Fusion Middleware Control Help for WebLogic Server

Channel: Configuration: Security

Configuration Options     Advanced Configuration Options     

This page allows you to define the security configuration of this network channel.

A network channel is a configurable resource that defines the attributes of a network connection to WebLogic Server. You can use network channels to manage quality of service, meet varying connection requirements, and improve utilization of your systems and network resources.

Configuration Options

Name	Description
Two Way SSL Enabled	Specifies whether this network channel uses two way SSL. MBean Attribute: NetworkAccessPointMBean.TwoWaySSLEnabled Secure value: true
Client Certificate Enforced	Specifies whether clients must present digital certificates from a trusted certificate authority to WebLogic Server on this channel. MBean Attribute: NetworkAccessPointMBean.ClientCertificateEnforced Secure value: true
Channel Identity	Whether or not the channel's custom identity should be used. This setting only has an effect if the server is using a customized keystore. By default the channel's identity is inherited from the server's identity. MBean Attribute: NetworkAccessPointMBean.ChannelIdentityCustomized
Server Private Key Alias	The string alias used to store and retrieve the server's private key in the keystore. This private key is associated with the server's digital certificate. MBean Attribute: SSLMBean.ServerPrivateKeyAlias
Custom Channel Private Key Alias	The string alias used to store and retrieve the channel's private key in the keystore. This private key is associated with the server's digital certificate. A value of null indicates that the network channel uses the alias specified in the server's SSL configuration. MBean Attribute: NetworkAccessPointMBean.CustomPrivateKeyAlias
Custom Channel Private Key Pass Phrase	The passphrase used to retrieve the server's private key from the keystore. This passphrase is assigned to the private key when it is generated. A value of null indicates that the network channel uses the pass phrase specified in the server's SSL configuration. MBean Attribute: NetworkAccessPointMBean.CustomPrivateKeyPassPhrase

Advanced Configuration Options

Name	Description
Custom Identity Keystore Type	The type of the keystore. Generally, this is JKS. If using the Oracle Key Store Service, this would be KSS If empty or null, then the JDK's default keystore type (specified in java.security) is used. The custom identity key store type is only used if ServerMBean.KeyStores is CUSTOM_IDENTITY_AND_JAVA_STANDARD_TRUST, CUSTOM_IDENTITY_AND_CUSTOM_TRUST or CUSTOM_IDENTITY_AND_COMMAND_LINE_TRUST. MBean Attribute: NetworkAccessPointMBean.CustomIdentityKeyStoreType
Custom Identity Keystore	MBean Attribute: NetworkAccessPointMBean.CustomIdentityKeyStoreFileNames Changes take effect after you redeploy the module or restart the server.
Custom Identity Keystore Pass Phrase	The encrypted custom identity keystore's passphrase. If empty or null, then the keystore will be opened without a passphrase. This attribute is only used if ServerMBean.KeyStores is CUSTOM_IDENTITY_AND_JAVA_STANDARD_TRUST, CUSTOM_IDENTITY_AND_CUSTOM_TRUST or CUSTOM_IDENTITY_AND_COMMAND_LINE_TRUST. When you get the value of this attribute, WebLogic Server does the following: Retrieves the value of the CustomIdentityKeyStorePassPhraseEncrypted attribute. Decrypts the value and returns the unencrypted password as a String. When you set the value of this attribute, WebLogic Server does the following: Encrypts the value. Sets the value of the CustomIdentityKeyStorePassPhraseEncrypted attribute to the encrypted value. Using this attribute (CustomIdentityKeyStorePassPhrase) is a potential security risk because the String object (which contains the unencrypted password) remains in the JVM's memory until garbage collection removes it and the memory is reallocated. Depending on how memory is allocated in the JVM, a significant amount of time could pass before this unencrypted data is removed from memory. Instead of using this attribute, use CustomIdentityKeyStorePassPhraseEncrypted. MBean Attribute: NetworkAccessPointMBean.CustomIdentityKeyStorePassPhrase
Hostname Verification	Specifies whether to ignore the installed implementation of the weblogic.security.SSL.HostnameVerifier interface (when this server is acting as a client to another application server). MBean Attribute: NetworkAccessPointMBean.HostnameVerificationIgnored
Custom Hostname Verifier	The name of the class that implements the weblogic.security.SSL.HostnameVerifier interface. This class verifies whether the connection to the host with the hostname from URL should be allowed. The class is used to prevent man-in-the-middle attacks. The weblogic.security.SSL.HostnameVerifier has a verify() method that WebLogic Server calls on the client during the SSL handshake. MBean Attribute: NetworkAccessPointMBean.HostnameVerifier
Ciphersuites	Indicates the cipher suites being used on a particular WebLogic Server channel. The strongest negotiated cipher suite is chosen during the SSL handshake. The set of cipher suites used by default by JSEE depends on the specific JDK version with which WebLogic Server is configured. For a list of possible values, see Cipher Suites. MBean Attribute: NetworkAccessPointMBean.Ciphersuites
Unencrypted Null Ciphers	Test if the AllowUnEncryptedNullCipher is enabled see setAllowUnencryptedNullCipher(boolean enable) for the NullCipher feature. MBean Attribute: NetworkAccessPointMBean.AllowUnencryptedNullCipher
Inbound Certificate Validation	Indicates the client certificate validation rules for inbound SSL. This attribute only applies to ports and network channels using 2-way SSL. MBean Attribute: NetworkAccessPointMBean.InboundCertificateValidation
Outbound Certificate Validation	Indicates the server certificate validation rules for outbound SSL. This attribute always applies to outbound SSL that is part of WebLogic Server (that is, an Administration Server talking to the Node Manager). It does not apply to application code in the server that is using outbound SSL unless the application code uses a weblogic.security.SSL.ServerTrustManager that is configured to use outbound SSL validation. MBean Attribute: NetworkAccessPointMBean.OutboundCertificateValidation