGURED_ONLY}, this fallback is available when the configured Node Manager listen address is that host address.

Tags

Return all tags on this Configuration MBean

Type

Returns the type of the MBean.

Operations

This section describes the following operations:

addTag

Add a tag to this Configuration MBean. Adds a tag to the current set of tags on the Configuration MBean. Tags may contain white spaces.

freezeCurrentValue

If the specified attribute has not been set explicitly, and if the attribute has a default value, this operation forces the MBean to persist the default value.

Unless you use this operation, the default value is not saved and is subject to change if you update to a newer release of WebLogic Server. Invoking this operation isolates this MBean from the effects of such changes.

Note: To insure that you are freezing the default value, invoke the restoreDefaultValue operation before you invoke this.

This operation has no effect if you invoke it on an attribute that does not provide a default value or on an attribute for which some other value has been set.

Deprecated. 9.0.0.0

getInheritedProperties

Return all properties' names whose value is inherited from template mbean. this is a convenient method to get inheritance info on multiple properties in one jmx call.

isInherited

Check if the value of a property is inherited from template mbean or not.

isSet

Returns true if the specified attribute has been set explicitly in this MBean instance.

removeTag

Remove a tag from this Configuration MBean

restoreDefaultValue

If the specified attribute has a default value, this operation removes any value that has been set explicitly and causes the attribute to use the default value.

Default values are subject to change if you update to a newer release of WebLogic Server. To prevent the value from changing if you update to a newer release, invoke the freezeCurrentValue operation.

This operation has no effect if you invoke it on an attribute that does not provide a default value or on an attribute that is already using the default.

Deprecated. 9.0.0.0

unSet

Restore the given property to its default value.