Deploying SSL Certificates on Oracle Weblogic

Setting up SSL Certificates on Apache or IIS has become common place and a fairly straightforward implementation. Increasingly though, we have customers asking for SSL implementations on Oracle Weblogic, which is a tricky and sometimes complex task.

Oracle Weblogic uses the Java Keystore architecture to manage and deploy SSL Certificates. In this blog, I will describe the process of creating and deploying SSL Certificates on Oracle Weblogic.

1 Launch Command Shell/Terminal

2 Set Weblogic Environment

Example on Windows would be:

<middleware_home>\wlserver_10.3\server\bin\setWLSenv.cmd

Example on Linux/Unix would be:

<middleware_home>/wlserver_10.3/server/bin/setWLSenv.sh

3 Create Certificate Request with Keystore and Keyfile

keytool -genkey -alias portal -keyalg RSA -keysize 2048 -keypass <yourkeypass> -keystore identity.jks -storepass <yourstorepass>
What is your first and last name?
  [Unknown]:  www.example.com
What is the name of your organizational unit?
  [Unknown]:
What is the name of your organization?
  [Unknown]:  Example Corp
What is the name of your City or Locality?
  [Unknown]:  Town
What is the name of your State or Province?
  [Unknown]:  State
What is the two-letter country code for this unit?
  [Unknown]:  US
Is CN=www.example.com, OU=Unknown, O=Example Corp, L=Town, ST=State, C=US correct?
  [no]:  yes

4 Export Certificate Request to send to Signing Authority

keytool -certreq -alias portal -keystore identity.jks -file portal.csr

5 Get CSR signed by Authority (eg. GoDaddy)

At this point you will need to take your portal.csr file and have it signed by a Certificate Authority. This process can vary depending on the Authority chosen.

CSR should look something like:

6 Concatenate Certificate with Root Certificate(s) into 1 file

Your Signed Cert + CA Intermediate(s) + CA Root

You may have to download the CA Root and Intermediate Certs from the Authority if you did not get them with your Cert package.

EG (https://certs.godaddy.com/repository)

Full Certificate should look similar to this:

Save file as: fullcert.crt

7 Import Full Cert into identity.jks Keystore

keytool -import -trustcacerts -alias portal -file fullcert.crt -keystore identity.jks

8 Create Empty Trust Store

This Trust Store will be used to store the Root and Intermediate certificates alone

keytool -genkey -keyalg RSA -alias dummy -keystore truststore.jks

## Answers DO NOT MATTER you will delete this dummy record next

What is your first and last name?
[Unknown]:
What is the name of your organizational unit?
[Unknown]:
What is the name of your organization?
[Unknown]:
What is the name of your City or Locality?
[Unknown]:
What is the name of your State or Province?
[Unknown]:
What is the two-letter country code for this unit?
[Unknown]:
Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct?
[no]:  yes

Enter key password for <dummy>
(RETURN if same as keystore password):
Re-enter new password:

8 Delete the DUMMY record

Here we remove the “dummy” alias before importing the Trust chain in the next step.

keytool -delete -alias dummy -keystore truststore.jks

9 Import the Trust Cert Chain only from the CRT format

CA Intermediate(s) + CA Root

keytool -import -alias root -file gd_root.crt -keystore truststore.jks

10 Save Files

Save JKS Keystores to your file system:

Example C:\Oracle\keystores\

11 In Weblogic Console -> Server <my server>

Set SSL Listen Port to 443 and disable Listen port for 80 (if you want to force the server to SSL only)

12 In Weblogic Console -> Server <my server>

Keystore Tab -> Change to Custom Identity and Trust

For Identity set:

Custom Identity Keystore == C:\Oracle\keystore\identity.jks
Custom Identity Keystore Type == JKS
Custom Identity Keystore Passphrase == <my password>

For Trust set:

Custom Trust Keystore == C:\Oracle\keystore\truststore.jks
Custom Trust Keystore Type == JKS
Custom Trust Keystore Passphrase == <my password>

13 In Weblogic Console -> Server <my server>

In SSL Tab

Set Private Key Alias == portal
Set Private Key Passphrase == <my password>

In the Advanced Section set Use JSSE SSL on

Posts