Using Your Own Certificate Authority Converting a Microsoft p7b Format to PEM Format

Configuring Identity and Trust 11-9

11.4.1.3 Using Your Own Certificate Authority

Many companies act as their own certificate authority. To use those trusted CA certificates with WebLogic Server:

1. Ensure the trusted CA certificates are in PEM format.

■ If the trusted CA certificate is in DER format, use the der2pem utility to convert them. ■ If the trusted CA certificate was issued by Microsoft, see Section 11.4.1.4, Converting a Microsoft p7b Format to PEM Format. ■ If the trusted CA certificate has a custom file type, use the steps in Section 11.4.1.4, Converting a Microsoft p7b Format to PEM Format, to convert the trusted CA certificate to PEM format.

2. Create a trust keystore and store the trusted CA certificate in it. For more

information, see Section 11.4.2, Storing Private Keys, Digital Certificates, and Trusted Certificate Authority Certificates.

3. Configure WebLogic Server to use the trust keystore. For more information, see

Section 11.4.3.1, Configuring Keystores for Production.

11.4.1.4 Converting a Microsoft p7b Format to PEM Format

Digital certificates issued by Microsoft are in a format p7b that cannot be used by WebLogic Server. The following example converts a digital certificate in p7b PKCS7 format to PEM format on Windows XP: 1. In Windows Explorer, select the file filename.p7b you want to convert. Double-click on the file to display a Certificates window. 2. In the left pane of the Certificates window, expand the file. 3. Expand the Certificates folder to display a list of certificates. 4. Select a certificate to convert to PEM format. Right-click on the certificate, then choose All Tasks Export to display the Certificate Export Wizard.

5. In the wizard, click Next.

6. Select the Base-64 encoded X.509 .CER option. Then click Next. Base-64

encoded is the PEM format.

7. In the File name field, enter a name for the converted digital certificate; then click

Next . 8. Verify that the settings are correct. If the settings are correct, click Finish; if they are not correct, click Back and make any necessary modifications. Note: Oracle does not recommend using the demo certificates or turning off host name verification in a production environment. Note: The wizard appends a .cer extension to the output file. The .cer extension is a generic extension which is appended to both base-64 encoded certificates and DER certificates. You can change the extension to .pem after you exit the wizard. 11-10 Securing Oracle WebLogic Server

11.4.1.5 Obtaining a Digital Certificate for a Web Browser