At the bottom of the page, click Advanced.

10-28 Oracle Fusion Middleware Security and Administrators Guide for Web Services Make sure that the certificate’s key usage allows both encryption and digital signatures. Oracle requires a key length of 1024 bits or larger. 3. Make sure that the following properties are set in the clients JVM: ■ javax.net.ssl.trustStore -- The name of the file that contains the trust store. ■ javax.net.ssl.trustStoreType -- The type of KeyStore object that you want the default TrustManager to use. ■ javax.net.ssl.trustStorePassword -- The password for the KeyStore object that you want the default TrustManager to use. Configuring Two-Way SSL for a Web Service Client You must ensure that WebLogic Server is able to validate the X.509 certificate that the client uses to digitally sign its request, and that WebLogic Server in turn uses to encrypt its responses to the client. Do one of the following:

1. Ensure that the client application obtains a digital certificate that WebLogic Server

automatically trusts, because it has been issued by a trusted certificate authority.

2. Create a certificate registry that lists all the individual certificates trusted by

WebLogic Server, and then ensure that the client uses one of these registered certificates. To configure SSL for a Web service client:

1. Create a keystore used by the client application. Oracle recommends that you

create one client keystore per application user. You can use the keytool utility to perform this step. For development purposes, the keytool utility is the easiest way to get started.

2. Create a private key and digital certificate pair, and load it into the client keystore.

Make sure that the certificate’s key usage allows both encryption and digital signatures. Oracle requires a key length of 1024 bits or larger.

3. Make sure that the following properties are set in the clients JVM:

■ javax.net.ssl.trustStore -- The name of the file that contains the trust store. ■ javax.net.ssl.trustStoreType -- The type of KeyStore object that you want the default TrustManager to use. ■ javax.net.ssl.trustStorePassword -- The password for the KeyStore object that you want the default TrustManager to use. ■ javax.net.ssl.keyStore -- The name of the file that contains the KeyStore object. ■ javax.net.ssl.keyStoreType -- The type of KeyStore object. ■ javax.net.ssl.keyStorePassword -- The password for the KeyStore. Note: See Configuring SOA Composite Applications for Two-Way SSL Communication in Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle Business Process Management Suite for specific configuration steps when a SOA application is the Web service client over two-way SSL. Setting Up Your Environment for Policies 10-29 Configuring SSL on Oracle HTTP Server The HTTPS protocol uses an industry standard protocol called Secure Sockets Layer SSL to establish secure connections between clients and servers. You can use the HTTPSSSL support offered by the Oracle HTTP Server as one of the communication protocols to communicate between the client and the Web service. This section describes how to set up a Web service client and a Web service using Oracle WSM policies to send requests over SSL. Oracle HTTP Server is configured as a Web proxy that intermediates between the client and Oracle WebLogic Server. SSL is enabled at Oracle HTTP Server and SSL transport is turned on between the client and Oracle HTTP Server. Communication remains non-SSL between Oracle HTTP Server and WebLogic Server. This section describes how to configure the policies that require one-way SSL and two-way SSL. For more information, see: ■ Configuring SSL in Oracle Fusion Middleware, in Oracle Fusion Middleware Administrators Guide ■ Configuring SSL in Securing Oracle WebLogic Server ■ Set Up SSL in the Oracle WebLogic Server Administration Console Help ■ Configuring Secure Sockets Layer in Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server One-Way SSL For more information on the Oracle WSM policies that require one-way SSL configuration, see Which Policies Require You to Configure SSL? on page 10-23. To use one-way SSL, you need to: 1. Configure the Oracle HTTP Server as follows: a. In the file ORACLE_INSTANCEconfigOHSohs_namessl.conf, configure Oracle HTTP Server as a Web proxy and specify the list of URLs you want to access, as shown in Example 10–1 . Example 10–1 Specifying URLs in ssl.conf added properties for configuring OHS as webproxy IfModule weblogic_module WebLogicHost host WebLogicPort port SecureProxy Off WlProxySSL On Debug ALL WlLogFile tmpweblogic.log the location attributes list the urls you want to access via OHS Location myWlsService SetHandler weblogic-handler WebLogicHost host WeblogicPort port Location b. In the same file, set the following properties under virtual host configuration to ensure the client certificate information is sent to WebLogic Server: SSLVerifyClient optional