Configuring Access Control Oracle Fusion Middleware Online Documentation Library

Configuring Security 5-9

5.4.1 Task 1: Create Wallets

To support HTTPS for Oracle Web Cache, you must create a wallet on the Oracle Web Cache server for each supported site. You need wallets to support the following HTTPS requests: ■ Client requests for sites hosted by Oracle Web Cache ■ Administration, invalidation, and statistics monitoring requests to Oracle Web Cache ■ Oracle Web Cache requests to origin servers, as well as admin server process requests for requests to invalidation and statistics monitoring ports enabled for SSL For each site that Oracle Web Cache supports, configure at least one wallet. You specify the location of the wallet for each of the Oracle Web Cache HTTPS listening and operations ports to support incoming HTTPS requests, and the origin server to support outgoing HTTPS requests. You can share one wallet, or you can create separate wallets. If you use the same wallet, keep in mind that it can support only one server-side certificate. To create a wallet:

1. Navigate to the Web Cache Home page in Fusion Middleware Control. See

Section 2.6.2 .

2. From the Web Cache menu, select Security and then Wallets.

The Wallets page displays.

3. Perform the tasks in section Create a Wallet of the Oracle Fusion Middleware

Administrators Guide.

5.4.2 Task 2: Configure an HTTPS Listening Port

To configure HTTPS protocol support between client and Oracle Web Cache, you must configure an HTTPS listening port for Oracle Web Cache. To add an HTTPS listening port: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 . 2. Create the listening port:

a. From the Web Cache menu, select Administration Ports Configuration.

The Ports Configuration page displays.

b. Click Create.

The Create Port page appears.

c. From the Port Type list, select NORM.

d. In the IP Address field, specify the computer running Oracle Web Cache:

- IP version 4 address written in a 32-bit dotted decimal notation or an IP version 6 address written in a 128-bit notation. See Section 2.5 . - A host name that resolves to an IP address of the computer running Oracle Web Cache. If you do not want to rely on Domain Name System DNS to resolve the host name, use a different name resolution mechanism, such as the UNIX etchosts file. 5-10 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache - ANY to represent any IP address

e. In the Port field, enter the listening port from which Oracle Web Cache

receives client requests for the Web site. Ensure that this port number is not in use. Port numbers less than 1024 are reserved for use by privileged processes on UNIX. To configure Oracle Web Cache to listen on a port less than 1024, such as on port 80, run the Oracle Web Cache webcached executable with the root privilege. If the webcached executable is not run as root, Oracle Web Cache fails to start. See Section 5.9 for instructions on changing the webcached executable to run as root.

f. Click OK.

3. Enable the port for SSL:

a. From the Web Cache menu, select Security SSL Configuration.

The SSL Configuration page displays.

b. Select the row for the endpoint you created in Step 2 and click Edit.

The Edit Port page displays.

c. In the SSL Configuration section, click Enable SSL.

d. In the Server Wallet Name field, select the wallet you created in

Section 5.4.1 . e. In the Advanced SSL Settings section, click Expand + to expand the configuration settings:

f. From the Client Authentication list, select the type of client authentication.

- Server Authentication: A server authenticates itself to a client. - Mutual Authentication: A client authenticates itself to a server and that server authenticates itself to the client. - No Authentication: Neither server nor client are required to authenticate. - Optional Client Authentication: The server authenticates itself to the client, but the client may or may not authenticate itself to the server. Even if the client does not authenticate itself, the SSL session still goes through.

g. From the SSL protocol version list, select the version of SSL to use.

- All: This selection enables the v1, v3, and v3-v2Hello options. - v1: This selection supports TLS version 1 traffic. - v3: This selection provides SSL version 3 traffic. - v3_v2Hello: This selection combines the SSL version 2 hello message format with SSL version 3 handling to support SSL version upgrade during handshake operations.

h. Click OK.