SSL: An Introduction One-Way and Two-Way SSL

12 Configuring SSL 12-1 12 Configuring SSL Configuring SSL is an optional step; however, Oracle recommends SSL for production environments. The following sections describe how to configure SSL for WebLogic Server. ■ Section 12.1, SSL: An Introduction ■ Section 12.2, One-Way and Two-Way SSL ■ Section 12.3, Java Secure Socket Extension JSSE SSL Implementation Supported ■ Section 12.4, Setting Up SSL: Main Steps ■ Section 12.5, Using Host Name Verification ■ Section 12.6, SSL Debugging ■ Section 12.7, SSL Session Behavior ■ Section 12.8, Configuring RMI over IIOP with SSL ■ Section 12.9, SSL Certificate Validation ■ Section 12.10, Using the nCipher JCE Provider with WebLogic Server ■ Section 12.11, Specifying the Version of the SSL Protocol ■ Section 12.12, Using the JSSE-Based SSL Implementation

12.1 SSL: An Introduction

Secure Sockets Layer SSL provides secure connections by allowing two applications connecting over a network to authenticate each others identity and by encrypting the data exchanged between the applications. Authentication allows a server and optionally a client to verify the identity of the application on the other end of a network connection. Encryption makes data transmitted over the network intelligible only to the intended recipient. SSL in WebLogic Server is an implementation of the SSL 3.0 and Transport Layer Security TLS 1.0 specifications. Note: The following sections apply to WebLogic Server deployments that use the security features in this release of WebLogic Server as well as deployments that use Compatibility Security. All machines must be kept up to date with the current set of recommended patches from the operating system vendors. 12-2 Securing Oracle WebLogic Server WebLogic Server supports SSL on a dedicated listen port which defaults to 7002. To establish an SSL connection over HTTP, a Web browser connects to WebLogic Server by supplying the SSL listen port and the HTTPs protocol in the connection URL, for example, https:myserver:7002. Using SSL is compute intensive and adds overhead to a connection. Avoid using SSL in development environments when it is not necessary. However, always use SSL in a production environment.

12.2 One-Way and Two-Way SSL

SSL can be configured one-way or two-way: ■ With one-way SSL, the server must present a certificate to the client, but the client is not required to present a certificate to the server. The client must authenticate the server, but the server accepts a connection from any client. One-way SSL is common on the Internet where customers want to create secure connections before they share personal data. Often, clients will also use SSL to log on in order that the server can authenticate them. ■ With two-way SSL SSL with client authentication, the server presents a certificate to the client and the client presents a certificate to the server. WebLogic Server can be configured to require clients to submit valid and trusted certificates before completing the SSL connection.

12.3 Java Secure Socket Extension JSSE SSL Implementation Supported