In the left pane of the Console, expand Environment and select Servers.

Setting Up Your Environment for Policies 10-27 This section summarizes the steps required to configure SSL on WebLogic Server. For complete information, see Securing Oracle WebLogic Server. To configure two-way SSL: 1. In the left pane of the WebLogic Server Administration Console, expand Environment and select Servers. 2. Click the name of the server for which you want to configure SSL.

3. Select Configuration, and then the SSL page, and choose the location of identity

certificate and private key and trust trusted CAs for WebLogic Server. 4. Set SSL attributes for the private key alias and password.

5. At the bottom of the page, click Advanced.

6. Set Hostname Verification to None. 7. Indicate the number of times WebLogic Server can use an exportable key between a domestic server and an exportable client before generating a new key. The more secure you want WebLogic Server to be, the fewer times the key should be used before generating a new key. 8. Set the Use Server Certs control if needed. Setting this control determines whether a Web service client hosted on WebLogic Server should use the server certificateskey as the client identity when initiating a connection over HTTPS.

9. Set the Two Way Client Cert Behavior control to Client Certs Requested and

Enforced. 10. Specify the inbound and outbound SSL certificate validation methods. These options are available: ■ Builtin SSL Validation Only: Uses the built-in trusted CA-based validation. This is the default. ■ Builtin SSL Validation and Cert Path Validators: Uses the built-in trusted CA-based validation and uses configured CertPathValidator providers to perform extra validation. Configuring SSL for a Web Service Client The core WebLogic Server security subsystem uses private key and X.509 certificate pairs, stored in the default keystores, for SSL. You must ensure that the Web service client trusts the X.509 certificate that WebLogic Server uses to digitally sign the request. Do one of the following: 1. Ensure that WebLogic Server obtains a digital certificate that the client automatically trusts, because it has been issued by a trusted certificate authority. 2. Create a certificate registry that lists all the individual certificates trusted by WebLogic Server, and then ensure that the client trusts these registered certificates. To configure SSL for a Web service client: 1. Create a keystore used by the client application. Oracle recommends that you create one client keystore per application user. You can use the keytool utility to perform this step. For development purposes, the keytool utility is the easiest way to get started. 2. Create a private key and digital certificate pair, and load it into the client keystore.