Contents

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in Oracle HTTP Server 12c (12.2.1.x)

• New and Changed Features in 12c (12.2.1.2)
  • Significant Updates in 12c (12.2.1.2)
    • Oracle HTTP Server No Longer Supports Certificates Signed Using the MD5 Algorithm
• New and Changed Features in 12c (12.2.1.1)
• New and Changed Features in 12c (12.2.1)
  • New Features in 12c (12.2.1)
    • New and Changed Features Available with Apache httpd 2.4
    • New Operational Mode—Restricted-JRF
    • New Modules
    • iPlanet Migration to Oracle HTTP Server
    • Trust Flags
    • Oracle WebLogic Server Proxy Monitoring
    • Support for Multi-tenancy and Partitions for Oracle WebLogic Server Proxy Plug-Ins
  • Significant Updates in 12c (12.2.1)
    • New Ciphers
    • Removal of Modules
    • Replacements for mod_perl
    • Replacements for mod_fastcgi/mod_cgi
    • Replacements for mod_plsql
    • Names of WLST Custom Command Have Changed
    • New WLST Commands
    • createOHSTestDomain (ohs_createTestDomain) WLST Custom Command Has Been Removed
    • Other Upgrade Notes
  • Features Removed

Part I Understanding Oracle HTTP Server

1 Introduction to Oracle HTTP Server

• What is Oracle HTTP Server?
• Oracle HTTP Server 12c (12.2.1) Topologies
• Key Features of Oracle HTTP Server
  • Restricted-JRF Mode
  • Oracle WebLogic Server Proxy Plug-In (mod_wl_ohs)
  • CGI and Fast CGI Protocol (mod_proxy_fcgi)
  • Security Features
    • Oracle Secure Sockets Layer (mod_ossl)
    • Security: Encryption with Secure Sockets Layer
    • Security: Single Sign-On with WebGate
  • URL Rewriting and Proxy Server Capabilities
• Domain Types
  • WebLogic Server Domain (Full-JRF Mode)
  • WebLogic Server Domain (Restricted-JRF Mode)
  • Standalone Domain
• Understanding Oracle HTTP Server Directory Structure
• Understanding Configuration Files
  • Staging and Run-time Configuration Directories
  • Oracle HTTP Server Configuration Files
  • Modifying an Oracle HTTP Server Configuration File
• Upgrading from Earlier Releases of Oracle HTTP Server
• Oracle HTTP Server Support

2 Understanding Oracle HTTP Server Modules

• Oracle-Developed Modules for Oracle HTTP Server
  • mod_certheaders Module—Enables Reverse Proxies
  • mod_context Module—Creates or Propagates ECIDs
  • mod_dms Module—Enables Access to DMS Data
  • mod_odl Module—Enables Access to ODL
  • mod_ora_audit—Supports Authentication and Authorization Auditing
  • mod_ossl Module—Enables Cryptography (SSL)
  • mod_webgate Module—Enables Single Sign-on
  • mod_wl_ohs Module—Proxies Requests to Oracle WebLogic Server
• Apache HTTP Server and Third-party Modules in Oracle HTTP Server

3 Understanding Oracle HTTP Server Management Tools

• Administering Oracle HTTP Server Using Fusion Middleware Control
  • Accessing Fusion Middleware Control
  • Accessing the Oracle HTTP Server Home Page
  • Understanding the Oracle HTTP Server Home Page
  • Editing Configuration Files Using Fusion Middleware Control
• Administering Oracle HTTP Server Using WLST
  • Oracle HTTP Server-Specific WLST Commands
  • Using WLST in a Standalone Environment

Part II Managing Oracle HTTP Server

4 Running Oracle HTTP Server

• Before You Begin
• Creating an OHS Instance
  • Creating an Oracle HTTP Server Instance in a WebLogic Server Domain
    • Creating an Instance by Using WLST
    • Creating an Instance by Using Fusion Middleware Control
    • About Instance Provisioning
  • Creating an Oracle HTTP Server Instance in a Standalone Domain
• Performing Basic Oracle HTTP Server Tasks
  • About Using the WLST Commands
  • Understanding the PID File
  • Starting Oracle HTTP Server Instances
    • Starting Oracle HTTP Server Instances Using Fusion Middleware Control
    • Starting Oracle HTTP Server Instances Using WLST
    • Starting Oracle HTTP Server Instances from the Command Line
      • Storing Your Node Manager Password
    • Starting Oracle HTTP Server Instances on a Privileged Port (UNIX Only)
    • Starting Oracle HTTP Server Instances as a Different User (UNIX Only)
  • Stopping Oracle HTTP Server Instances
    • Stopping Oracle HTTP Server Instances Using Fusion Middleware Control
    • Stopping Oracle HTTP Server Instances Using WLST
    • Stopping Oracle HTTP Server Instances from the Command Line
  • Restarting Oracle HTTP Server Instances
    • Restarting Oracle HTTP Server Instances Using Fusion Middleware Control
    • Restarting Oracle HTTP Server Instances Using WLST
  • Checking the Status of a Running Oracle HTTP Server Instance
    • Checking Server Status Using Fusion Middleware Control
    • Checking Server Status Using WLST
  • Deleting an Oracle HTTP Server Instance
    • Deleting an Oracle HTTP Server Instance in a WebLogic Server Domain
      • Deleting an Instance Using WLST
      • Deleting an Instance Using Fusion Middleware Control
    • Deleting an Oracle HTTP Server Instance from a Standalone Domain
  • Changing the Default Node Manager Port Number
    • Changing the Default Node Manager Port Using WLST
    • Changing the Default Node Manager Port Using Oracle WebLogic Server Administration Console
• Remotely Administering Oracle HTTP Server
  • Setting Up a Remote Environment
    • Host Requirements for a Remote Environment
    • Task 1: Set Up an Expanded Domain on host1
    • Task 2: Pack the Domain on host1
    • Task 3: Unpack the Domain on host2
    • Task 4: Run Oracle HTTP Server Remotely

5 Working with Oracle HTTP Server

• About Editing Configuration Files
  • Editing a Configuration File for a Standalone Domain
  • Editing a Configuration File for a WebLogic Server Domain
• Specifying Server Properties
  • Specifying Server Properties Using Fusion Middleware Control
  • Specify Server Properties by Editing the httpd.conf File
• Configuring Oracle HTTP Server Instances
  • Secure Sockets Layer Configuration
  • Configuring Secure Sockets Layer in Standalone Mode
    • Configure SSL
      • Task 1: Create a Real Wallet
      • Task 2: (Optional) Customize Your Configuration
      • Basic SSL Configuration Example
    • Specify SSLVerifyClient on the Server Side
      • Adding a Trusted Client Certificate in a Standalone Oracle HTTP Server Installation
      • Adding a Trusted Client Certificate in Collocated Oracle HTTP Server Installation
      • Forcing Clients to Authenticate Using Certificates
      • Forcing a Client to Authenticate for a Particular URL
      • Authorizing a Client for a Particular URL
      • Allowing Clients with Strong Ciphers and CA Client Certificate or Basic Authentication
    • Enable SSL Between Oracle HTTP Server and Oracle WebLogic Server
  • Exporting the Keystore to an Oracle HTTP Server Instance Using WLST
  • Importing Wallets to the KSS Database after an Upgrade Using WLST
  • Associating Oracle HTTP Server Instances With a Keystore Using WLST
  • Configuring MIME Settings using Fusion Middleware Control
    • Configuring MIME Types
    • Configuring MIME Encoding
    • Configuring MIME Languages
  • About Configuring mod_proxy_fcgi
  • About Configuring the Oracle WebLogic Server Proxy Plug-In (mod_wl_ohs)
    • Configuring SSL for mod_wl_ohs
  • Removing Access to Unneeded Content
    • Edit the cgi-bin Section
    • Edit the Fancy Indexing Section
    • Edit the Product Documentation Section
  • Using the apxs Command to Install Extension Modules
  • Disabling the Options Method
  • Updating Oracle HTTP Server Component Configurations on a Shared Filesystem
• Configuring the mod_security Module
  • Configuring mod_security in the httpd.conf File
  • Configuring mod_security in a mod_security.conf File
  • Sample mod_security.conf File

6 Managing and Monitoring Server Processes

• Oracle HTTP Server Processing Model
  • Request Process Model
  • Single Unit Process Model
• Monitoring Server Performance
  • Oracle HTTP Server Performance Metrics
  • Viewing Performance Metrics
    • Viewing Server Metrics Using Fusion Middleware Control
    • Viewing Server Metrics Using WLST
• Oracle HTTP Server Performance Directives
  • Understanding Performance Directives
    • Changing the MPM Type Value in a Standalone Domain
    • Changing the MPM Type Value in a WebLogic Server Managed Domain
  • Configuring Performance Directives Using Fusion Middleware Control
    • Setting the Request Configuration Using Fusion Middleware Control
    • Setting the Connection Configuration Using Fusion Middleware Control
    • Setting the Process Configuration Using Fusion Middleware Control
• Understanding Process Security for UNIX

7 Managing Connectivity

• Default Listen Ports
• Defining the Admin Port
• Viewing Port Number Usage
  • Viewing Port Number Usage Using Fusion Middleware Control
  • Viewing Port Number Usage Using WLST
• Managing Ports
  • Creating Ports Using Fusion Middleware Control
  • Editing Ports Using Fusion Middleware Control
  • Disabling a Listening Port in a Standalone Environment
• Configuring Virtual Hosts
  • Creating Virtual Hosts Using Fusion Middleware Control
  • Configuring Virtual Hosts Using Fusion Middleware Control

8 Managing Oracle HTTP Server Logs

• Overview of Server Logs
  • About Error Logs
  • About Access Logs
  • Configuring Log Rotation
    • Syntax and Examples for Time- and Size-Based Log Rotation
• Configuring Oracle HTTP Server Logs
  • Configuring Error Logs Using Fusion Middleware Control
    • Configuring the Error Log Format and Location
    • Configuring the Error Log Level
    • Configuring Error Log Rotation Policy
  • Configuring Access Logs Using Fusion Middleware Control
    • Configuring the Access Log Format
    • Configuring the Access Log File
  • Configuring the Log File Creation Mode (umask) (UNIX/Linux Only)
    • Configure umask for an Oracle HTTP Server Instance in a Standalone Domain
    • Configure umask for an Oracle HTTP Server Instance in a WebLogic Server Managed Domain
• Configuring the Log Level Using WLST
• Log Directives for Oracle HTTP Server
  • Oracle Diagnostic Logging Directives
    • OraLogMode
    • OraLogDir
    • OraLogSeverity
    • OraLogRotationParams
  • Apache HTTP Server Log Directives
    • ErrorLog
    • LogLevel
    • LogFormat
    • CustomLog
• Viewing Oracle HTTP Server Logs
  • Viewing Logs Using Fusion Middleware Control
  • Viewing Logs Using WLST
  • Viewing Logs in a Text Editor
• Recording ECID Information
  • About ECID Information
  • Configuring Error Logs for ECID Information
  • Configuring Access Logs for ECID Information
• Terminating SSL Requests
  • About Terminating SSL at the Load Balancer
    • Terminating SSL at the Load Balancer
  • About Terminating SSL at Oracle HTTP Server
    • Terminating SSL at Oracle HTTP Server

9 Managing Application Security

• About Oracle HTTP Server Security
• Classes of Users and Their Privileges
• Resources Protected
• Authentication, Authorization and Access Control
  • Access Control
  • User Authentication and Authorization
    • Authenticating Users with Apache HTTP Server Modules
    • Authenticating Users with WebGate
  • Support for FMW Audit Framework
    • Managing Audit Policies Using Fusion Middleware Control
• Implementing SSL
  • Global Server ID Support
  • PKCS #11 Support
  • SSL and Logging
• Using mod_security
• Using Trust Flags

A Appendixes

• Oracle HTTP Server WLST Custom Commands
  • Getting Help on Oracle HTTP Server WLST Custom Commands
  • Names of WLST Custom Commands Have Changed
  • Oracle HTTP Server Commands
    • ohs_addAdminProperties
    • ohs_addNMProperties
    • ohs_createInstance
    • ohs_deleteInstance
    • ohs_exportKeyStore
    • ohs_postUpgrade
    • ohs_updateInstances
• Migrating to the mod_proxy_fcgi and mod_authnz_fcgi Modules
  • Task 1: Replace LoadModule Directives in htttpd.conf File
  • Task 2: Delete mod_fastcgi Configuration Directives From the htttpd.conf File
  • Task 3: Configure mod_proxy_fcgi to Act as a Reverse Proxy to an External FastCGI Server
  • Task 4: Setup an External FastCGI Server
  • Task 5: Setup mod_authnz_fcgi to Work with FastCGI Authorizer Applications.
• Frequently Asked Questions
  • How Do I Create Application-Specific Error Pages?
  • What Type of Virtual Hosts Are Supported for HTTP and HTTPS?
  • Can I Use Different Language and Character Set Versions of Document?
  • Can I Apply Apache HTTP Server Security Patches to Oracle HTTP Server?
  • Can I Upgrade the Apache HTTP Server Version of Oracle HTTP Server?
  • Can I Compress Output From Oracle HTTP Server?
  • How Do I Create a Namespace That Works Through Firewalls and Clusters?
  • How Can I Enhance Website Security?
  • Why is REDIRECT_ERROR_NOTES not set for "File Not Found" errors?
  • How can I hide information about the Web Server Vendor and Version
  • Can I Start OHS by Using apachectl or Other Command-Line Tool?
  • How Do I Configure Oracle HTTP Server to Listen at Port 80?
  • How Do I Terminate Requests Using SSL Within Oracle HTTP Server?
  • How Do I Configure End-to-End SSL Within Oracle HTTP Server?
  • Can Oracle HTTP Server Front-End Oracle WebLogic Server?
  • What is the Difference Between Oracle WebLogic Server Domains and Standalone Domains?
  • Can Oracle HTTP Server Cache the Response Data?
  • How Do I Configure a Virtual Server-Specific Access Log?
• Troubleshooting Oracle HTTP Server
  • Oracle HTTP Server Unable to Start Due to Port Conflict
  • System Overloaded by Number of httpd Processes
  • Permission Denied When Starting Oracle HTTP Server On a Port Below 1024
  • Using Log Files to Locate Errors
    • Rewrite Log
    • Script Log
    • Error Log
  • Recovering an OHS Instance on a Remote Host
  • Oracle HTTP Server Performance Issues
    • Special Runtime Files Reside on a Network File System
    • UNIX Sockets on a Network File System
    • DocumentRoot on a Slow File System
  • Out of DMS Shared Memory
  • Performance Issues with Instances Created on Shared File Systems
  • Node Manager 12c (12.1.2) OHS Throws Java Exception on AIX
  • Oracle HTTP Server Fails to Start due to Certificates Signed Using the MD5 Algorithm
• Configuration Files
  • httpd.conf File
  • ssl.conf File
  • admin.conf File
  • mod_wl_ohs.conf File
  • mime.types File
  • ohs.plugins.nodemanager.properties File
  • magic File
  • keystores/<wallet-directory> File
  • auditconfig.xml File
  • component-logs.xml File
  • component_events.xml File
  • Additional Reference
• Property Files
  • ohs_admin.properties File
  • ohs_nm.properties File
  • ohs.plugins.nodemanager.properties File
    • Cross-platform Properties
    • Environment Variable Configuration Properties
    • Properties Specific to Oracle HTTP Server Instances Running on Linux and UNIX
• OHS Module Directives
  • Note on mod_wl_ohs Module
  • mod_certheaders Module
    • AddCertHeader Directive
    • SimulateHttps Directive
  • mod_ossl Module
    • SSLCARevocationFile Directive
    • SSLCARevocationPath Directive
    • SSLCipherSuite Directive
    • SSLEngine Directive
    • SSLFIPS Directive
    • SSLHonorCipherOrder Directive
    • SSLInsecureRenegotiation Directive
    • SSLOptions Directive
    • SSLProtocol Directive
    • SSLProxyCipherSuite Directive
    • SSLProxyEngine Directive
    • SSLProxyProtocol Directive
    • SSLProxyWallet Directive
    • SSLRequire Directive
    • SSLRequireSSL Directive
    • SSLSessionCache Directive
    • SSLSessionCacheTimeout Directive
    • SSLTraceLogLevel Directive
    • SSLVerifyClient Directive
    • SSLWallet Directive