How SSL Sessions Are Conducted

Configuring SSL in Oracle Fusion Middleware 6-7 b. Section 6.5.1.2.3, Outbound SSL from LDAP Authenticator to LDAP 7. Section 6.6.1.1, Enable Inbound SSL on an Oracle Internet Directory Listener Using Fusion Middleware Control and Section 6.6.1.2, Enabling Inbound SSL on an Oracle Internet Directory Listener Using WLST 8. Section 6.6.3.2, SSL-Enable a Data Source 9. Section 6.6.3.1, SSL-Enable Oracle Database 10. Section 6.5.6, Client-Side SSL for Applications 11. Section 6.5.2, Configuring SSL for Oracle SOA Suite 12. Section 6.5.3, Configuring SSL for Oracle WebCenter 13. Section 6.3.3, WLST Command-Line Tool 14. Section 6.6.1.3, Enabling Outbound SSL from Oracle Internet Directory to Oracle Database 15. Section 6.6.3.1, SSL-Enable Oracle Database In addition, you can configure SSL for identity management components. For details, see: ■ Section 6.5.4.1, Configuring SSL for Oracle Directory Integration Platform ■ Section 6.5.4.2, Configuring SSL for Oracle Identity Federation ■ Section 6.5.4.3, Configuring SSL for Oracle Directory Services Manager Keystores and Wallets Keystores and wallets are central to SSL configuration and are used to store certificates and keys. For details, see Section 6.2.2, Keystores and Oracle Wallets.

6.2.2 Keystores and Oracle Wallets

Oracle Fusion Middleware supports two types of keystores for keys and certificates: ■ JKS-based keystore and truststore ■ Oracle wallet In 11g Release 1 11.1.1, all Java components and applications use the JKS keystore. Thus all Java components and applications running on Oracle WebLogic Server use the JKS-based KeyStore and TrustStore. The following system components continue to use the Oracle wallet: ■ Oracle HTTP Server ■ Oracle Web Cache ■ Oracle Internet Directory You can use Fusion Middleware Control or the command-line WLST and orapki interfaces, to manage wallets and their certificates for these system components. You can use either the Fusion Middleware Control or WLST to SSL-enable the listeners for these components. Oracle Virtual Directory uses a JKS-based keystore. You can use Fusion Middleware Control or WLST to manage JKS keystores and their certificates for Oracle Virtual 6-8 Oracle Fusion Middleware Administrators Guide Directory. You can use either the Fusion Middleware Control or WLST to SSL-enable the listeners for Oracle Virtual Directory. JDKs keytool utility manages the keystore used by Oracle WebLogic Server listeners for Java EE applications. This is the only keystore tool to manage these keystores; no graphical user interface is available for this purpose. For more information about these types of stores, and when to use which type of store, see Section 6.1.3, Keystores and Wallets .

6.2.3 Authentication Modes

The following authentication modes are supported: ■ In no-authentication mode, neither server nor client are required to authenticate. Other names for this mode include Anonymous SSLNo AuthenticationDiffie-Hellman. ■ In server authentication mode, a server authenticates itself to a client. This mode is also referred to as One-way SSLServer Authentication. ■ In mutual authentication mode, a client authenticates itself to a server and that server authenticates itself to the client. This mode is also known as Two-way SSLClient Authentication. ■ In optional client authentication mode, the server authenticates itself to the client, but the client may or may not authenticate itself to the server. Even if the client does not authenticate itself, the SSL session still goes through.

6.2.4 Tools for SSL Configuration

Oracle Fusion Middleware uses two kinds of configuration tools, common and advanced. Common Tools ■ Fusion Middleware Control ■ WLST command-line interface ■ Oracle WebLogic Server Administration Console ■ keytool command-line tool These tools allow you to configure SSL and manage Oracle WalletJKS keystore for any listener or component in Oracle Fusion Middleware. Advanced Tools ■ Oracle Wallet Manager graphical user interface ■ orapki command-line interface These tools allow you to configure advanced features like managing file-based CRLs, PKCS11-based wallets, and so on. See Also: Section 8.1, Key and Certificate Storage in Oracle Fusion Middleware for keystore management See Also: Section 8.1, Key and Certificate Storage in Oracle Fusion Middleware for keystore management