From the SSL Protocol Version list, select the version of SSL to use.

Configuring Security 5-15 After configuring the client-side certificate, to enable Oracle Web Cache to transfer certificate information to Oracle HTTP Server, add the AddCertHeader directive to httpd.conf. See the Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server for information about adding the AddCertHeader directive.

5.5.2.2 Configuring Client-Side Certificate Settings for Cache Clusters

If you have a cache cluster, you must prevent a cache from accepting the certificate information in HTTP headers from any source other than a peer cluster member. In addition, each cache must be able to pass the client-side certificate information in headers to the peer cluster member, and the peer must be able to pass them to the application Web server. To configure this behavior in Oracle Web Cache Manager:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 .

2. In the Security Header Configuration section of the Security page, set the value of

Accept SSL client certificates encoded in SSL-Client-Cert HTTP headers to NO the default, so Oracle Web Cache does not accept the certificate information in HTTP headers. This setting prevents caches in a cache cluster from accepting the certificate information in HTTP headers.

3. In the Cluster Security Configuration section, set the value of the Route requests

that contain SSL client certificates to cache cluster peers to YES, enabling Oracle Web Cache to pass information about the client-side certificate in HTTP headers to a peer cache. This setting is used for caches in a cache cluster so that they can pass the information to a peer cache.

4. Click Apply Changes.

5. Restart Oracle Web Cache. See

Section 2.13 .

5.5.2.3 Configuring Client-Side Certificate Settings for a Site

You can also specify that an entire site require client-side certificates. If a site requires client certificates, then a 403 Forbidden error returns if a client certificate is not provided. To configure a site to use client-side certificates:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties Site

Definition . See Section 2.7.2 .

2. In the Site Definitions page, select the site and click ShowEdit Site.

3. In the ShowEdit dialog, in the Client-Side Certificate field, select Required.

4. Click Submit.

5. Restart Oracle Web Cache. See Section 2.13 .

5.5.3 Configuring Certificate Revocation Lists CRLs

Fusion Middleware Control or Oracle Web Cache Manager do not provide support for client certificate validation with Certificate Revocation Lists CRLs. You can configure this support by manually editing the webcache.xml file. Client certificate revocation status is checked against CRLs that are located in a file system directory. Typically, CRL definitions are valid for a few days, and must be updated on a regular basis. Whenever the CRL definitions are modified, you must restart Oracle Web Cache. 5-16 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache When CRL validation is enabled and available, Oracle Web Cache performs certificate revocation status checking for client certificates. The SSL connection is rejected if a certificate is revoked. SSL connections are accepted if no CRL is found, or if the certificate has not been revoked. To configure certificate validation with CRL 1. Enable client certificate for the HTTPS listen port. See Section 5.5.2 . 2. Use a text editor to open webcache.xml, located in: UNIX ORACLE_INSTANCEinstance_nameconfigWebCachewebcache_name Windows ORACLE_INSTANCE\instance_name\config\WebCache\webcache_name 3. Locate the HTTPS listen port in webcache.xml for which CRL checking needs to be enabled, and add the SSLCRLENABLE=YES parameter to the LISTEN directive. For example: ... LISTEN IPADDR=ANY PORT=443 PORTTYPE=NORM SSLENABLED=SSLV3_V2H CLIENT_ CERT=YES SSLCRLENABLE=YES STRONG_CRYPTO_ONLY=NO ... 4. Configure CRL file location by adding the SSLCRLPATH and SSLCRLFILE parameters to the HTTPS LISTEN directive. ■ SSLCRLPATH: Enter the path to the directory where CRLs are stored. Ensure that the path is correct; otherwise CRL checking will not work. This parameter has no default value. ■ SSLCRLFILE: Enter the path to a comprehensive CRL file where PEM-encoded BASE64 CRLs are concatenated in order of preference in one file. If this parameter is set, then the file must be present at the specified location. Otherwise CRL checking will not work. For example: ... LISTEN IPADDR=ANY PORT=443 PORTTYPE=NORM SSLENABLED=SSLV3_V2H CLIENT_ CERT=YES SSLCRLENABLE=YES SSLCRLFILE=ORACLE_HOMEwebcachecrlssample_ crl SSLCRLPATH=ORACLE_HOMEwebcachecrls STRONG_CRYPTO_ONLY=NO ... Use the command line utility orapki to rename CRLs in your file system. See section Certificate Revocation List Management in the Oracle Database Advanced Security Administrators Guide from the Oracle Database documentation library for information about using orapki. 5. Save webcache.xml. 6. Restart Oracle Web Cache with the following command: opmnctl restartproc ias-component=component_name This executable is found in the following directory: UNIX ORACLE_INSTANCEbin Windows ORACLE_INSTANCE\bin In a cluster configuration, when configuration changes are made directly to a cluster members webcache.xml file, use Fusion Middleware Control or Oracle Web Cache Manager to propagate the change to other cluster members. See Section 3.6 and Section 3.7 .