Generating Self-Signed Certificates Using the utils.CertGen Utility

Setting Up Node Manager 16-3

16.3.1 Generating Self-Signed Certificates Using the utils.CertGen Utility

The certificates added in this chapter as an example address a configuration where Node Manager listens on a physical host name HOST.mycompany.com and a WebLogic Managed Server listens on a virtual host name VIP.mycompany.com. Whenever a server is using a virtual host name, it is implied that the server can be migrated from one node to another. Consequently, the directory where keystores and trust keystores are maintained ideally must reside on a shared storage that is accessible from the failover. If additional host names are used in the same or different nodes, the steps in this example must be extended to:

1. Add the required host names to the certificate stores if they are different from

HOST.mycompany.com and VIP.mycompany.com.

2. Change the identity and trust store location information for Node Manager if the

additional host names are used by Node Manager or for the servers if the additional host names are used by Managed Servers. Follow these steps to create self-signed certificates on HOST. These certificates should be created using the network name or alias. For information on using trust CA certificates instead, see Configuring Identity and Trust in Oracle Fusion Middleware Securing Oracle WebLogic Server. The following examples configure certificates for HOST.mycompany.com and VIP.mycompany.com; that is, it is assumed that both a physical host name HOST and a virtual host name VIP are used in HOST. It is also assumed that HOST.mycompany.com is the address used by Node Manager and VIP.mycompany.com is the address used by a Managed Server or the Administration Server. This is the common situation for nodes hosting an Administration Server and a Fusion Middleware component, or for nodes where two Managed Servers coexist with one server listening on the physical host name and one server using a virtual host name which is the case for servers that use migration servers. 1. Set up your environment by running the WL_HOMEserverbinsetWLSEnv.sh script. In the Bourne shell, run the following commands: HOST cd WL_HOMEserverbin HOST .setWLSEnv.sh Verify that the CLASSPATH environment variable is set: HOST echo CLASSPATH 2. Create a user-defined directory for the certificates. For example, create a directory called certs under the ORACLE_BASEadmindomain_ name aserverdomain_name directory. Note that certificates can be shared across WebLogic domains. HOST cd ORACLE_BASEadmindomain_nameaserverdomain_name HOST mkdir certs

3. Change directory to the directory that you just created:

Note: The directory where keystores and trust keystores are maintained must be on shared storage that is accessible from all nodes so that when the servers fail over manually or with server migration, the appropriate certificates can be accessed from the failover node. Oracle recommends using central or shared stores for the certificates used for different purposes like SSL set up for HTTP invocations, for example. 16-4 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management HOST cd certs 4. Run the utils.CertGen tool from the user-defined directory to create the certificates for both HOST. mycompany.com and VIP. mycompany.com. Syntax all on a single line: java utils.CertGen Key_Passphrase Cert_File_Name Key_File_Name [export | domestic] [Host_Name] Examples: IDMHOST1 java utils.CertGen Key_Passphrase IDMHOST1.mycompany.com_cert IDMHOST1.mycompany.com_key domestic IDMHOST1.mycompany.com IDMHOST2 java utils.CertGen Key_Passphrase IDMHOST2.mycompany.com_cert IDMHOST2.mycompany.com_key domestic IDMHOST2.mycompany.com IDMHOST2 java utils.CertGen Key_Passphrase ADMVHN.mycompany.com_cert ADMVHN.mycompany.com_key domestic ADMVHN.mycompany.com

16.3.2 Creating an Identity Keystore Using the utils.ImportPrivateKey Utility