Select Configuration, and then Keystores.

Setting Up Your Environment for Policies 10-27 This section summarizes the steps required to configure SSL on WebLogic Server. For complete information, see Securing Oracle WebLogic Server. To configure two-way SSL: 1. In the left pane of the WebLogic Server Administration Console, expand Environment and select Servers. 2. Click the name of the server for which you want to configure SSL.

3. Select Configuration, and then the SSL page, and choose the location of identity

certificate and private key and trust trusted CAs for WebLogic Server. 4. Set SSL attributes for the private key alias and password.

5. At the bottom of the page, click Advanced.

6. Set Hostname Verification to None. 7. Indicate the number of times WebLogic Server can use an exportable key between a domestic server and an exportable client before generating a new key. The more secure you want WebLogic Server to be, the fewer times the key should be used before generating a new key. 8. Set the Use Server Certs control if needed. Setting this control determines whether a Web service client hosted on WebLogic Server should use the server certificateskey as the client identity when initiating a connection over HTTPS.

9. Set the Two Way Client Cert Behavior control to Client Certs Requested and

Enforced. 10. Specify the inbound and outbound SSL certificate validation methods. These options are available: ■ Builtin SSL Validation Only: Uses the built-in trusted CA-based validation. This is the default. ■ Builtin SSL Validation and Cert Path Validators: Uses the built-in trusted CA-based validation and uses configured CertPathValidator providers to perform extra validation. Configuring SSL for a Web Service Client The core WebLogic Server security subsystem uses private key and X.509 certificate pairs, stored in the default keystores, for SSL. You must ensure that the Web service client trusts the X.509 certificate that WebLogic Server uses to digitally sign the request. Do one of the following: 1. Ensure that WebLogic Server obtains a digital certificate that the client automatically trusts, because it has been issued by a trusted certificate authority. 2. Create a certificate registry that lists all the individual certificates trusted by WebLogic Server, and then ensure that the client trusts these registered certificates. To configure SSL for a Web service client: 1. Create a keystore used by the client application. Oracle recommends that you create one client keystore per application user. You can use the keytool utility to perform this step. For development purposes, the keytool utility is the easiest way to get started. 2. Create a private key and digital certificate pair, and load it into the client keystore. 10-28 Oracle Fusion Middleware Security and Administrators Guide for Web Services Make sure that the certificate’s key usage allows both encryption and digital signatures. Oracle requires a key length of 1024 bits or larger. 3. Make sure that the following properties are set in the clients JVM: ■ javax.net.ssl.trustStore -- The name of the file that contains the trust store. ■ javax.net.ssl.trustStoreType -- The type of KeyStore object that you want the default TrustManager to use. ■ javax.net.ssl.trustStorePassword -- The password for the KeyStore object that you want the default TrustManager to use. Configuring Two-Way SSL for a Web Service Client You must ensure that WebLogic Server is able to validate the X.509 certificate that the client uses to digitally sign its request, and that WebLogic Server in turn uses to encrypt its responses to the client. Do one of the following:

1. Ensure that the client application obtains a digital certificate that WebLogic Server

automatically trusts, because it has been issued by a trusted certificate authority.

2. Create a certificate registry that lists all the individual certificates trusted by

WebLogic Server, and then ensure that the client uses one of these registered certificates. To configure SSL for a Web service client:

1. Create a keystore used by the client application. Oracle recommends that you

create one client keystore per application user. You can use the keytool utility to perform this step. For development purposes, the keytool utility is the easiest way to get started.

2. Create a private key and digital certificate pair, and load it into the client keystore.

Make sure that the certificate’s key usage allows both encryption and digital signatures. Oracle requires a key length of 1024 bits or larger.

3. Make sure that the following properties are set in the clients JVM:

■ javax.net.ssl.trustStore -- The name of the file that contains the trust store. ■ javax.net.ssl.trustStoreType -- The type of KeyStore object that you want the default TrustManager to use. ■ javax.net.ssl.trustStorePassword -- The password for the KeyStore object that you want the default TrustManager to use. ■ javax.net.ssl.keyStore -- The name of the file that contains the KeyStore object. ■ javax.net.ssl.keyStoreType -- The type of KeyStore object. ■ javax.net.ssl.keyStorePassword -- The password for the KeyStore. Note: See Configuring SOA Composite Applications for Two-Way SSL Communication in Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle Business Process Management Suite for specific configuration steps when a SOA application is the Web service client over two-way SSL.