Select the row for the endpoint you created in Step 2 and click Edit.

Configuring Security 5-15 After configuring the client-side certificate, to enable Oracle Web Cache to transfer certificate information to Oracle HTTP Server, add the AddCertHeader directive to httpd.conf. See the Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server for information about adding the AddCertHeader directive.

5.5.2.2 Configuring Client-Side Certificate Settings for Cache Clusters

If you have a cache cluster, you must prevent a cache from accepting the certificate information in HTTP headers from any source other than a peer cluster member. In addition, each cache must be able to pass the client-side certificate information in headers to the peer cluster member, and the peer must be able to pass them to the application Web server. To configure this behavior in Oracle Web Cache Manager:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 .

2. In the Security Header Configuration section of the Security page, set the value of

Accept SSL client certificates encoded in SSL-Client-Cert HTTP headers to NO the default, so Oracle Web Cache does not accept the certificate information in HTTP headers. This setting prevents caches in a cache cluster from accepting the certificate information in HTTP headers.

3. In the Cluster Security Configuration section, set the value of the Route requests

that contain SSL client certificates to cache cluster peers to YES, enabling Oracle Web Cache to pass information about the client-side certificate in HTTP headers to a peer cache. This setting is used for caches in a cache cluster so that they can pass the information to a peer cache.

4. Click Apply Changes.

5. Restart Oracle Web Cache. See

Section 2.13 .

5.5.2.3 Configuring Client-Side Certificate Settings for a Site

You can also specify that an entire site require client-side certificates. If a site requires client certificates, then a 403 Forbidden error returns if a client certificate is not provided. To configure a site to use client-side certificates:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties Site

Definition . See Section 2.7.2 .

2. In the Site Definitions page, select the site and click ShowEdit Site.

3. In the ShowEdit dialog, in the Client-Side Certificate field, select Required.

4. Click Submit.

5. Restart Oracle Web Cache. See Section 2.13 .

5.5.3 Configuring Certificate Revocation Lists CRLs

Fusion Middleware Control or Oracle Web Cache Manager do not provide support for client certificate validation with Certificate Revocation Lists CRLs. You can configure this support by manually editing the webcache.xml file. Client certificate revocation status is checked against CRLs that are located in a file system directory. Typically, CRL definitions are valid for a few days, and must be updated on a regular basis. Whenever the CRL definitions are modified, you must restart Oracle Web Cache.