Configuring SSL (Port 443) for SSB (HTTP & WebCache) and INB (HTTP Only)

Transcription

1 Configuring SSL (Port 443) for SSB (HTTP & WebCache) and INB (HTTP Only) **NOTE: Follow these steps after you ve completed the non-ssl steps provided by ITS- Athens (Sungard). You can also refer to Metalink DocID: and for more information. Setting Up SSL (Port 4443) for HTTP for SSB: ***Assumptions: These instructions were written with the assumption you are running SSL for HTTP and WebCache for SSB. WebCache will be configured on 443 and HTTP Server will be configured on If you are not configuring WebCache on the same server, you will need to change the port to 443 for HTTP in Step In OEM 11g, create a Wallet or Reuse Certificate from your 10g installation. If reusing cert, import an Auto-Login wallet (cwallet.sso). a. Select WebTier ohs1 Security Wallets b. Select Import, choose your *.sso file c. Check Auto-login d. Wallet Name: Whatever you like to call it 2. In order to use a port < 1024, you must run.apachectl as a privilege user such as root. See: a. Log into the server as root. b. Run the following commands in the Oracle home: cd ORACLE_HOME/ohs/bin chown root.apachectl chmod 6750.apachectl 3. In OEM 11g, change the non-ssl virtual host to SSL. a. Select WebTier ohs1 Administration Advanced Configuration b. Select ssl.conf. c. Note the port # for Listen. In this example, we will use Port d. At the top, click on Oracle HTTP Server. Select Virtual Hosts. e. Select the line with Port 4443, click on Configure SSL Configuration. f. Click on Enable SSL g. Server Wallet Name: select the wallet you ve imported or created h. SSL Authentication: Server Authentication i. Cipher Suite: All j. SSL Protocol Version: All k. Click Ok.

2 4. Restart the HTTP Server Component. a. Select Oracle HTTP Server Control Restart 5. Test your SSL configuration for SSB. Setting Up SSL (Port 443) for HTTP for SSB 1. In OEM 11g, create a Wallet or Reuse Certificate from your 10g installation. If reusing cert, import an Auto-Login wallet (cwallet.sso). a. Select WebTier webcache1 Security Wallets b. Select Import, choose your *.sso file c. Check Auto-login d. Wallet Name: Whatever you like to call it 2. In order to use a port < 1024, you must run webcached as a privilege user such as root. See: a. Log into the server as root. b. Set your ORACLE_HOME c. Run the following commands in the Oracle home: cd ORACLE_HOME/webcache/bin./webcache_setuser.sh setroot oracle 3. Create a new SSL listening port: a. Select 'Webcache' -> 'Administration' -> 'Ports Configuration' b. Select 'Create' and enter the relevant information: c. Port Type: Norm d. IP address: ANY e. Port: 443 (make sure this is not used by another process) f. Select OK and this will take you back to the Ports screen. g. Select the Port you just added e.g 443 and select 'Edit' h. Check 'Enable SSL' i. Select the Wallet created in Step 1. j. In Advanced Settings leave the defaults. k. Click OK 4. Verify your Origin Server exists, if not create one. a. Select 'Webcache' -> 'Administration' -> 'Origin Servers' b. Select 'Create' and enter the relevant information:

3 c. Host: <OHS host.domain> e.g ohs.uk.oracle.com d. Port: <OHS HTTP Port> e.g: 4443 e. Protocol : HTTPS f. Leave all the rest as default 5. Create a new Site: a. Select 'Webcache' -> 'Administration' -> 'Sites' b. Select 'Create' and enter the relevant information: c. Host: <webcache host.domain> e.g webcache.uk.oracle.com d. Port <port> e.g 443 e. Click OK and this will return you to the Sites page 6. Create a Site to Server Mapping: a. Select 'Create' and enter the relevant information: b. Host Pattern: <webcache host.domain> e.g webcache.uk.oracle.com c. Port Pattern: 443 d. Select the Origin Server created earlier e.g: ohs.uk.oracle.com:4443and select the 'Move' button. e. Click OK 6. Import the Trusted Root CA Certificate into the Origin Server Wallet: a. Navigate to 'Webcache' -> 'Security' -> 'SSL Configuration' b. In 'SSL Communication Between Web Cache and Oracle HTTP Server (OHS)' select 'Change Wallet' c. Select the Client Wallet that you created in Step II d. If Webcache and OHS are on the same server and you are using the same wallet for OHS and Webcache move to 7. e. If Webcache and OHS are on the same or different servers and the certificate for OHS was signed by a different CA to the Webcache certificate, you need to import the Trusted Root CA certificate that signed the OHS certificate, into the Webcache Wallet selected above. How to import a Trusted Certificate into a Wallet has already been covered in earlier sections/notes. 7. Restart WebCache: a. Select 'WebCache -> 'Control' -> 'Restart'' 8. Test your SSL site:

4 Setting Up SSL (Port 443) for HTTP for INB: ***NOTE: There is only for HTTP. Webcache is not installed for Oracle Forms. 1. In OEM 11g, create a Wallet or Reuse Certificate from your 10g installation. If reusing cert, import an Auto-Login wallet (cwallet.sso). a. Select WebTier ohs1 Security Wallets b. Select Import, choose your *.sso file c. Check Auto-login d. Wallet Name: Whatever you like to call it 2. In order to use a port < 1024, you must run.apachectl as a privilege user such as root. See: a. Log into the server as root. b. Run the following commands in the Oracle home: cd ORACLE_HOME/ohs/bin chown root.apachectl chmod 6750.apachectl 3. In OEM 11g, change the non-ssl virtual host to SSL. a. Select WebTier ohs1 Administration Advanced Configuration b. Select ssl.conf. c. Note the port # for Listen. In this example, we will use Port 443. d. Change Listen Port to Listen 443. e. Change <Virtual *:Port> to <VirtualHost *:443> f. At the top, click on Oracle HTTP Server. Select Virtual Hosts. g. Select the line with Port 443, click on Configure SSL Configuration. h. Click on Enable SSL i. Server Wallet Name: select the wallet you ve imported or created j. SSL Authentication: Server Authentication k. Cipher Suite: All l. SSL Protocol Version: All m. Click Ok. 4. Restart the HTTP Server Component. a. Select Oracle HTTP Server Control Restart 5. Test your SSL configuration for INB.

5 Configuring SSL Via Manual Configuration 1. Backup the $ORACLE_INSTANCE/config/OHS/ohs1/ssl.conf 2. Edit the ssl.conf and locate the VirtualHost section: <VirtualHost *:4448> <IfModule ossl_module> # SSL Engine Switch: # Enable/Disable SSL for this virtual host. SSLEngine on # Client Authentication (Type): # Client certificate verification type and depth. Types are # none, optional and require. SSLVerifyClient None # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. SSLCipherSuite SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_RSA_WITH_ 3DES_EDE_CBC_SHA,SSL_RSA_WITH_DES_CBC_SHA,TLS_RSA_WITH_AES_128 _CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA # SSL Certificate Revocation List Check # Valid values are On and Off SSLCRLCheck Off #Path to the wallet SSLWallet "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/key stores/default" <FilesMatch "\.(cgi shtml phtml php)$"> SSLOptions +StdEnvVars </FilesMatch> <Directory "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/cgibin"> SSLOptions +StdEnvVars </Directory> BrowserMatch ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0

6 </IfModule> </VirtualHost> 3. Change the SSLWallet directive to point at the Wallet created in Step I e.g: SSLWallet "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/key stores/newwallet 4. Save the file and restart HTTP Server: $ORACLE_INSTANCE/bin/opmnctl restartproc process-type=ohs 5. Test you can connect from a browser to your Virtual Host: e.g Configuring Web Cache with SSL in Fusion Middleware 11g ( X) In FMW 11g it is possible to configure Web Cache in the following architectures: Browser --> https --> WebCache --> https --> Oracle HTTP Server Browser --> https --> WebCache --> http --> Oracle HTTP Server This document will show how to configure FMW 11g Web Cache in both configurations. Configuration I: HTTPS between Browser, WebCache and HTTP Server This section will show how to set up WebCache so the configuration is as follows: Browser --> https --> WebCache --> https --> Oracle HTTP Server Step I: Configure the HTTP Server so it can be accessed by Web Cache in SSL mode Step II: Configure the WebCache Wallet Step III: Configure the WebCache to listen in SSL Mode Step IV: Test you can access Web Cache in SSL mode Step I: Configure the HTTP Server so it can be accessed by Web Cache in SSL mode 1.To configure HTTP Server to run in SSL mode, see Note Configuring Oracle HTTP Server to use SSL in Fusion Middleware 11g ( X)

7 2. After this is configured make sure HTTP Server can be accessed in SSL mode e.g: where 4444 is the SSL port configured for the OHS. Step II: Configure the WebCache Wallet If WebCache and HTTP Server exist on the same server then this section can be ignored as the same Wallet can be used for both WebCache and the HTTP Server. If WebCache and the HTTP Server are on different machines, then create a Wallet for Webcache. Choose whichever method suits and follow the relevant "How to Create a Wallet Via..." Note in Note Master Note for SSL Configuration in Fusion Middleware 11g, Section II: Wallets and Keystores in FMW 11g. If on Windows, then make sure you perform the following steps or you will hit the issue outlined in Note Oracle HTTP Server and/or WebCache Fails to Start after Configuring SSL in FMW 11g on Windows: 1. Open Windows Explorer and navigate to the <wallet_location>\cwallet.sso file. 2. Right Click on the cwallet.sso file, select Properties, and navigate to the Security tab. In the "Group or user names" security box, select "Add", and enter "SYSTEM" and click OK. When the Wallet is complete and contains a valid certificate move to Step III Step III: Configure the WebCache to listen in SSL Mode The steps to follow depend on whether your Webtier is associated with a WebLogic Server domain, or whether it is a standalone Webtier. Follow the relevant section below for your circumstances: WebCache associated with WLS Domain 1. In Step I, if you created a new Wallet for Webcache via FMW Control or WLST ignore this and continue at 2. If you created a new Wallet for Webcache via OWM or orapki, OR Webcache and OHS are on the same machine and you want to use the same Wallet as you did for OHS, then you need to import the Wallet into the WebCache configuration. Copy the Wallet (ftp in binary) from it's existing location on the server to the browser machine where FMW Control is running. Then follow Importing a Wallet Using Fusion Middleware Control, to import the Wallet to the 'Wallet' section of WebCache 2. Create a new SSL listening port:

8 Select 'Webcache' -> 'Administration' -> 'Ports Configuration' Select 'Create' and enter the relevant information: o Port Type: Norm o IP address: ANY o Port: 4443 (make sure this is not used by another process) o Select OK and this will take you back to the Ports screen. o Select the Port you just added e.g 4443 and select 'Edit' o Check 'Enable SSL' o Select the Wallet created in Step II. o In Advanced Settings leave the defaults. o Click OK If you plan on using a port <1024 on UNIX, then follow Configuring Root Privilege for Privileged Ports and More than 1,024 File Descriptors 3. Create an Origin Server: Select 'Webcache' -> 'Administration' -> 'Origin Servers' Select 'Create' and enter the relevant information: o Host: <OHS host.domain> e.g ohs.uk.oracle.com o Port: <OHS HTTP Port> e.g: 4444 o Protocol : HTTPS o Leave all the rest as default 4. Create a new Site: Select 'Webcache' -> 'Administration' -> 'Sites' Select 'Create' and enter the relevant information: Host: <webcache host.domain> e.g webcache.uk.oracle.com Port <port> e.g 4443 Click OK and this will return you to the Sites page 5. Create a Site to Server Mapping: Select 'Create' and enter the relevant information: o Host Pattern: <webcache host.domain> e.g webcache.uk.oracle.com o Port Pattern: 4443 o Select the Origin Server created earlier e.g: ohs.uk.oracle.com:4444 and select the 'Move' button. o Click OK 6. Import the Trusted Root CA Certificate into the Origin Server Wallet:

9 Navigate to 'Webcache' -> 'Security' -> 'SSL Configuration' In 'SSL Communication Between Web Cache and Oracle HTTP Server (OHS)' select 'Change Wallet' Select the Client Wallet that you created in Step II If Webcache and OHS are on the same server and you are using the same wallet for OHS and Webcache move to 7. If Webcache and OHS are on the same or different servers and the certificate for OHS was signed by a different CA to the Webcache certificate, you need to import the Trusted Root CA certificate that signed the OHS certificate, into the Webcache Wallet selected above. How to import a Trusted Certificate into a Wallet has already been covered in earlier sections/notes. 7. Restart WebCache: Select 'WebCache -> 'Control' -> 'Restart'' 8. Move to Step IV: Test you can access Web Cache in SSL mode Webcache Standalone Not Associated with a WLS Domain 1. Access the WebCache Administration page e.g: To find your Webcache Administration port run: $ORACLE_INSTANCE/bin/opmnctl status -l For example:./opmnctl status -l Processes in Instance: wtdomain ias-component process-type pid status uid memused uptime ports webcache1 WebCache-admin Alive :32:26 http_admin:7786 In this case the admin port is Create a new SSL listening port:

10 Select 'Listen Ports' Select the top entry in the list Select 'Insert Above' and enter the relevant information: o Enter IP Address: ANY o Enter Port Number: 4443 (make sure this is not used by another process) o Protocol: HTTPS o Wallet : <wallet_location_created_in_step_ii> o Client Certificate: Not Required o Click 'Submit' 3. Create an Origin Server: Select 'Origin Servers' Click 'Add' and enter the relevant information: o Host Name: <OHS host.domain> ohs.uk.oracle.com o Port: <OHS SSL Port> e.g 4444 o Protocol: HTTPS o Capacity: 100 o Failover Threshold: 5 o Ping URL: / o Ping Interval (seconds): 10 o Click OK 4. Create a new Site: Select 'Sites'. Click 'Add' and enter the relevant information: o Host Name : <Webcache_host.domain> e.g webcache.uk.oracle.com o Port Number: <Webcache_SSL_port> e.g 4443 o Leave the rest of the entries as default o Click Submit 5. Create a Site to Server Mapping: Select 'Site to Server Mapping' Select the top entry and Insert Above Check 'Select a Defined Site' and select the Site you added from the drop down list Select the correct Origin Server from 'Available Origin Servers' e.g: ohs.uk.oracle.com:4444 Select 'Submit'

11 6. Set the Origin Server Wallet: Select 'Origin Server Wallet' Select the Wallet and 'Edit Selected' Change the path to the Wallet you created in Step II If Webcache and OHS are on the same server and you are using the same wallet for OHS and Webcache move to 7. If Webcache and OHS are on same or different servers and the certificate for OHS was signed by a different CA to the Webcache certificate you need to import the Trusted Root CA certificate that signed the OHS certificate, into the Webcache Wallet selected above. How to import a Trusted Certificate into a Wallet has already been covered in earlier sections/notes 7. Restart Webcache: Select 'Cache Operations' Select 'Apply Changes' Select 'Restart' Step IV: Test you can access Web Cache in SSL mode 1.Test you can access Webcache via SSL e.g: Configuration II: HTTPS between Browser/Web Cache and HTTP between Web Cache/HTTP Server This section will show how to set up WebCache so the configuration is as follows: Browser --> https --> WebCache --> http --> Oracle HTTP Server There are several steps to configure WebCache for SSL on UNIX: Step I: Configure Web Cache Wallet Step II: Configure the Web Cache to listen in SSL Mode Step III: Configure HTTP Server to use Mod_certheaders Step IV: Test you can access Web Cache in SSL mode

12 Step I: Configure the WebCache Wallet As outlined in some of the referenced notes, there are several ways to create an Oracle Wallet in Fusion Middleware 11g. To summarize the methods are as follows: Fusion Middleware Control Oracle Wallet Manager ORAPKI WLST The one you choose to use depends on your circumstances. Please read Note Understanding Wallets and Keystores in Fusion Middleware 11g Generally speaking the recommendation is to use FMW Control, however remember that FMW Control can *only* be used if your Webtier is associated with a WLS domain. For WebCache standalone, use OWM or ORAPKI. Choose whichever method suits and follow the relevant "How to Create a Wallet Via..." Note in Note Master Note for SSL Configuration in Fusion Middleware 11g, Section II: Wallets and Keystores in FMW 11g. When the Wallet is complete and contains a valid certificate move to Step II Step II: Configure the WebCache to listen in SSL Mode The steps to follow here depend on whether your Webtier is associated with a WebLogic Server domain, or whether it is a standalone Webtier. Follow the relevant section below for your circumstances: WebCache associated with WLS Domain 1. In Step I, if you created a new Wallet for Webcache via FMW Control or WLST ignore this step and move to 2. If you created a new Wallet for Webcache via OWM or orapki, OR Webcache and OHS are on the same machine and you want to use the same Wallet as you did for OHS, then you need to import the Wallet into the WebCache configuration. Copy the Wallet (ftp in binary) from it's existing location on the server to the browser machine where FMW Control is running. Then follow Importing a Wallet Using Fusion Middleware Control, to import the Wallet to the Webcache -> Wallets section. 2. Create a new SSL listening port:

13 Select 'Webcache' -> 'Administration' -> 'Ports Configuration' Select Create and enter the relevant information: o Port Type: Norm o IP address: ANY o Port: 4443 (make sure this is not used by another process) o Select OK and this will take you back to the Ports screen. o Select the Port you just added e.g 4443 and select Edit o Check 'Enable SSL' o Select the Wallet created in Step I o In Advanced Settings leave the defaults. o Click OK 3. Create an Origin Server: Select 'Webcache' -> 'Administration' -> 'Origin Servers' Select 'Create' and enter the relevant information: o Host: <OHS host.domain> e.g ohs.uk.oracle.com o Port: <OHS HTTP Port> e.g: 7779 o Protocol : HTTP o Leave all the rest as default o Click OK 4. Create a new Site: Select 'Webcache' ->'Administration' ->'Sites' Select 'Create' and enter the relevant information: o Host: <Webcache_host.domain> e.g webcache.uk.oracle.com o Port <SSL_port> e.g 4443 o Click OK and this will return you to the Sites page 5. Create a Site to Server Mapping: Select 'Create' and enter the relevant information o Host Pattern: <Webcache_host.domain> e.g webcache.uk.oracle.com o Port Pattern: 4443 o Select the Origin Server created earlier e.g: ohs.uk.oracle.com:7779 and select the 'Move' button. o Click OK 6. Restart WebCache: Select 'WebCache' -> 'Control' -> 'Restart'

14 7. Move to Step III: Configure HTTP Server to use Mod_certheaders Standalone WebCache not associated with WLS Domain 1. Access the WebCache Administration page e.g: To find your Webcache Administration port run: $ORACLE_INSTANCE/bin/opmnctl status -l For example:./opmnctl status -l Processes in Instance: wtdomain ias-component process-type pid status uid memused uptime ports webcache1 WebCache-admin Alive :32:26 http_admin:7786 In this case the admin port is Create a new SSL listening port: Select 'Listen Ports' Select the top entry in the list and select 'Insert Above' Enter the relevant information as follows: o IP Address: ANY o Port Number: 4443 o Protocol: HTTPS o Wallet : <wallet_location_created_in_step_i> o Client Certificate: Not Required o Click 'Submit' 3. Create an Origin Server: Select 'Origin Servers' Click 'Add' and enter the relevant information: o Host Name: <OHS host.domain> ohs.uk.oracle.com o Port: <OHS Port> e.g 7779

15 o Protocol: HTTP o Capacity: 100 o Failover Threshold: 5 o Ping URL: / o Ping Interval (seconds): 10 o Click OK 4. Create a new Site: Select 'Sites' Click 'Add' and enter the relevant information: o Host Name : <Webcache_host.domain> e.g webcache.uk.oracle.com o Port Number: <Webcache_SSL_port> e.g 4443 o Leave the rest of the entries as default o Click 'Submit' 5. Create a Site to Server Mapping: Select 'Site to Server Mapping' Select the top entry and 'Insert Above' Check 'Select a Defined Site' and select the Site you added from the drop down list Select the correct Origin Server from 'Available Origin Servers' e.g: ohs.uk.oracle.com:7779 Select 'Submit' 6. Restart Web Cache: Select 'Cache Operations' Select 'Apply Changes' Select 'Restart' Step III: Configure HTTP Server to use Mod_certheaders This step is necessary to configure HTTP server so it knows the originating request to Webcache was via HTTPS. To do this HTTP Server needs to be configured to use mod_certheaders. 1. For OHS associated with a WLS domain: In FMW Control select -> 'ohs1' -> 'Administration' -> 'Advanced Configuration' -> Select file: httpd.conf For Standalone OHS: Edit $ORACLE_INSTANCE/config/OHS/ohs1/httpd.conf 2. Add the certheaders_module by adding the following at the end of the LoadModule section :

16 LoadModule certheaders_module "${ORACLE_HOME}/ohs/modules/mod_certheaders.so' 3.At the end of the httpd.conf add: AddCertHeader HTTPS SimulateHttps On 4. Restart HTTP Server Step IV: Test you can access Web Cache in SSL mode 1.Test you can access Webcache via SSL e.g: