Keystores and Wallets How SSL Works

6-6 Oracle Fusion Middleware Administrators Guide

6.2.1 SSL in the Oracle Fusion Middleware Architecture

Figure 6–2 SSL in Oracle Fusion Middleware In the Oracle Fusion Middleware architecture shown in Figure 6–2 , the numbered circles represent the endpoints that can be SSL-enabled. For configuration details about each endpoint, see: 1. Section 6.4.2.1, Enable Inbound SSL for Oracle Web Cache Using Fusion Middleware Control and Section 6.4.2.2, Enable Inbound SSL for Oracle Web Cache Using WLST 2. Section 6.4.2.3, Enable Outbound SSL for Oracle Web Cache Using Fusion Middleware Control and Section 6.4.2.4, Specify the Wallet for Outbound SSL from Oracle Web Cache Using WLST 3. Section 6.4.3.1, Enable SSL for Inbound Requests to Oracle HTTP Server Virtual Hosts Using Fusion Middleware Control and Section 6.4.3.2, Enable SSL for Inbound Requests to Oracle HTTP Server Virtual Hosts Using WLST 4. Section 6.4.3.3, Enable SSL for Outbound Requests from Oracle HTTP Server 5. Section 6.5.1.1, Inbound SSL to Oracle WebLogic Server 6. Outbound connections to the LDAP server can originate from Oracle Platform Security Services or from Oracle WebLogic Server: a. Section 6.5.1.2.1, Outbound SSL from Oracle Platform Security Services to LDAP Notes: ■ In Figure 6–2 , the label Oracle Enterprise Manager refers to the Fusion Middleware Control user interface. ■ Other administrative tools, such as opmn, are available for specific tasks. Configuring SSL in Oracle Fusion Middleware 6-7 b. Section 6.5.1.2.3, Outbound SSL from LDAP Authenticator to LDAP 7. Section 6.6.1.1, Enable Inbound SSL on an Oracle Internet Directory Listener Using Fusion Middleware Control and Section 6.6.1.2, Enabling Inbound SSL on an Oracle Internet Directory Listener Using WLST 8. Section 6.6.3.2, SSL-Enable a Data Source 9. Section 6.6.3.1, SSL-Enable Oracle Database 10. Section 6.5.6, Client-Side SSL for Applications 11. Section 6.5.2, Configuring SSL for Oracle SOA Suite 12. Section 6.5.3, Configuring SSL for Oracle WebCenter 13. Section 6.3.3, WLST Command-Line Tool 14. Section 6.6.1.3, Enabling Outbound SSL from Oracle Internet Directory to Oracle Database 15. Section 6.6.3.1, SSL-Enable Oracle Database In addition, you can configure SSL for identity management components. For details, see: ■ Section 6.5.4.1, Configuring SSL for Oracle Directory Integration Platform ■ Section 6.5.4.2, Configuring SSL for Oracle Identity Federation ■ Section 6.5.4.3, Configuring SSL for Oracle Directory Services Manager Keystores and Wallets Keystores and wallets are central to SSL configuration and are used to store certificates and keys. For details, see Section 6.2.2, Keystores and Oracle Wallets.

6.2.2 Keystores and Oracle Wallets

Oracle Fusion Middleware supports two types of keystores for keys and certificates: ■ JKS-based keystore and truststore ■ Oracle wallet In 11g Release 1 11.1.1, all Java components and applications use the JKS keystore. Thus all Java components and applications running on Oracle WebLogic Server use the JKS-based KeyStore and TrustStore. The following system components continue to use the Oracle wallet: ■ Oracle HTTP Server ■ Oracle Web Cache ■ Oracle Internet Directory You can use Fusion Middleware Control or the command-line WLST and orapki interfaces, to manage wallets and their certificates for these system components. You can use either the Fusion Middleware Control or WLST to SSL-enable the listeners for these components. Oracle Virtual Directory uses a JKS-based keystore. You can use Fusion Middleware Control or WLST to manage JKS keystores and their certificates for Oracle Virtual