Configuring SSL

Securing the Browser Connection to WebCenter Portal using SSL

This section presents an overview of how to configure the Oracle Platform Security Services (OPSS) Keystore Service for use with WebCenter Portal. It is possible to use Fusion Middleware Control as well for this, but the scope of this document is restricted to usage of WLST.

Note:

The default Java Keystore Service (JKS) has been replaced with the Oracle Platform Security Services (OPSS) Keystore Service. Use WC_Portal as the server and OPSS as the keystore service.

For detailed information and step-by-step instructions to configure SSL in the WebLogic Server environment, see Managing Keys and Certificates with the Keystore Service in Securing Applications with Oracle Platform Security Services.

The OPSS Keystore Service provides an alternate mechanism to manage keys and certificates for message security. The OPSS Keystore Service makes using certificates and keys easier by providing central management and storage of keys and certificates for all servers in a domain. You use the OPSS Keystore Service to create and maintain keystores of type KSS.

Securing the browser connection to WebCenter Portal with SSL consists of the following steps

Creating the Custom Keystore

The first step is to generate a custom keystore for WebCenter Portal.

To configure the Keystore Service:

Connect to WebLogic Server using the WLST console:

connect('username','password','hostname:port')

Get the OPSS Service reference name.

svc = getOpssService(name='KeyStoreService')

Create a new keystore:
Note:
Create a keystore in the system stripe and the permission must be set to false.

Enter the following command:
```
svc.createKeyStore(appStripe='system', name='webcenter_wls', password='password', permission=false)
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe in which the keystore is created
- name = the name of the keystore
- password = password of the keystore
- permission = false if protected by both permission and password (true if keystore is protected by permission only)
Generate key pair.
Use your actual alias, domain name, and credentials. The following example also uses a default CA signed certificate.
```
svc.generateKeyPair(appStripe='system', name='webcenter_wls', password='password', dn='cn=webcenteridentity,dc=example,dc=com', keysize='2048', alias='webcenter_wls',  keypassword='password')
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore where the key pair is generated
- password = password of the keystore
- dn = the distinguished name of the certificate wrapping the key pair
- keysize = the key size
- alias = the alias of the key pair entry
- keypassword = the key password
(Optional) List the keystores and aliases inside the keystore, using the following command:.
```
svc.listKeyStores(appStripe='*')
```
This will list the system/webcenter_wls.
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe whose keystores are listed
Enter:
```
svc.listKeyStoreAliases(appStripe="system",name="webcenter_wls", password="password", type="*")
```
This will list the alias webcenter_wls.
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore
- password = password of the keystore
- type = the type of entry for which aliases are listed. Valid values are 'Certificate', 'TrustedCertificate', 'SecretKey' or '*'

Run the syncKeyStores command:

syncKeyStores(appStripe='system', keystoreFormat='KSS')

Restart the WC_Portal managed server.

Configuring the Custom Identity and Custom Trust Keystores

For an overview of on how to configure the Identity and Trust keystores, see Configuring the OPSS Keystore Service for Custom Identity and Trust: Main Steps in Administering Security for Oracle WebLogic Server.

The next step is to configure the Custom Identity and Custom Trust keystores on the WebCenter Portal server.

To configure the identity and trust keystores:

Log in to the WebLogic Server Administration Console.

For information on logging into the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.
Click the WebCenter Portal server (WC_Portal) to configure the identity and trust keystores.

The Settings pane for the WebCenter Portal server opens.
Open the Configuration tab, and then the Keystores subtab.
The Keystores pane opens.
Click Change.
For Keystores, select Custom Identity and Custom Trust and click Save.
Under Identity, enter the path and filename of the Custom Identity Keystore you created in Securing the Browser Connection to WebCenter Portal using SSL.
If you use the example in Securing the Browser Connection to WebCenter Portal using SSL, enter kss://system/webcenter_wls
where
- alias = system
- keystore_alias_name = webcenter_wls
Enter KSS as the Custom Identity Keystore Type.
Enter and confirm the Custom Identity Keystore password.
Under Trust, set the Custom Trust Keystore to kss://system/trust.
For Custom Trust Keystore Type, enter KSS, then click Save to save your entries.
Open the SSL tab.
Enter the Private Key Alias (for example, webcenter_wls) and the Private Key Passphrase (for example, welcome1), then click Save to save your entries.

Configuring the SSL Connection

For an overview to configure the SSL connection, see Specifying a Client Certificate for an Outbound Two-Way SSL Connection in Administering Security for Oracle WebLogic Server.

To configure the SSL Connection:

On the Settings pane for the WebCenter Portal server, open the Configuration tab and then the General subtab.

The General Configuration pane displays.
Check SSL Listen Port Enabled.
Enter an SSL Listen Port number and click Save.
On the Configuration tab, open the SSL subtab, and then expand the Advanced options at the bottom of the page.

The SSL advanced options are displayed.
Set the Two Way Client Cert Behavior option to Client Certs Not Requested and click Save.
Open the Control tab on the Settings pane, and select the Start/Stop subtab.
Click Restart SSL.
Restart the WebLogic Server and open the SSL WebCenter Portal URL.
For a development or test environment only (that is, not for a production environment), if the hostname in the certificate does not match the host name, then the server must be started with the following command:
-Dweblogic.security.SSL.ignoreHostnameVerification=true
Accept the certificate for the session and log in.

Securing the Connection from Oracle HTTP Server to WebCenter Portal with SSL

Securing the connection between the Oracle HTTP Server (OHS) and WebCenter Portal is described in the following sections:

Wiring the WebCenter Portal Ports to the HTTP Server

To wire the WebCenter Portal ports to the HTTP server:

Install and configure OHS 12c (see Installing the Oracle HTTP Server Software in Installing and Configuring Oracle HTTP Server ).
By default, it comes configured with the SSL port.
Open the file DOMAIN_HOME/config/fmwconfig/components/OHS/instances/ohs1/mod_wl_ohs.conf
Add the WebCenter URL to mod_wl_ohs.conf to make WebCenter Portal work with OHS:
```
<Location/webcenter>
SetHandler weblogic-handler
WebLogicHost host_id
WebLogicPort port
</Location>
```
Replacing host_id and port with the WebLogic server ID and port number.

Note:
When using mod_wl_ohs, you need to complete the prerequisites mentioned in Preparing for Configuring the Oracle WebLogic Server Proxy Plug-In in Using Oracle WebLogic Server Proxy Plug-Ins 12.2.1.
Start the node manager:
```
DOMAIN_HOME/bin/startNodeManager.sh &
```
See Starting the Node Manager in Installing and Configuring Oracle HTTP Server.

Restart the OHS server:

				DOMAIN_HOME/bin/stopComponent.sh ohs1 & DOMAIN_HOME/bin/startComponent.sh ohs1

Verify if the following URLs are working:

http://OHS_12c_installation_host:port

http://OHS_12c_installation_host:OHS_12c_installation_port/webcenter
Configure the WebCenter SSL port with the OHS SSL:
1. Verify that the OHS SSL port is working by checking the following URL.
```
https://ohs_ssl_host:ohs_ssl_port
```
2. To configure the WebCenter SSL port, open the file OHS ssl.conf file (DOMAIN_HOME/config/fmwconfig/components/OHS/instances/ohs1/ssl.conf.
3. Add the following entry (WebCenter SSL host and port) to ssl.conf to make WebCenter Portal run on the OHS SSL port:
  Note:
  This snippet needs to be inserted just before the </VirtualHost> tag, that is, where the virtual host tag ends.
```
		<Location /webcenter>
      SetHandler weblogic-handler
		 WebLogicHost host_id
      WebLogicPort port
      SecureProxy ON
      WlSSLWallet /filepath/ohs12c/user_projects/domains/base_domain/config/fmwconfig/components/OHS/instances/ohs1/keystores/default
		</Location>
```
Restart OHS.

Configuring the SSL Certificates

For OHS to trust WebCenter Portal's certificate, the WC_Portal certificate must be imported into the OHS trust store.

To configure the SSL certificates:

Export the WC_Portal certificate from the WC_Portal identity keystore, using the following WLST:
```
svc = getOpssService(name='KeyStoreService')
svc.exportKeyStoreCertificate(appStripe='system', name='webcenter_wls', password='password', alias='webcenter_wls', type='TrustedCertificate', filepath='/filepath/certificate/webcenter.cer')
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore
- password = password of the keystore
- type = the type of entry for which aliases are listed. Valid values are 'Certificate', 'TrustedCertificate', or 'CertificateChain'
- filepath = absolute path of the file where certificate, trusted certificate or certificate chain is exported
Import this certificate into the wallet on the OHS side.
Navigate to /domain_home/config/fmwconfig/components/OHS/instances/ohs1/keystores/default and run the following orapki command (typically located in IDM_HOME) :
```
setenv JAVA_HOME /Java_install_location/jdk1.8.0_40/
/OHS_install_location/oracle_common/bin/orapki wallet add -wallet . -trusted_cert -cert <webcenter_wls.cer location> -auto_login_only
```
For WebCenter Portal to trust OHS certificates, export the user certificate from OHS wallet and import it as a trusted certificate in the WebLogic trust store.
```
/OHS_install_location/oracle_common/bin/orapki wallet display -wallet .
/OHS_install_location/oracle_common/bin/orapki wallet export -wallet . -cert cert.txt -dn 'dn_value'
```
Where, dn_value refers to the output returned by the wallet display -wallet command.
Import the OHS certificate into the WC_Portal managed server trust store:
```
keytool -importcert -alias ohs_cert -file wls_java_home/jre/lib/security/cacerts
```
Where, wls_java_home refers to the WebLogic Java home directory, and keytool is installed in wls_java_home/jre/bin/keytool. For finding out the wls_java_home path, you can run domain_home/bin/setDomainEnv.sh (on UNIX) or domain_home\bin\setDomainEnv.cmd (on Windows).
In WebCenter, log in to the WebLogic Console and check if the WebLogic Plugin checkbox is enabled:
1. Log in to the WebLogic Console.
2. Click the domain name on the left hand navigation.
3. Click the Web Applications tab.
4. Select the option WebLogic Plugin Enabled, then click Save.
Restart OHS and the WC_Portal server.

You should now be able to access the SSL OHS URL (https://<ohs ssl host>:<ohs ssl port>/webcenter).
After accessing the URL, accept the certificate.

Securing the Browser Connection to Discussions with SSL

Securing the browser connection to discussions with SSL is described in the following sections:

Creating the Custom Keystore for Discussions

The first step in securing the connection to Discussions is to generate a custom keystore as shown below:

Connect to WebLogic Server using the WLST console:
```
connect('weblogic','password','host:port’) 
```

Get OPSS service reference:

svc = getOpssService(name='KeyStoreService')

Create a new keystore:

Note:
Create the keystore in the system stripe and the permission must be set to false
```
svc.createKeyStore(appStripe='system', name='collab_wls', password='password', permission=false) 
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe in which the keystore is created
- name = the name of the keystore
- password = password of the keystore
- permission = true if keystore is protected by permission only; false if protected by both permission and password
Using keytool, generate a key pair:
```
svc.generateKeyPair(appStripe='system', name='collab_wls', password='password', dn='cn=collabidentity,dc=example,dc=com', keysize='2048', alias='collab_wls', keypassword='welcome1') 
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore where the key pair is generated
- password = password of the keystore
- dn = the distinguished name of the certificate wrapping the key pair
- keysize = the key size
- alias = the alias of the key pair entry
- keypassword = the key password
Optionally, list the keystores and aliases inside the keystore:
```
svc.listKeyStores(appStripe='*') 
```
This will list the system/collab_wls.
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe whose keystores are listed
Enter:
```
svc.listKeyStoreAliases(appStripe="system",name="collab_wls", password="password", type="*") 
```
This is will list the alias collab_wls
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore
- password = password of the keystore
- type = the type of entry for which aliases are listed. Valid values are 'Certificate', 'TrustedCertificate', 'SecretKey' or '*'

Run syncKeyStores:

syncKeyStores(appStripe='system', keystoreFormat='KSS')

Configuring the Identity and Trust Keystore for Discussions

The next step is to configure the Custom Identity and Custom Trust keystores on the WebCenter Collaboration server.

To configure the identity and trust keystores for discussions:

Log in to the WebLogic Server Administration Console.

For information on logging into the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.
In the Domain Structure pane, expand Environment and click Servers.

The Summary of Servers pane displays.
Click the WebCenter Collaboration server (WC_Collaboration) to configure the identity and trust keystores.

The Settings pane for the Collaboration server displays.
Open the Configuration tab, and then the Keystores subtab.

The Keystores pane displays.
Click Change.
For Keystores, select Custom Identity and Custom Trust, then click Save.
Under Identity, enter the path and filename of the Custom Identity Keystore you created in kss://system/collab_wls (Creating the Custom Keystore for Discussions).
Enter KSS as the Custom Identity Keystore Type.
Enter and confirm your custom identity keystore password, (for example, welcome1).
Under Trust, set the Custom Trust Keystore to kss://system/trust and click Save.
Enter KSS as the Custom Trust Keystore Type, and enter and confirm your custom trust keystore password, then click Save.
From the WLS Administration console, go to Servers -> WC_Collaboration and open the Configuration tab, and then the SSL subtab.
Enter the private key alias ( for example, collab_wls), and set the private key password (for example, welcome1.
Click Save to have your entries.
On the Settings pane for the WebCenter Collaboration server (WC_Collaboration), open the Configuration tab and then the General subtab.

The General Configuration pane opens.
Check SSL Listen Port Enabled.
Enter an SSL Listen Port number and click Save.
On the Configuration tab, open the SSL subtab, and then expand the Advanced options at the bottom of the page.
Check that the Two Way Client Cert Behavior option is set to Client Certs Not Requested and click Save.
Open the Control tab.

The Control Settings pane opens.
Click Restart SSL.

Configuring and Securing the SSL Connection for Discussions

To configure the SSL connection for Discussions:

Restart the WebCenter Collaboration server (WC_Collaboration) server and open the SSL collaboration URL: https://host:port/owc_discussions.
The certificate should be generated when you access the URL, and stored in your browser.
Download and store the certificate in .PEM or .CRT format.

Import the certificate into cacerts in JDK_HOME, using the following command:

keytool -importcert -alias collab_cert –file /filepath/sslcertificate/collabcert.crt –keystore..../oracle_common/jdk/jre/lib/security/cacerts

Enter the password changeit when asked, then enter YES.
Register the https://jive URL in Oracle Enterprise Manager for Announcements and Discussions.
Restart the WC_Portal managed server.
Test announcements and discussions.

Securing the WebCenter Portal Connection to Portlet Producers with SSL

Securing the connection to WSRP with SSL is described in the following sections:

Creating the Custom Keystores for Portlet Producers

The following steps are required to configure WebCenter Portlet with SSL using the KSS keystore.

Connect to WebLogic Server using the WLST console:

connect('weblogic','password','host:port’)

Get the OPSS service reference:

svc = getOpssService(name='KeyStoreService')

Create a new keystore:
Note:
Create a keystore in the system stripe and the permission must be false.
```
svc.createKeyStore(appStripe='system', name='portlet_wls', password='password', permission=false)
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe in which the keystore is created
- name = the name of the keystore
- password = password of the keystore
- permission = false if protected by both permission and password (true if keystore is protected by permission only)
Generate keypair:
```
svc.generateKeyPair(appStripe='system', name='portlet_wls', password='password', dn='cn=customidentity,dc=example,dc=com', keysize='2048', alias='portlet_wls', keypassword='password')
```
where:
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore where the key pair is generated
- password = password of the keystore
- dn = the distinguished name of the certificate wrapping the key pair
- keysize = the key size
- alias = the alias of the key pair entry
- keypassword = the key password
Optionally, list the keystores and aliases inside the keystore.

This will list the system/portlet_wls:
```
svc.listKeyStores(appStripe='*')
```
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe whose keystores are listed
This will list the alias portlet_wls:
```
svc.listKeyStoreAliases(appStripe="system",name="portlet_wls", password="password", type="*")
```
- svc = the service command object obtained through a call to getOpssService()
- appStripe = the name of the stripe containing the keystore
- name = the name of the keystore
- password = password of the keystore
- type = the type of entry for which aliases are listed. Valid values are 'Certificate', 'TrustedCertificate', 'SecretKey' or '*'

Run syncKeyStores:

syncKeyStores(appStripe='system', keystoreFormat='KSS')

Configuring the Identity and Trust Keystores for Portlet Producers

The next step is to configure the Custom Identity and Trust Keystores for the WebCenter Portlet server (for example, WC_Portlet).

For an overview of on how to configure the Identity and Trust keystores, see Securing the Browser Connection to WebCenter Portal using SSL.

To configure the identity and trust keystores for the Portlet server:

Log in to the WebLogic Server Administration Console.

For information on logging into the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.
In the Domain Structure pane, expand Environment and click Servers.

The Summary of Servers pane displays.
Click the WebCenter Portlet server (for example, WC_Portlet) to configure the identity and trust keystores.

The Settings pane for the Portlet server displays.
Open the Configuration tab, and then the Keystores subtab.

The Keystores pane displays.
Click Change.
For Keystores, select Custom Identity and Custom Trust, and click Save
Under Identity, enter the path and filename of the Custom Identity Keystore you created in kss://system/portlet_wls (Creating the Custom Keystores for Portlet Producers).
Enter KSS as the Custom Identity Keystore Type.
Enter and confirm your custom identity keystore password, (for example, welcome1).
Under Trust, set the Custom Trust Keystore to kss://system/trust and click Save.
Enter KSS as the Custom Trust Keystore Type, and enter and confirm your custom trust keystore password, then click Save.
Open the SSL tab.
Enter the private key alias ( for example, portlet_wls), and set the private key password (for example, welcome1).
Click Save to save your entries.

Configuring the SSL Connection for Portlet Producers

To configure SSL, see Overview of Configuring SSL in WebLogic server in Administering Security for Oracle WebLogic Server guide.

To configure the SSL connection for Portlet Server:

On the Settings pane for the WebCenter Portlet server (WC_Portlet), open the Configuration tab and then the General subtab.
Select SSL Listen Port Enabled.
Enter an SSL listen port number.
Click Save.
Select Configuration > SSL, and then open the Advanced options at the bottom of the page.
Check that the Two Way Client Cert Behavior option is set to Client Certs Not Requested .
Click Save.
Open the Control tab.

The Control Settings pane opens.
Click Restart SSL.
Restart the Portlet Server (WC_Portlet) and open the SSL WSRP Portlet URL: https://host:port/<context-root>/portlets/wsrp2?WSDL.
Accept the certificate for the session and WSDL will get loaded.

Registering the SSL-enabled WSRP Producer and Running the Portlets

Configure the WC_Portal managed server to register portlets with WebCenter Portal. This also uses the certificates in JAVA_HOME trust store (/jdk/jre/lib/security/cacerts).

To register the SSL-enabled WSRP producer and run the portlets:

When you accessed the SSL WSRP Portlet URL (https://host:port/<context-root>/portlets/wsrp2?WSDL), the certificate was generated and stored in your browser.
Download the certificate and save it in .PEM or .crt format.

Use Firefox 3.0 or later to download the certificate directly to .PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see der2pem in Command Reference for Oracle WebLogic Server.
Import the certificate into the cacerts file in the /jdk/jre/lib/security using the following keytool command:
```
keytool -importcert -alias portlet_cert -file portlet_pem -keystore cacerts
```
Where:
- portlet_cert is the portlet certificate alias
- portlet_pem is the portlet certificate file (for example, portlet_cert.pem)
Restart WC_Portal.
Register the SSL enabled portlet URL — Run the registerWSRPProducer WLST command to register the producer:
```
registerWSRPProducer('webcenter', 'sslwsrpprod','producer_wsdl')
```
Where:
- sslwsrpprod is the name of the SSL-enabled WSRP producer
- producer_wsdl is the WSDL URL of the SSL-enabled WSRP producer
For example:
```
registerWSRPProducer('webcenter', 'sslwsrpprod','https://example.com:7004/richtextportlet/portlets/wsrp2?WSDL')
```
Navigate to the HTTP or HTTPS WebCenter Portal URL.
Create a page and go to the Portlets link.
Go to the registered WSRP producer.
Add the portlet to the page.
Go to the view mode of the page and check that the WSRP portlet renders correctly.

Securing the WebCenter Portal Connection to the LDAP Identity Store

To configure the LDAP server port for SSL, refer to the appropriate administration documentation for the LDAP server. For Oracle Internet Directory (OID), an SSL port is installed by default. To use this port for LDAP communication from WebCenter Portal, the identity store should be configured for authentication with the appropriate authenticator. See Configuring the Identity Store for the steps to do this for the identity store.

If the CA is unknown to the Oracle WebLogic server, complete this additional step described in the following subsection:

Exporting the OID Certificate Authority (CA)

Exporting the OID Certificate Authority (CA)

The following topics describe how to secure the WebCenter Portal connection to OID:

Enabling the SSL in OID

This topic describes how to enable the SSL in OID.

Note:

OID should be configured in the server auth mode.

Create an Oracle wallet by running the following commands:
```
<OID_INSTALL_LOC>/oracle_common/bin/orapki wallet create -wallet <wallet_location>/OID_Wallet -auto_login
```
Note:
Enter the password, when prompted.

where,
- <OID_INSTALL_LOC> is the location where the OID is installed.
  
  <wallet_location> is the location where you want the new wallet named OID_Wallet to be created. If you do not specify the wallet location, the new wallet is created in the current directory, where the command is executed.
Add certificates to an Oracle wallet by running the following commands:
```
<OID_INSTALL_LOC>/oracle_common/bin/orapki wallet add -wallet -wallet <wallet_location>/OID_Wallet -dn cn=<Domain name> -keysize 2048 -self_signed -sign_alg sha1 -validity 1000
```
Where,
- <OID_INSTALL_LOC> is the OID install location.
- <wallet_location> is the wallet location.
- cn is the domain name where OID server is installed. You can find the domain name from /etc/hosts file.
  
  For example: cn=<Domain name>.
- -sign_alg is signature algorithm. MD5 is the default value of signature algorithm.
  
  The recent versions of JDK, which is JDK8 does not support the MD5 algorithm, you need to give sha1 or sha2 for the signature algorithm. For example: sha1 .
- -self_signed is a self signed certificate.
  
  You can also get the certificate trusted by CA and import it accordingly. For more information, see Configuring Secure Sockets Layer (SSL).

Configure the SSL parameters in OID by running the following commands:

ldapmodify -h OID_host -p OID_port -D cn=OID_admin -w password
dn:cn=oid1,cn=osdldapd,cn=subconfigsubentry
changetype: modify
replace: orclsslauthentication
orclsslauthentication: 32
-
replace: orclsslwalleturl
orclsslwalleturl: file://<wallet_location>/OID_wallet

Restart the OID server.
Verify that the SSL connections are created successfully by running the following commands:
```
./ldapbind -h OID_host -p OID_port -U 2 -W file://<wallet_location>/OID_Wallet  -P password
```
where,
- <wallet_location>/OID_Wallet is wallet location.
Export the certificate by running the following command:
```
<OID_INSTALL_LOC>/oracle_common/bin/orapki wallet export -wallet /<wallet_location>/OID_Wallet -dn "cn=<Domain name>" -cert oid_trust.cer
```
where,
- <OID_install_LOC>/<wallet_location>/OID_Wallet is the location of the wallet.
- oid_trust.cer is the certificate. By default, the wallet certificate is created in the current directory where the command is executed. If you specify the path, wallet certificate is created in the specified location, for example: /OID_Install_LOC/oid_cert_trust.cer.

Importing the OID Certificate

This topic describes how to import the OID certificate to the WebLogic Server Trust Store of WebCenter.

Note:

The procedure has to be performed on your WebLogic domain, where the WebCenter Portal server is installed.

Import the certificate to the Oracle WebLogic Server Trust Store of the WebCenter Portal using the following command:
```
keytool -importcert -v -trustcacerts -alias oid_server_trust -file oid_trust.cer -keystore cacerts -storepass changeit
```
Note:

The cacerts path can be retrieved as follows:
1. Log in to the WebLogic console, navigate to Servers and click WC_Portal server.
2. Click Configurations, then click the Keystores subtab.
3. Verify the path mentioned in the Java Standard Trust Keystore.
  
  Note:
  
  The path mentioned in the Java Standard Trust Keystore is your cacert path.
Configure the OID with Oracle WebLogic Server.

For more information, see Configuring the Oracle Internet Directory Authenticator.

Note:

When entering the Provider Specific information, ensure to specify an SSL host and port and to select the SSL Enabled check box.

Establishing the SSL Connections

This topic describes how to Establish the SSL connections between the identity store and LDAP server.

Note:

The procedure has to be performed on your WebLogic domain, where the WebCenter Portal server is installed.

Set up your environment using the following script:

setenv WL_HOME <WCP_INSTALL_LOCATION>/wlserver  
setenv ORACLE_HOME <WCP_ORACLE_HOME> 
cd $WL_HOME/server/bin 
./setWLSEnv.sh 
cd $ORACLE_HOME/oracle_common/bin

Create the keystore using the following script:
```
libovdconfig.sh -host wls_host -port wls_adminserver_port -userName
wls_user_name -domainPath full_path_domain_home -createKeystore
```
- host is the Oracle WebLogic Server host
- port is the Oracle WebLogic Server Admin Server port
- username is the Oracle WebLogic Server admin user name
- domainPath is the complete path to the domain home
Note:
The keystore is created in the following location -keystore $DOMAIN_HOME/config/fmwconfig/ovd/default/keystores/adapters.jks
Import the certificate to the keystore using the keytool command. The syntax is as follows, for a keystore named adapters.jks.
Ensure that you have exported the previously generated OID. For more information, see Enabling the SSL in OID.

Note:

The keystore adapters.jksis created in Step 2.
```
$JAVA_HOME/bin/keytool -importcert 
-keystore $DOMAIN_HOME/config/fmwconfig/ovd/default/keystores/adapters.jks 
-storepass keystore_password_used_in_libovdconfig.sh 
-alias alias_name 
-file full_path_to_LDAPCert_file 
-noprompt
```
Restart the Oracle WebLogic Server and the managed servers.
Access the WebCenter Portal and log in as any OID user. You should be able to login successfully.
Note:
if you receive host name verification exception, then set the following parameter:
```
 -Dweblogic.security.SSL.ignoreHostnameVerification=true
```

Securing the WebCenter Portal Connection to IMAP and SMTP with SSL

Before reconfiguring the mail server connection, you must first import the certificate into the trust store. Follow the steps below to put the certificate in the trust store and configure WebCenter Portal to use the trust store.

To secure the WebCenter Portal connection to IMAP and SMTP with SSL:

Open a browser and connect to your IMAP server with the following command:
```
https://imapserver:ssl_port
```
For example:
```
https:mailserver.example:993 
```
Place your cursor on the page, right-click, and select Properties.
Click Certificate.
In the popup window, click the Details tab and click Copy to File...

Be sure to use the DER encoded binary(X.509) format and copy to a file.
Convert the .DER format certificate to .PEM format.

Use Firefox 3.0 or later to download the certificate directly to.PEM format, or for other browsers use the WebLogic Server der2pem tool to convert to PEM format. For more information about using the der2pem tool, see der2pem in Command Reference for Oracle WebLogic Server. Note that WebLogic does not recognize any other format other than .PEM format.
Import the certificate into the cacerts in the JDK_HOME using the following command:
```
keytool -import -alias imap_cer -file cert_file.cer -keystore cacerts -storepass changeit
```
Where cert_file is the name of the certificate file you downloaded.
Register the mail server connection as described in Registering Mail Servers.
Restart WebCenter Portal.
Log into WebCenter Portal and provide your mail credentials.

Securing the WebCenter Portal Connection to an External BPEL Server with SSL

This section describes how to secure the WebCenter Portal connection to a BPEL server when the BPEL server resides in an external SOA domain.

Note:

When SOA is installed in an external domain, the Identity Asserter and Authenticator should be configured exactly as for WebCenter Portal. For more information on configuring the Identity Asserter and Authenticator for an external LDAP identity store, see Reassociating the Identity Store with an External LDAP Server.

To secure the WebCenter Portal connection to an external BPEL server with SSL:

Install and configure Oracle SOA 12c.
See Installing Oracle SOA Suite Quick Start for Developers in Installing SOA Suite and Business Process Management Suite Quick Start for Developers.

From WebCenter, create a connection to SOA in WebCenter, by running the following commands:

createBPELConnection('webcenter','WebCenter-Worklist'
setSpacesWorkflowConnectionName('webcenter', 'WebCenter-Worklist', 'SOA_host:port','oracle/wss10_saml_token_client_policy')

From WebCenter, enable SSL.
Follow the steps in Securing the Browser Connection to WebCenter Portal using SSL.
From SOA, enable SSL.
Follow the steps in Securing the Browser Connection to WebCenter Portal using SSL, but instead of webcenter_wls, you will use soa_wls and instead of webcenteridentity, you will use soaidentity.
Configure the keystores for WebCenter Portal and SOA.
See Creating the WebCenter Portal Domain Keystore and Creating the SOA Domain Keystore.
Wire WebCenter WebLogic server and SOA WebLogic server to the same OID.

From WebCenter, import the SOA public and CA certificate to the WebCenter Trust store:

keytool -importcert -trustcacerts -alias soa_cert -file /filepath/certificate/bpel.cer -keystore /filepath/cacerts -storepass changeit

keytool -importcert -trustcacerts -alias soa_trust -file /filepath/certificate/democabpel.cer -keystore /filepath/cacerts -storepass changeit

From SOA, import the WebCenter public and CA certificate to the SOA Trust Store:

keytool -importcert -trustcacerts -alias webcenter_cert -file /filepath/certificate/webcenter.cer -keystore /filepath/cacerts -storepass changeit

keytool -importcert -trustcacerts -alias webcenter_trust -file /filepath/certificate/democaprod.cer -keystore /filepath/cacerts -storepass changeit

From WebCenter, change the SOA connection details to use the SOA HTTPS host and port in Oracle Enterprise Manager.
Add -Dweblogic.security.SSL.ignoreHostnameVerification=true as EXTRA_JAVA_PROPERTIES in setDomainEnv.sh for Webcenter.
Restart the WC_Portal server and the SOA managed server.

Securing the WebCenter Portal Connection to Content Server with SSL

If Content Server and the WebCenter Portal application in which you intend to create a repository connection are not on the same system or the same trusted private network, then identity propagation is not secure. To ensure secure identity propagation you must also configure SSL on Content Server.

Securing the connection with SSL is described in the following sections:

Configuring Content Server SSL for Socket SSL

To configure Content Server socket SSL, see Configuring SSL in Developing with Oracle WebCenter Content.

Note the following parameters at the end of the configuration:

serverPort
keystoreLocation - client_keystore
keystorePassword - idcidc
privateKeyAlias - SecureClient
privateKeyPassword - idcidc

Creating Content Server SSL Connection in WebCenter Portal

Creating Socket SSL Connection

Create Content Server Connection in WebCenter Portal

To create Content Server connection, do the following:
```
createContentServerConnection (appName='webcenter', name='dev-ucm', socketType='socketssl', serverHost='100.111.149.197', serverPort='3333', isPrimary='true', keystoreLocation='/scratch/patch-jars/ucm_keystore/client_keystore', keystorePassword='idcidc', privateKeyAlias='SecureClient', privateKeyPassword='idcidc')
setContentServerProperties(appName='webcenter', portalServerIdentifier='/WCP01', securityGroup='WCP01', adminUserName='weblogic')
```
Note:
The serverPort must be SSL Port. For keystore configuration, see Configuring Content Server SSL for Socket SSL. The values that you have noted in the previous step like keystore and aliases will be used when you will create content server connection using WLST command.

For createContentServerConnection details, see WebCenter Portal Custom WLST Commands in WebCenter WLST Command Reference and Managing Connections to Oracle WebCenter Content Server.
Restart the Portal server.
Now access the WebCenter Content RUI and test the documented use cases.

Creating JAX-WS SSL Connection

To import the WebCenter Content SSL Certificate to WebCenter Portal Keystore (cacerts):

Enter the Content Server URL: https://host:port/cs in the firefox browser. The certificate should be generated when you access the URL, and stored in your browser.
Download and store the certificate in .PEM or .CRT format.

Import the certificate into cacerts in JDK_HOME, using the following command:

keytool -importcert -alias collab_cert –file /filepath/sslcertificate/contentcert.crt –keystore..../oracle_common/jdk/jre/lib/security/cacerts

Enter the password changeit when asked, then enter YES.

Creating Content Server Connection in WebCenter Portal

To create Content Server connection, do the following:

createContentServerConnection(appName='webcenter', name='dev-ucm', socketType='jaxws', url='https://<ucm_host>:<sslPort>/idcnativews', clientSecurityPolicy='oracle/wss10_saml_token_client_policy', adminUsername='weblogic',isPrimary='true') 
setContentServerProperties(appName='webcenter', portalServerIdentifier='/WCP01', securityGroup='WCP01', adminUserName='weblogic')

Note:

The URL must be https URL of WebCenter Content.

Restart the Portal server.
Now access the WebCenter Content RUI and test the documented use cases.

For createContentServerConnection details, see WebCenter Portal Custom WLST Commands and Managing Connections to Oracle WebCenter Content Server.