Configuring HTTPS Operation Ports

5-14 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache

h. Click OK.

5.5.2 Requiring Client-Side Certificates

You can require that clients send certificates client-side certificates to the cache to verify the identity of the client. With client-side certificates, the client browser sends the certificate to the cache during the SSL handshake. Then, the server processes the request for the object. If the requested object is not stored in the cache, the cache forwards the request to the application Web server, a peer cache in a cluster, or a subordinate cache in a hierarchy. To transfer information about the client-side certificate to another cache or to the application Web server, Oracle Web Cache adds HTTP headers to the request. The headers begin with the string SSL-Client-Cert. Note the following points about using client-side certificates: ■ In a simple configuration client to cache to application Web server, the client sends the certificate to the cache during the SSL handshake. If the requested object is not stored in the cache, the cache forwards the request to the application Web server and transfers the client-side certificate information in headers to the application Web server. The application Web server recognizes the headers and responds to the request. ■ In a cluster, the client sends the certificate to a cache cluster member during the SSL handshake. If the requested object is not stored in that cache, the cluster member requests it from a peer the cluster member that owns the object. With client-side certificates, Oracle Web Cache must be able to pass the client-side certificate information in headers to the peer cluster member, and the peer must be able to pass the headers to the application Web server. ■ If a site requires client certificates, then a 403 Forbidden error returns if a client certificate is not provided. If a listen port requires client certificates, then the SSL handshake fails if a client certificate is not provided. The following topics describe how to configure client-side certificate settings: ■ Section 5.5.2.1, Configuring Client-Side Certificate Settings for the HTTPS Listening Ports ■ Section 5.5.2.2, Configuring Client-Side Certificate Settings for Cache Clusters ■ Section 5.5.2.3, Configuring Client-Side Certificate Settings for a Site

5.5.2.1 Configuring Client-Side Certificate Settings for the HTTPS Listening Ports

To use client-side certificates, you must enable an HTTPS listening port, as described in Section 5.4.2 . If you have a cache cluster, you must enable HTTPS listening ports for all cluster members. In addition, you must configure Oracle Web Cache to require client browsers to provide SSL certificates. Note: Oracle Web Cache supports the use of client-side certificates with Oracle HTTP Server only. Oracle Web Cache does not support client-side certificates with a distributed cache hierarchy because the security of the certificates cannot be guaranteed.