Channel: Configuration: Security
Configuration Options Advanced Configuration Options Related Tasks Related Topics
This page allows you to define the security configuration of this network channel.
A network channel is a configurable resource that defines the attributes of a network connection to WebLogic Server. You can use network channels to manage quality of service, meet varying connection requirements, and improve utilization of your systems and network resources.
Name Description Two Way SSL Enabled
Specifies whether this network channel uses two way SSL.
Client Certificate Enforced
Specifies whether clients must present digital certificates from a trusted certificate authority to WebLogic Server on this channel.
Specifies the SSL identity for this channel.
Server Private Key Alias
The string alias used to store and retrieve the server's private key in the keystore. This private key is associated with the server's digital certificate.
Custom Channel Private Key Alias
The string alias used to store and retrieve the channel's private key in the keystore. This private key is associated with the server's digital certificate. A value of null indicates that the network channel uses the alias specified in the server's SSL configuration.
Custom Channel Private Key Pass Phrase
The passphrase used to retrieve the server's private key from the keystore. This passphrase is assigned to the private key when it is generated. A value of null indicates that the network channel uses the pass phrase specified in the server's SSL configuration.
Advanced Configuration Options
Name Description Custom Identity KeyStore Type
The type of the keystore. Generally, this is
JKS. If using the Oracle Key Store Service, this would be
If empty or null, then the JDK's default keystore type (specified in
java.security) is used. The custom identity key store type is only used if ServerMBean.KeyStores is CUSTOM_IDENTITY_AND_JAVA_STANDARD_TRUST, CUSTOM_IDENTITY_AND_CUSTOM_TRUST or CUSTOM_IDENTITY_AND_COMMAND_LINE_TRUST.
Custom Identity Keystore
The source of the identity keystore. For a JKS keystore, the source is the path and file name. For an Oracle Key Store Service (KSS) keystore, the source is the KSS URI.
If using a JKS keystore, the keystore path name must either be absolute or relative to where the server was booted.
If using a KSS keystore, the keystore URI must be of the form:
keystorename" is the name of the keystore registered in KSS.
The value in this attribute is only used if ServerMBean.KeyStores is CUSTOM_IDENTITY_AND_JAVA_STANDARD_TRUST, CUSTOM_IDENTITY_AND_CUSTOM_TRUST or CUSTOM_IDENTITY_AND_COMMAND_LINE_TRUST.
Custom Identity Keystore Passphrase
The encrypted custom identity keystore's passphrase. If empty or null, then the keystore will be opened without a passphrase.
This attribute is only used if ServerMBean.KeyStores is CUSTOM_IDENTITY_AND_JAVA_STANDARD_TRUST, CUSTOM_IDENTITY_AND_CUSTOM_TRUST or CUSTOM_IDENTITY_AND_COMMAND_LINE_TRUST.
When you get the value of this attribute, WebLogic Server does the following:
Retrieves the value of the
Decrypts the value and returns the unencrypted password as a String.
When you set the value of this attribute, WebLogic Server does the following:
Encrypts the value.
Sets the value of the
CustomIdentityKeyStorePassPhraseEncryptedattribute to the encrypted value.
Using this attribute (
CustomIdentityKeyStorePassPhrase) is a potential security risk because the String object (which contains the unencrypted password) remains in the JVM's memory until garbage collection removes it and the memory is reallocated. Depending on how memory is allocated in the JVM, a significant amount of time could pass before this unencrypted data is removed from memory.
Instead of using this attribute, use
Specifies whether to ignore the installed implementation of the
weblogic.security.SSL.HostnameVerifierinterface (when this server is acting as a client to another application server).
Custom Hostname Verifier
The name of the class that implements the
This class verifies whether the connection to the host with the hostname from URL should be allowed. The class is used to prevent man-in-the-middle attacks. The
verify()method that WebLogic Server calls on the client during the SSL handshake.
Indicates the cipher suites being used on a particular WebLogic Server channel.
The strongest negotiated cipher suite is chosen during the SSL handshake. The set of cipher suites used by default by JSEE depends on the specific JDK version with which WebLogic Server is configured.
For a list of possible values, see Cipher Suites.
Unencrypted Null Ciphers
Test if the AllowUnEncryptedNullCipher is enabled
setAllowUnencryptedNullCipher(boolean enable)for the NullCipher feature.
Inbound Certificate Validation
Indicates the client certificate validation rules for inbound SSL.
This attribute only applies to ports and network channels using 2-way SSL.
Outbound Certificate Validation
Indicates the server certificate validation rules for outbound SSL.
This attribute always applies to outbound SSL that is part of WebLogic Server (that is, an Administration Server talking to the Node Manager). It does not apply to application code in the server that is using outbound SSL unless the application code uses a
weblogic.security.SSL.ServerTrustManagerthat is configured to use outbound SSL validation.
- Configure custom network channels
- Configure keystores and SSL attributes specific to a network channel
- Configure default network connections
- Configure listen ports
- Configure protocols