From the SSL protocol version list, select the version of SSL to use. From the Web Cache menu, select Administration Ports Configuration.

5-12 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache The ssl.conf file specifies the SSL definitions for Oracle HTTP Server. If this entry is not removed, then keep-alive connections are disabled. See Section 2.11.5 for further information about configuring the keep-alive timeout in Oracle Web Cache.

5.4.5 Task 5: Restart Oracle Web Cache

See Section 2.13 .

5.4.6 Task 6: Perform Additional Configuration for Oracle WebLogic Servers

If the orgin server is an Oracle WebLogic Server, you need to specify an extra attribute for Oracle Web Cache to process SSL requests correctly: To configure Oracle Web Cache for a configuration in which the origin server is an Oracle WebLogic Server: 1. Use a text editor to open webcache.xml, located in: UNIX ORACLE_INSTANCEinstance_nameconfigWebCachewebcache_name Windows ORACLE_INSTANCE\instance_name\config\WebCache\webcache_name 2. Locate the HOST ID element. 3. Add the SERVERTYPE attribute to the CACHE element. For example: HOST ID=host_ID NAME=WLS_server_name PORT=WLS_server_port LOADLIMIT=100 OSSTATE=ON SERVERTYPE=WebLogic ... 4. Save webcache.xml. 5. Restart Oracle Web Cache with the following command: opmnctl restartproc ias-component=component_name This executable is found in the following directory: UNIX ORACLE_INSTANCEbin Windows ORACLE_INSTANCE\bin

5.5 Additional HTTPS Configuration

After performing the tasks in Section 5.4 , you can perform the following optional configuration: ■ Section 5.5.1, Configuring HTTPS Operation Ports ■ Section 5.5.2, Requiring Client-Side Certificates ■ Section 5.5.3, Configuring Certificate Revocation Lists CRLs

5.5.1 Configuring HTTPS Operation Ports

To configure HTTPS ports to listen for administration, invalidation, or statistics monitoring requests in Fusion Middleware Control: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 . 2. Create the listening port:

a. From the Web Cache menu, select Administration Ports Configuration.

Configuring Security 5-13 The Ports Configuration page displays.

b. Click Create.

The Create Port page appears.

c. From the Port Type list, select the port type, ADMINISTRATION,

INVALIDATION , or STATISTICS.

d. In the IP Address field, specify the computer running Oracle Web Cache:

- IP version 4 address written in a 32-bit dotted decimal notation or an IP version 6 address written in a 128-bit notation. See Section 2.5 . - A host name that resolves to an IP address of the computer running Oracle Web Cache. If you do not want to rely on Domain Name System DNS to resolve the host name, use a different name resolution mechanism, such as the UNIX etchosts file. - ANY to represent any IP address

e. In the Port field, enter the listening port from which Oracle Web Cache

receives client requests for the Web site. Ensure that this port number is not in use. Port numbers less than 1024 are reserved for use by privileged processes on UNIX. To configure Oracle Web Cache to listen on a port less than 1024, such as on port 80, run the Oracle Web Cache webcached executable with the root privilege. If the webcached executable is not run as root, Oracle Web Cache fails to start. See Section 5.9 for instructions on changing the webcached executable to run as root.

f. Click OK.

3. Enable the port for SSL:

a. From the Web Cache menu, select Security SSL Configuration.

The SSL Configuration page displays.

b. Select the row for the endpoint you created in Step 2 and click Edit.

The Edit Port page displays.

c. In the SSL Configuration section, click Enable SSL.

d. In the Server Wallet Name field, select the wallet you created in

Section 5.4.1 . e. In the Advanced SSL Settings section, click Expand + to expand the configuration settings:

f. From the SSL Authentication list, select the type of client authentication.

- Server Authentication: A server authenticates itself to a client. - Mutual Authentication: A client authenticates itself to a server and that server authenticates itself to the client. - No Authentication: Neither server nor client are required to authenticate. - Optional Client Authentication: The server authenticates itself to the client, but the client may or may not authenticate itself to the server. Even if the client does not authenticate itself, the SSL session still goes through.

g. From the SSL Protocol Version list, select the version of SSL to use.

5-14 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache

h. Click OK.

5.5.2 Requiring Client-Side Certificates

You can require that clients send certificates client-side certificates to the cache to verify the identity of the client. With client-side certificates, the client browser sends the certificate to the cache during the SSL handshake. Then, the server processes the request for the object. If the requested object is not stored in the cache, the cache forwards the request to the application Web server, a peer cache in a cluster, or a subordinate cache in a hierarchy. To transfer information about the client-side certificate to another cache or to the application Web server, Oracle Web Cache adds HTTP headers to the request. The headers begin with the string SSL-Client-Cert. Note the following points about using client-side certificates: ■ In a simple configuration client to cache to application Web server, the client sends the certificate to the cache during the SSL handshake. If the requested object is not stored in the cache, the cache forwards the request to the application Web server and transfers the client-side certificate information in headers to the application Web server. The application Web server recognizes the headers and responds to the request. ■ In a cluster, the client sends the certificate to a cache cluster member during the SSL handshake. If the requested object is not stored in that cache, the cluster member requests it from a peer the cluster member that owns the object. With client-side certificates, Oracle Web Cache must be able to pass the client-side certificate information in headers to the peer cluster member, and the peer must be able to pass the headers to the application Web server. ■ If a site requires client certificates, then a 403 Forbidden error returns if a client certificate is not provided. If a listen port requires client certificates, then the SSL handshake fails if a client certificate is not provided. The following topics describe how to configure client-side certificate settings: ■ Section 5.5.2.1, Configuring Client-Side Certificate Settings for the HTTPS Listening Ports ■ Section 5.5.2.2, Configuring Client-Side Certificate Settings for Cache Clusters ■ Section 5.5.2.3, Configuring Client-Side Certificate Settings for a Site

5.5.2.1 Configuring Client-Side Certificate Settings for the HTTPS Listening Ports

To use client-side certificates, you must enable an HTTPS listening port, as described in Section 5.4.2 . If you have a cache cluster, you must enable HTTPS listening ports for all cluster members. In addition, you must configure Oracle Web Cache to require client browsers to provide SSL certificates. Note: Oracle Web Cache supports the use of client-side certificates with Oracle HTTP Server only. Oracle Web Cache does not support client-side certificates with a distributed cache hierarchy because the security of the certificates cannot be guaranteed. Configuring Security 5-15 After configuring the client-side certificate, to enable Oracle Web Cache to transfer certificate information to Oracle HTTP Server, add the AddCertHeader directive to httpd.conf. See the Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server for information about adding the AddCertHeader directive.

5.5.2.2 Configuring Client-Side Certificate Settings for Cache Clusters

If you have a cache cluster, you must prevent a cache from accepting the certificate information in HTTP headers from any source other than a peer cluster member. In addition, each cache must be able to pass the client-side certificate information in headers to the peer cluster member, and the peer must be able to pass them to the application Web server. To configure this behavior in Oracle Web Cache Manager:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 .

2. In the Security Header Configuration section of the Security page, set the value of

Accept SSL client certificates encoded in SSL-Client-Cert HTTP headers to NO the default, so Oracle Web Cache does not accept the certificate information in HTTP headers. This setting prevents caches in a cache cluster from accepting the certificate information in HTTP headers.

3. In the Cluster Security Configuration section, set the value of the Route requests

that contain SSL client certificates to cache cluster peers to YES, enabling Oracle Web Cache to pass information about the client-side certificate in HTTP headers to a peer cache. This setting is used for caches in a cache cluster so that they can pass the information to a peer cache.

4. Click Apply Changes.

5. Restart Oracle Web Cache. See

Section 2.13 .

5.5.2.3 Configuring Client-Side Certificate Settings for a Site

You can also specify that an entire site require client-side certificates. If a site requires client certificates, then a 403 Forbidden error returns if a client certificate is not provided. To configure a site to use client-side certificates:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties Site

Definition . See Section 2.7.2 .

2. In the Site Definitions page, select the site and click ShowEdit Site.

3. In the ShowEdit dialog, in the Client-Side Certificate field, select Required.

4. Click Submit.

5. Restart Oracle Web Cache. See Section 2.13 .

5.5.3 Configuring Certificate Revocation Lists CRLs

Fusion Middleware Control or Oracle Web Cache Manager do not provide support for client certificate validation with Certificate Revocation Lists CRLs. You can configure this support by manually editing the webcache.xml file. Client certificate revocation status is checked against CRLs that are located in a file system directory. Typically, CRL definitions are valid for a few days, and must be updated on a regular basis. Whenever the CRL definitions are modified, you must restart Oracle Web Cache.