Jump to

• Request
• Response

View This Certificate Management

get

/management/weblogic/{version}/domainConfig/securityConfiguration/certificateManagement

View this certificate management.

Request

Path Parameters

• version(required): string
  The version of the WebLogic REST interface.

Query Parameters

• excludeFields: string
  The 'excludeFields' query parameter is used to restrict which fields are returned in the response. It is a comma separated list of field names. If present, only fields whose name is not on the list will be returned. If not present, all fields are returned (unless the 'fields' query parameter is specified). Note: 'fields' must not be specified if 'excludeFields' is specified.
• excludeLinks: string
  The 'excludeLinks' query parameter is used to restrict which links are returned in the response. It is a comma separated list of link relationship names. If present, only links whose relationship name is not on the list will be returned. If not present, all links are returned (unless the 'links' query parameter is specified). Note: 'links' must not be specified if 'excludeLinks' is specified.
• fields: string
  The 'fields' query parameter is used to restrict which fields are returned in the response. It is a comma separated list of field names. If present, only fields with matching names are returned. If not present, all fields are returned (unless the 'excludeFields' query parameter is specified). Note: 'excludeFields' must not be specified if 'fields' is specified.
• links: string
  The 'links' query parameter is used to restrict which links are returned in the response. It is a comma separated list of link relationship names. If present, only links with matching relationship names are returned. If not present, all links are returned (unless the 'excludeLinks' query parameter is specified). Note: 'excludeLinks' must not be specified if 'links' is specified.

Security

• Admin: basic
  Type: basic

  Description: A user in the Admin security role.
• Deployer: basic
  Type: basic

  Description: A user in the Deployer security role.
• Monitor: basic
  Type: basic

  Description: A user in the Monitor security role.
• Operator: basic
  Type: basic

  Description: A user in the Operator security role.

Back to Top

Response

Supported Media Types

• application/json

200 Response

Returns this certificate management.

This method can return the following links:

• rel=certificateIssuerPlugins uri=/management/weblogic/{version}/domainConfig/securityConfiguration/certificateManagement/certificateIssuerPlugins

  This resource's certificateIssuerPlugins collection resource.

• rel=configurationProperties uri=/management/weblogic/{version}/domainConfig/securityConfiguration/certificateManagement/configurationProperties

  This resource's configurationProperties collection resource.

Body ()

Root Schema : Certificate Management

Type: object

Show Source

• certificateAuthorityKeyProfile: string
  Default Value: RSA-2048

  Returns the configured Certificate Authority key profile.

  The dynamic profile is used for a future Domain or Machine Certificate Authority generation or rollover. Updating it does not alter existing CA material or force regeneration.

• certificateAuthoritySignatureAlgorithm: string
  Default Value: SHA256withRSA

  Returns the configured signature algorithm for Certificate Authorities.

  A future Certificate Authority uses this algorithm to sign both its self-signed certificate and the leaf certificates it issues. An existing Certificate Authority continues to use its current signer until it is regenerated or rolled over.

• certificateAuthorityValidityPeriod: integer(int32)
  Minimum Value: 45

  Maximum Value: 1825

  Default Value: 365

  Returns the validity period (certificate lifetime) that the Domain Certificates Issuer should set when generating a new Certificate Authority certificate. The validity period is expressed in days.

• certificateCheckInterval: integer(int32)
  Minimum Value: 1

  Maximum Value: 7

  Default Value: 1

  Returns the certificate check interval -- how often the Certificate Management Service should check for/refresh expiring certificates (in days).

• certificateCheckTime: string
  Default Value: oracle.doceng.json.BetterJsonNull@57777c23

  Returns the optional local server time at which the Certificate Management Service begins each certificate check. The value uses H:mm format, with an hour from 0 through 23 and a two-digit minute.

  If this value is not set, the service retains its legacy fixed-rate scheduling behavior. If it is set, the first check is scheduled for this local time after the configured getCertificateCheckInterval() certificate check interval, and subsequent checks use the same calendar-day interval.

• certificateCheckTimeMaximumOffset: integer(int32)
  Minimum Value: 0

  Maximum Value: 86399

  Default Value: 900

  Returns the maximum random offset, in seconds, added to a configured certificate check time. The service samples one offset from zero through this value when the schedule is established, then reuses it for that scheduling lifecycle. An offset can move a check into the next local calendar date, but is always less than one day.

• certificateKeyProfile: string
  Default Value: RSA-2048

  Returns the configured leaf certificate key profile.

  The dynamic profile is used when a future leaf certificate is generated or renewed. Updating it does not alter existing certificate material or force regeneration.

• certificateRefreshWindow: integer(int32)
  Minimum Value: 5

  Maximum Value: 30

  Default Value: 10

  Returns the certificate refresh window. The Certificate Management Service will refresh an expiring certificate when its remaining lifetime is less than this number of days.

• certificateValidityPeriod: integer(int32)
  Minimum Value: 15

  Maximum Value: 365

  Default Value: 90

  Returns the validity period (certificate lifetime) that the Domain Certificates Issuer should set when generating a new certificate. The validity period is expressed in days.

• dynamicallyCreated: boolean
  Read Only: true

  Default Value: false

  Return whether the MBean was created dynamically or is persisted to config.xml

• enabled: boolean
  Default Value: false

  Returns true or false to indicate whether the Certificate Management Service is enabled or not.

• expiredCertificateAuthorityRetentionDays: integer(int32)
  Minimum Value: 0

  Maximum Value: 365

  Default Value: 7

  Returns the number of days an expired Certificate Authority remains trusted in the Admin Server's domain-trust or provisioned-trust source store before automatic cleanup removes it.

  A value of 0 disables automatic Certificate Authority cleanup. It does not disable Administrator-initiated cleanup.

• id: integer(int64)
  Read Only: true

  Return the unique id of this MBean instance

• includeRootCertificateInChain: boolean
  Default Value: true

  Whether the Domain Certificates Issuer should include the self-signed root CA in the certificate chain for a generated certificate.

• javaStandardTrustEnabled: boolean
  Default Value: false

  Whether or not the domain should trust the Java Standard Trust certificates, in addition to the Domain Certificate Authority certificate(s) and any Provisioned Trust certificates. Java Standard Trust is a collection of well-known, trusted root certificate authorities distributed (and updated) as part of the JDK.

• keystoreFileLockingEnabled: boolean
  Default Value: true

  Returns whether WebLogic Server uses cross-process file locks when accessing shared Certificate Management keystores.

  This process-lifetime setting requires a server restart. Node Manager uses the matching KeystoreFileLockingEnabled property in nodemanager.properties. The weblogic.keystore.filelock.enabled system property is a bootstrap override and takes precedence when specified. If locking is disabled, it must be disabled consistently in every process that accesses the same machine keystores.

• keystoreFileLockTimeout: integer(int64)
  Minimum Value: 1

  Maximum Value: 2147483647

  Default Value: 60000

  Returns the maximum number of milliseconds WebLogic Server waits to acquire a cross-process Certificate Management keystore file lock.

  This process-lifetime setting requires a server restart. Node Manager uses the matching KeystoreFileLockTimeout property in nodemanager.properties. The weblogic.keystore.filelock.timeout system property is a bootstrap override and takes precedence when specified.

• keystoreFileWatchingEnabled: boolean
  Default Value: true

  Returns whether WebLogic Server watches Certificate Management keystore files for changes made by another process.

  This process-lifetime setting requires a server restart. Node Manager uses the matching KeystoreFileWatchingEnabled property in nodemanager.properties. The weblogic.keystore.filewatch.enabled system property is a bootstrap override and takes precedence when specified.

  WebLogic Server and Node Manager enable watching by default. Set the matching Node Manager property to false to disable both file watching and managed-identity revision polling. When enabled, Node Manager restarts after identity replacement or removal so a removed listener credential is not retained.

• name: string
  Read Only: true

  The user-specified name of this MBean instance.

  This name is included as one of the key properties in the MBean's javax.management.ObjectName

  Name=user-specified-name

  Constraints

  • legal null
• notes: string

  Optional information that you can include to describe this configuration.

  WebLogic Server saves this note in the domain's configuration file (config.xml) as XML PCDATA. All left angle brackets (<) are converted to the xml entity <. Carriage returns/line feeds are preserved.

  Note: If you create or edit a note from the Administration Console, the Administration Console does not preserve carriage returns/line feeds.

• provisionedCertificatesIssuerEnabled: boolean
  Default Value: false

  Returns true or false to indicate whether the Provisioned Certificates Issuer is enabled or not.

• singlePurposeCertificatesEnabled: boolean
  Default Value: false

  Returns the single purpose certificates enabled value: whether the Domain Certificates Issuer should generate separate, single-purpose certificates for different purposes (server authentication, client authentication, signing and encryption), or generate one certificate that supports all those purposes.

  Constraints

  • secure default : true
• subjectAlternativeNames: string
  Default Value: hostname, address, loopback, listen_address_all, virtual_host_all

  A space- or comma-separated list of words representing the Subject Alternative Names that the Domain Certificates Issuer should include when generating a server certificate.

  Each word must be one of the subject name constants defined by the CertificateConfigurationConstants interface. When generating a certificate, the Certificate Management Service replaces each constant with the corresponding value(s) obtained from the target server's configuration or the host it's running on.

  Virtual host names are included only when the virtual host is targeted to the server for which the certificate is issued. A named virtual host, listen address, or network channel listen address that is not configured for that server is omitted without causing certificate issuance to fail.

  The preferred endpoint identity selected by getSubjectCommonName() is included even if it is not explicitly configured here. When no fully qualified hostname is available, the authenticated host address is included as an IP Subject Alternative Name when permitted by the configured subject name policy.

• subjectCommonName: string
  Default Value: hostname

  Allowed Values: [ "hostname", "listen_address" ]

  The fully qualified endpoint identity the Domain Certificates Issuer should prefer for a server certificate's Subject common name and first Subject Alternative Name: either the local hostname (hostname) or the server's listen address (listen_address).

  If no fully qualified listen address is configured for the server, the fully qualified hostname will be used instead, regardless of the value set here. If neither is available, the authenticated host address is used as an IP Subject Alternative Name when permitted by the configured subject name policy.

  When a fully qualified hostname is available, the Subject uses that value in CN=fully-qualified-hostname and identifies the server in OU=Server: server-name. When no fully qualified hostname is available, the Subject instead identifies the server in CN=Server: server-name and omits the server organizational unit. The domain organizational unit is present in both forms.

• subjectNamePolicy: string
  Default Value: CONFIGURED_PLUS_HOST

  Allowed Values: [ "CONFIGURED_ONLY", "CONFIGURED_PLUS_HOST", "CONFIGURED_PLUS_ANY" ]

  Controls which host names and literal IP addresses the Domain Certificates Issuer may place in a certificate subject.

  CONFIGURED_ONLY permits a server's configured listen address, network-channel listen addresses, and targeted virtual-host names. For a machine certificate it permits the configured Node Manager listen address. CONFIGURED_PLUS_HOST additionally permits the hostname and address authenticated in the certificate request. CONFIGURED_PLUS_ANY retains legacy behavior and permits any requested identity. The localhost DNS name and numeric loopback addresses are permitted in every mode.

  A server certificate request fails if its preferred endpoint identity or any requested Subject Alternative Name is not permitted. A machine certificate request silently discards names that are not permitted. It prefers a permitted fully qualified hostname for the Subject common name. If none is available, a permitted authenticated host address is placed in an IP Subject Alternative Name and the Subject identifies the machine in CN=Machine: machine-name without the machine organizational unit. Under CONFIGURED_ONLY, this fallback is available when the configured Node Manager listen address is that host address.

• tags: array Items
  Title: Items

  Return all tags on this Configuration MBean

• type: string
  Read Only: true

  Returns the type of the MBean.

  Constraints

  • unharvestable

{
    "type":"object",
    "properties":{
        "certificateAuthorityKeyProfile":{
            "default":"RSA-2048",
            "type":"string",
            "description":"<p>Returns the configured Certificate Authority key profile.</p><p>The dynamic profile is used for a future Domain or Machine Certificate Authority generation or rollover. Updating it does not alter existing CA material or force regeneration.</p>"
        },
        "certificateAuthoritySignatureAlgorithm":{
            "default":"SHA256withRSA",
            "type":"string",
            "description":"<p>Returns the configured signature algorithm for Certificate Authorities.</p><p>A future Certificate Authority uses this algorithm to sign both its self-signed certificate and the leaf certificates it issues. An existing Certificate Authority continues to use its current signer until it is regenerated or rolled over.</p>"
        },
        "certificateAuthorityValidityPeriod":{
            "default":365,
            "minimum":45,
            "maximum":1825,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the validity period (certificate lifetime) that the Domain Certificates Issuer should set when generating a new Certificate Authority certificate. The validity period is expressed in days.</p>"
        },
        "certificateCheckInterval":{
            "default":1,
            "minimum":1,
            "maximum":7,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the certificate check interval -- how often the Certificate Management Service should check for/refresh expiring certificates (in days).</p>"
        },
        "certificateCheckTime":{
            "default":null,
            "type":"string",
            "description":"<p>Returns the optional local server time at which the Certificate Management Service begins each certificate check. The value uses <code>H:mm</code> format, with an hour from <code>0</code> through <code>23</code> and a two-digit minute.</p><p>If this value is not set, the service retains its legacy fixed-rate scheduling behavior. If it is set, the first check is scheduled for this local time after the configured getCertificateCheckInterval() certificate check interval, and subsequent checks use the same calendar-day interval.</p>"
        },
        "certificateCheckTimeMaximumOffset":{
            "default":900,
            "minimum":0,
            "maximum":86399,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the maximum random offset, in seconds, added to a configured certificate check time. The service samples one offset from zero through this value when the schedule is established, then reuses it for that scheduling lifecycle. An offset can move a check into the next local calendar date, but is always less than one day.</p>"
        },
        "certificateKeyProfile":{
            "default":"RSA-2048",
            "type":"string",
            "description":"<p>Returns the configured leaf certificate key profile.</p><p>The dynamic profile is used when a future leaf certificate is generated or renewed. Updating it does not alter existing certificate material or force regeneration.</p>"
        },
        "certificateRefreshWindow":{
            "default":10,
            "minimum":5,
            "maximum":30,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the certificate refresh window. The Certificate Management Service will refresh an expiring certificate when its remaining lifetime is less than this number of days.</p>"
        },
        "certificateValidityPeriod":{
            "default":90,
            "minimum":15,
            "maximum":365,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the validity period (certificate lifetime) that the Domain Certificates Issuer should set when generating a new certificate. The validity period is expressed in days.</p>"
        },
        "dynamicallyCreated":{
            "readOnly":true,
            "default":false,
            "type":"boolean",
            "description":"<p>Return whether the MBean was created dynamically or is persisted to config.xml</p>"
        },
        "enabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Returns true or false to indicate whether the Certificate Management Service is enabled or not.</p>"
        },
        "expiredCertificateAuthorityRetentionDays":{
            "default":7,
            "minimum":0,
            "maximum":365,
            "type":"integer",
            "format":"int32",
            "description":"<p>Returns the number of days an expired Certificate Authority remains trusted in the Admin Server's <code>domain-trust</code> or <code>provisioned-trust</code> source store before automatic cleanup removes it.</p><p>A value of <code>0</code> disables automatic Certificate Authority cleanup. It does not disable Administrator-initiated cleanup.</p>"
        },
        "id":{
            "readOnly":true,
            "type":"integer",
            "format":"int64",
            "description":"<p>Return the unique id of this MBean instance</p>"
        },
        "includeRootCertificateInChain":{
            "default":true,
            "type":"boolean",
            "description":"<p>Whether the Domain Certificates Issuer should include the self-signed root CA in the certificate chain for a generated certificate.</p>"
        },
        "javaStandardTrustEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Whether or not the domain should trust the Java Standard Trust certificates, in addition to the Domain Certificate Authority certificate(s) and any Provisioned Trust certificates. Java Standard Trust is a collection of well-known, trusted root certificate authorities distributed (and updated) as part of the JDK.</p>"
        },
        "keystoreFileLockTimeout":{
            "default":60000,
            "minimum":1,
            "maximum":2147483647,
            "type":"integer",
            "format":"int64",
            "description":"<p>Returns the maximum number of milliseconds WebLogic Server waits to acquire a cross-process Certificate Management keystore file lock.</p><p>This process-lifetime setting requires a server restart. Node Manager uses the matching <code>KeystoreFileLockTimeout</code> property in <code>nodemanager.properties</code>. The <code>weblogic.keystore.filelock.timeout</code> system property is a bootstrap override and takes precedence when specified.</p>"
        },
        "keystoreFileLockingEnabled":{
            "default":true,
            "type":"boolean",
            "description":"<p>Returns whether WebLogic Server uses cross-process file locks when accessing shared Certificate Management keystores.</p><p>This process-lifetime setting requires a server restart. Node Manager uses the matching <code>KeystoreFileLockingEnabled</code> property in <code>nodemanager.properties</code>. The <code>weblogic.keystore.filelock.enabled</code> system property is a bootstrap override and takes precedence when specified. If locking is disabled, it must be disabled consistently in every process that accesses the same machine keystores.</p>"
        },
        "keystoreFileWatchingEnabled":{
            "default":true,
            "type":"boolean",
            "description":"<p>Returns whether WebLogic Server watches Certificate Management keystore files for changes made by another process.</p><p>This process-lifetime setting requires a server restart. Node Manager uses the matching <code>KeystoreFileWatchingEnabled</code> property in <code>nodemanager.properties</code>. The <code>weblogic.keystore.filewatch.enabled</code> system property is a bootstrap override and takes precedence when specified.</p><p>WebLogic Server and Node Manager enable watching by default. Set the matching Node Manager property to <code>false</code> to disable both file watching and managed-identity revision polling. When enabled, Node Manager restarts after identity replacement or removal so a removed listener credential is not retained.</p>"
        },
        "name":{
            "readOnly":true,
            "x-weblogic-legalNull":true,
            "type":"string",
            "description":"<p>The user-specified name of this MBean instance.</p><p>This name is included as one of the key properties in the MBean's <code>javax.management.ObjectName</code></p><p><code>Name=<i>user-specified-name</i></code></p><p><h5>Constraints</h5></p><ul><li>legal null</li></ul>"
        },
        "notes":{
            "type":"string",
            "description":"<p>Optional information that you can include to describe this configuration.</p><p>WebLogic Server saves this note in the domain's configuration file (<code>config.xml</code>) as XML PCDATA. All left angle brackets (<) are converted to the XML entity <code>&lt;</code>. Carriage returns/line feeds are preserved.</p><p>Note: If you create or edit a note from the Administration Console, the Administration Console does not preserve carriage returns/line feeds.</p>"
        },
        "provisionedCertificatesIssuerEnabled":{
            "default":false,
            "type":"boolean",
            "description":"<p>Returns true or false to indicate whether the Provisioned Certificates Issuer is enabled or not.</p>"
        },
        "singlePurposeCertificatesEnabled":{
            "x-weblogic-secureDefault":true,
            "default":false,
            "type":"boolean",
            "description":"<p>Returns the single purpose certificates enabled value: whether the Domain Certificates Issuer should generate separate, single-purpose certificates for different purposes (server authentication, client authentication, signing and encryption), or generate one certificate that supports all those purposes.</p><p><h5>Constraints</h5></p><ul><li>secure default : true</li></ul>"
        },
        "subjectAlternativeNames":{
            "default":"hostname, address, loopback, listen_address_all, virtual_host_all",
            "type":"string",
            "description":"<p>A space- or comma-separated list of words representing the Subject Alternative Names that the Domain Certificates Issuer should include when generating a server certificate.</p><p>Each word must be one of the subject name constants defined by the CertificateConfigurationConstants interface. When generating a certificate, the Certificate Management Service replaces each constant with the corresponding value(s) obtained from the target server's configuration or the host it's running on.</p><p>Virtual host names are included only when the virtual host is targeted to the server for which the certificate is issued. A named virtual host, listen address, or network channel listen address that is not configured for that server is omitted without causing certificate issuance to fail.</p><p>The preferred endpoint identity selected by getSubjectCommonName() is included even if it is not explicitly configured here. When no fully qualified hostname is available, the authenticated host address is included as an IP Subject Alternative Name when permitted by the configured subject name policy.</p>"
        },
        "subjectCommonName":{
            "default":"hostname",
            "enum":[
                "hostname",
                "listen_address"
            ],
            "type":"string",
            "description":"<p>The fully qualified endpoint identity the Domain Certificates Issuer should prefer for a server certificate's Subject common name and first Subject Alternative Name: either the local hostname (<code>hostname</code>) or the server's listen address (<code>listen_address</code>).</p><p>If no fully qualified listen address is configured for the server, the fully qualified hostname will be used instead, regardless of the value set here. If neither is available, the authenticated host address is used as an IP Subject Alternative Name when permitted by the configured subject name policy.</p><p>When a fully qualified hostname is available, the Subject uses that value in <code>CN=fully-qualified-hostname</code> and identifies the server in <code>OU=Server: server-name</code>. When no fully qualified hostname is available, the Subject instead identifies the server in <code>CN=Server: server-name</code> and omits the server organizational unit. The domain organizational unit is present in both forms.</p>"
        },
        "subjectNamePolicy":{
            "default":"CONFIGURED_PLUS_HOST",
            "enum":[
                "CONFIGURED_ONLY",
                "CONFIGURED_PLUS_HOST",
                "CONFIGURED_PLUS_ANY"
            ],
            "type":"string",
            "description":"<p>Controls which host names and literal IP addresses the Domain Certificates Issuer may place in a certificate subject.</p><p><code>CONFIGURED_ONLY</code> permits a server's configured listen address, network-channel listen addresses, and targeted virtual-host names. For a machine certificate it permits the configured Node Manager listen address. <code>CONFIGURED_PLUS_HOST</code> additionally permits the hostname and address authenticated in the certificate request. <code>CONFIGURED_PLUS_ANY</code> retains legacy behavior and permits any requested identity. The <code>localhost</code> DNS name and numeric loopback addresses are permitted in every mode.</p><p>A server certificate request fails if its preferred endpoint identity or any requested Subject Alternative Name is not permitted. A machine certificate request silently discards names that are not permitted. It prefers a permitted fully qualified hostname for the Subject common name. If none is available, a permitted authenticated host address is placed in an IP Subject Alternative Name and the Subject identifies the machine in <code>CN=Machine: machine-name</code> without the machine organizational unit. Under <code>CONFIGURED_ONLY</code>, this fallback is available when the configured Node Manager listen address is that host address.</p>"
        },
        "tags":{
            "title":"Items",
            "type":"array",
            "items":{
                "type":"string",
                "description":""
            },
            "description":"<p>Return all tags on this Configuration MBean</p>"
        },
        "type":{
            "readOnly":true,
            "x-weblogic-unharvestable":true,
            "type":"string",
            "description":"<p>Returns the type of the MBean.</p><p><h5>Constraints</h5></p><ul><li>unharvestable</li></ul>"
        }
    },
    "description":""
}

Nested Schema : Items

Type: array

Title: Items

Return all tags on this Configuration MBean

Show Source

• Array of: string

{
    "title":"Items",
    "type":"array",
    "items":{
        "type":"string",
        "description":""
    },
    "description":"<p>Return all tags on this Configuration MBean</p>"
}

Back to Top