Configuring SSL for Listeners Using WLST

Creating and Managing Oracle Virtual Directory Listeners 11-25 setKeyStorePassword,java.lang.StringPASSWORD.toCharArray setTrustStorePassword,java.lang.StringPASSWORD.toCharArray 11. Configure the SSL settings for the Listener using the following command and file.prop. An sample file.prop file is given for reference: configureSSL instance1, ovd1, ovd, LDAP SSL Endpoint, PATH_TO_ file.prop Example 11–1 Sample file.prop File SSLEnabled=true AuthenticationType=auth_type SSLVersions=version Ciphers=cipher KeyStore=name_of_your_keystore TrustStore=name_of_your_keystore Important Notes Regarding the file.prop File: ■ Replace the variable values in the Example 11–1 with the values for your environment. ■ If you are configuring the Listener for SSL No-Auth mode, you must select at least one DH_anon cipher. For all other SSL modes, you must select at least one RSA cipher. ■ You must specify the value of the KeyStore parameter when configuring SSL for server-auth and mutual-auth modes. ■ If you specify only AES ciphers, the SSLVersions parameter must contain TLSv1. Note: If you configure a different keystore or change the certificate in the keystore for the Admin Gateway Listener or the LDAP SSL Endpoint Listener, you must import the certificate into the Oracle Enterprise Manager Fusion Middleware Control Agent’s wallet. If you do not import the certificate, Oracle Enterprise Manager Fusion Middleware Control cannot connect to Oracle Virtual Directory to retrieve performance metrics. To import the certificate into the Oracle Enterprise Manager Fusion Middleware Control Agent’s wallet: 1. Export the Oracle Virtual Directory server certificate by executing the following command: ORACLE_HOME jdkjrebinkeytool -exportcert \ -keystore OVD_KEYSTORE_FILE -storepass PASSWORD \ -alias OVD_SERVER_CERT_ALIAS -rfc \ -file OVD_SERVER_CERT_FILE 2. Add the Oracle Virtual Directory server certificate to the Oracle Enterprise Manager Fusion Middleware Control Agent’s Wallet by executing the following command: ORACLE_COMMON_HOME binorapki wallet add -wallet \ ORACLE_INSTANCEEMAGENTEMAGENTsysmanconfigmonwallet \ -trusted_cert -cert OVD_SERVER_CERT_FILE -pwd WALLET_PASSWORD 11-26 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory ■ The text in the file.prop file is case sensitive. ■ Do not use spaces after cipher entries in the file.prop file. ■ Refer to the Properties Files for SSL section in the Oracle Fusion Middleware Administrators Guide for more information about the contents of the file.prop file. 12. Save your changes and then refresh the MBean. For example: cd.... cdoracle.as.management.mbeans.register cdoracle.as.management.mbeans.register:type=component,name=ovd1,instance=asin st1 invokesave,jarray.array[],java.lang.Object,jarray.array[],java.lang.Strin g invokeload,jarray.array[],java.lang.Object,jarray.array[],java.lang.Strin g 13. Stop Oracle Virtual Directory if it is running. After it stops, start Oracle Virtual Directory.

11.6.3 Validating the SSL Connection

This topic explains how to validate SSL connections for each SSL mode and contains the following sections: ■ SSL No-Authentication Mode ■ SSL Server Auth Mode ■ SSL Mutual Authentication Mode See Also: The following sections for information about the AuthenticationType, SSLVersions, and Ciphers you can configure in File.prop: ■ Configuring Admin Listener Settings Using WLST on page 11-12 ■ Configuring LDAP Listener Settings Using WLST on page 11-14 ■ Configuring HTTP Listener Settings Using WLST on page 11-17 Note: You must explicitly stop and start Oracle Virtual Directory—not Restart—to load the Listener configuration to the Oracle Virtual Directory server. Note: If you are using default settings after installing 11g Release 1 11.1.1, you can use the following values for the following variables described in this section: ■ For OVD_KEY_STORE_FILE, use: ORACLE_INSTANCEconfigOVDovd1keystoreskeys.jks ■ For OVD_SERVER_CERT_ALIAS, use serverselfsigned ■ For PASSWORD used for the -storepass and -jkspwd options, use the same password as orcladmin Creating and Managing Oracle Virtual Directory Listeners 11-27

11.6.3.1 SSL No-Authentication Mode

To validate a connection secured by SSL No-Authentication mode, execute the following command: ORACLE_HOME binldapbind -D cn=orcladmin -q -U 1 -h HOST -p SSL_PORT

11.6.3.2 SSL Server Auth Mode

To validate a connection secured by SSL Server Authentication mode, perform the following steps: 1. Create an Oracle Wallet by executing the following command: ORACLE_COMMON_HOME binorapki wallet create -wallet DIRECTORY_FOR_SSL_WALLET \ -pwd WALLET_PASSWORD 2. Export the Oracle Virtual Directory server certificate by executing the following command: ORACLE_HOME jdkjrebinkeytool -exportcert -keystore OVD_KEYSTORE_FILE \ -storepass PASSWORD -alias OVD_SERVER_CERT_ALIAS -rfc \ -file OVD_SERVER_CERT_FILE 3. Add the Oracle Virtual Directory server certificate to the Oracle Wallet by executing the following command: ORACLE_COMMON_HOME binorapki wallet add -wallet DIRECTORY_FOR_SSL_WALLET \ -trusted_cert -cert OVD_SERVER_CERT_FILE -pwd WALLET_PASSWORD 4. Use the Oracle Wallet from step 3 while executing the following command: ORACLE_HOME binldapbind -D cn=orcladmin -q -U 2 -h HOST -p SSL_PORT \ -W file:DIRECTORY_FOR_SSL_WALLET -Q

11.6.3.3 SSL Mutual Authentication Mode

To validate a connection secured by SSL Mutual Authentication mode, perform the following steps: 1. Create an Oracle wallet by executing the following command: ORACLE_COMMON_HOME binorapki wallet create -wallet DIRECTORY_FOR_SSL_WALLET \ -pwd WALLET_PASSWORD 2. Transform the Oracle Virtual Directory keystore file to an Oracle Wallet by executing the following command: ORACLE_COMMON_HOME binorapki wallet jks_to_pkcs12 \ -wallet DIRECTORY_FOR_SSL_WALLET -pwd WALLET_PASSWORD \ -keystore ORACLE_INSTANCEconfigOVDOVD_COMPONENTkeystoreskeys.jks \ -jkspwd PASSWORD 3. Export the client certificate in Base64 format by executing the following command: ORACLE_COMMON_HOME binorapki wallet export -wallet . -dn CLIENT_DN \ -cert .b64certificate.txt 4. Import the client certificate you created in step 2 into the Oracle Virtual Directory keystore as a trusted entry by executing the following command: ORACLE_HOME jdkjrebinkeytool -importcert \ -keystore ORACLE_INSTANCEconfigOVDOVD_COMPONENTkeystoreskeys.jks 11-28 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory -storepass JKS_PASSWORD -alias ALIAS -file b64certificate.txt -noprompt 5. Verify the SSL connection using the bind DN of the client certificate by executing the following command: ORACLE_HOME binldapbind -U 3 -h HOST -p SSL_PORT -W file:DIRECTORY_FOR_SSL_ WALLET -Q