Configuring SSL in Oracle WebLogic Server

You can configure one-way and two-way SSL in Oracle WebLogic Server.

This section contains the following topics:

Configuring One-Way SSL in Oracle WebLogic Server

One-way SSL is required to properly secure the communication between Oracle Business Intelligence and Oracle WebLogic Server.

To configure one-way SSL in Oracle WebLogic Server:

From the WebLogic Server Administration Console home page, click Servers under the Environment heading.
In the Servers table, the name of the server you want to manage. Then, on the General subtab of the Configuration tab, select SSL Listen Port Enabled.
Use the Administration Tool to update the appropriate connection pool object in the Physical layer so that the URL uses https:// instead of http://. Also, update the port number to use the SSL port (7002 by default).

Configuring Two-Way SSL in Oracle WebLogic Server

You can set up two-way SSL to secure the communication between the Oracle BI Server and Oracle WebLogic Server.

To set up and test two-way SSL:

Create client certificates in the Oracle BI Server, if they do not already exist. See Authentication Concepts in Security Guide for Oracle Business Intelligence Enterprise Edition for more information.
Modify the ADF Oracle WebLogic Server to accept SSL connections and to perform mutual SSL. To do this, perform the following steps in the Oracle WebLogic Server Administration Console:
1. Log in to the Administration Console and click Servers under the Environment heading, then click the server name (for example, AdminServer).
2. In the Change Center, click Lock & Edit to enable configuration changes.
3. In the General tab, select SSL Listen Port Enabled and record the SSL Listen Port number. Then, click Save.
4. Select the SSL tab, then select Advanced. For Two Way Client Cert Behavior, select Client Certs Requested and Enforced. Then, click Save.
5. Select the Keystores tab and record the Trust Keystore that is being used. For example, if the Demo Trust keystore is used, record its location and file name.
6. Click Activate Changes.
Ensure that the Certificate Authority (CA) for the Oracle BI Server client certificate is trusted by the ADF Oracle WebLogic Server. To do this, follow these steps:
1. On the Oracle BI Server computer, find the CA file for the client certificate. If the file was generated using the instructions referenced in Step 1, the file will be "cacert.pem" in:
```
ORACLE_HOME/user_projects/domains/bifoundation_domain/config/fmwconfig
/biinstances/coreapplication/ssl
```
  Copy this file to a known location.
2. On the ADF Oracle WebLogic Server computer, open a command window and go to the location of the trust keystore. You recorded this value in Step 2. For example:
```
/scratch/user_name/view_storage/user_name_fmw/fmwtools/mw_home/wlserver_10.3/server/lib
```
  Copy the client CA file (for example, cacert.pem), stored in the previous step, to this location.
3. Use the JDK keytool utility to import the client CA into the trust keystore for the ADF server, making it a trusted CA. Use the following command:
```
keytool -import -file client_CA_file -keystore keystore_file -keystorepass keystore_password
```
  For example:
```
/scratch/my_name/view_storage/my_name_fmw/jdk6/bin/keytool -import -file
~/Downloads/SSL/cacert.pem -keystore DemoTrust.jks -keystorepass
DemoTrustKeyStorePassPhrase
```
4. Restart the ADF Oracle WebLogic Server.
Update the Physical layer of the Oracle BI repository, as follows:
1. In the Administration Tool, in the Physical layer, open the first ADF connection pool object and select the Miscellaneous tab.
2. Update the URL field to use the https protocol and the SSL port noted in Step 2, and then click OK.
3. Repeat the previous two steps for each additional ADF connection pool object.
4. Save the repository and restart the Oracle BI Server.
Configure the Oracle BI Server ODBC DSN to use SSL. For example, on Windows:
1. Open the ODBC Data Source Administrator and select the System DSN tab.
2. Double-click the DSN for the Oracle BI Server. The DSN should start with "coreapplication_OH."
3. Select Use SSL.
4. Click Next, click Next again, and then click Finish.
Perform queries against ADF using your Oracle BI Server client of choice (such as nqcmd). The Oracle BI Server should now be communicating with the ADF Oracle WebLogic Server using mutual SSL / client certs.