Setting up Keystore with the SSL Certificate and Private Key file of the Access Client

11-20 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management The certificate resides in the file cacert.der, which is located in the directory IAM_ ORACLE_HOME oamserverconfig. Execute the following command to import a PEMDER format CA certificate into the trust store. On Linux and UNIX-based systems, type: keytool -importcert -file IAM_ORACLE_HOMEoamserverconfigcacert.der -trustcacerts -keystore PathName_to_keystore -storetype JKS On Windows, type: keytool -import -file IAM_ORACLE_HOME\oam\server\config\cacert.der -trustcacerts -keystore PathName_to_keystore -storetype JKS Enter keystore password when prompted. Example: keytool -importcert -file IAM_ORACLE_HOMEoamserverconfigcacert.der -trustcacerts -keystore oamclient-truststore.jks -storetype JKS Sample output: Enter keystore password: Owner: CN=NetPoint Simple Security CA - Not for General Use, OU=NetPoint, O=Oblix, Inc., L=Cupertino, ST=California, C=US Issuer: CN=NetPoint Simple Security CA - Not for General Use, OU=NetPoint, O=Oblix, Inc., L=Cupertino, ST=California, C=US Serial number: 0 Valid from: Wed Apr 01 05:57:22 PDT 2009 until: Thu Mar 28 05:57:22 PDT 2024 Certificate fingerprints: MD5: 05:F4:8C:84:85:37:DB:E3:66:87:EF:39:E0:E6:B2:3F SHA1: 97:B0:F8:19:7D:0E:22:6B:40:2A:73:73:1B:27:B2:7B:8D:64:82:21 Signature algorithm name: MD5withRSA Version: 1 Trust this certificate? [no]: yes Certificate was added to keystore

11.11.3 Setting up Keystore with the SSL Certificate and Private Key file of the Access Client

An SSL certificate and private key were generated when you ran the idmConfigTool command in Section 11.6.2, Configuring Oracle Access Manager by Using the IDM Automation Tool. The SSL certificate and key are required for clients to communicate with Oracle Access Manager in Simple mode. The names of these files are, respectively, aaa_cert.pem and aaa_key.pem. They are located in the directory DOMAIN_HOME outputWebgate_IDM on IDMHOST1, where DOMAIN_HOME is the Administration Server Domain home. Execute the following commands to import the certificate and key file into the keystore oamclient-truststore.jsk. 1. Unzip the file importcert.zip, which is located in the directory: IAM_ORACLE_HOME oamservertoolsimportcert For example: cd IAM_ORACLE_HOMEoamservertoolsimportcert unzip importcert.zip 2. Execute the command: openssl pkcs8 -topk8 -nocrypt -in DOMAIN_HOMEoutputWebgate_IDMaaa_key.pem Extending the Domain with Oracle Access Manager 11g 11-21 -inform PEM -out aaa_key.der -outform DER The command prompts for a passphrase. Enter the password, which must be the global passphrase. This command creates the aaa_key.der file in the directory where the command is run Example: openssl pkcs8 -topk8 -nocrypt -in u01apporacleadminIDMDomainaserverIDMDomainoutputWebgate_IDMaaa_ key.pem -inform PEM -out aaa_key.der -outform DER Enter pass phrase for oamclient-truststore.jks: 3. Then execute: openssl x509 -in u01apporacleadminIDMDomainaserverIDMDomainoutputWebgate_IDMaaa_ cert.pem -inform PEM -out aaa_cert.der -outform DER This command creates the aaa_cert.der file in the directory where the command is run. This command does not generate any output. 4. Execute the command: java -cp IAM_ORACLE_HOMEoamservertoolsimportcertimportcert.jar oracle.security.am.common.tools.importcerts.CertificateImport -keystore ssoKeystore.jks -privatekeyfile aaa_key.der -signedcertfile aaa_cert.der -storetype jks -genkeystore yes This command creates the ssoKeystore.jks file in the directory where the command is run. In this command, aaa_key.der and aaa_cert.der are, respectively, the private key and certificate pair in DER format. Sample output: Enter keystore password as prompted. This MUST be same as global pass phrase. The files ssoKeystore.jks and oamclient-truststore.jks can now be used to allow clients to connect to OAM. 5. Add the CA certificate to the newly generated ssoKeystore.jks. On Linux or UNIX, type: keytool -importcert -file IAM_ORACLE_HOMEoamserverconfigcacert.der -trustcacerts -keystore PathName_to_keystore -storetype JKS On Windows, type: keytool -import -file IAM_ORACLE_HOME\oam\server\config\cacert.der -trustcacerts -keystore PathName_to_keystore -storetype JKS Enter keystore password when prompted. For example: keytool -importcert -file IAM_ORACLE_HOMEoamserverconfigcacert.der -trustcacerts -keystore ssoKeystore.jks -storetype JKS 11-22 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

11.12 Backing Up the Application Tier Configuration