Configure self signed certificate with Weblogic server

You can configure weblogic server to use self signed certificate which will be signed by yourself and not by any external authority. You can use these certs in non-production environments:

NOTE: You need to create keystores on each physical machine where you have servers running.

I. Generating self signed certificates:

1. Go to weblogic domain directory and create a new directory call as certs

> mkdir certs

2. Go to bin directory available in domain directory and execute setDomainEnv.sh / setDomainEnv.cmd files as below:

Windows: > setDomainEnv.cmd

Unix: . ./setDomainEnv.sh (Do not forget two dots)

3. Change directory to certs and Execute below command to create identity.jks:

> keytool -genkey -alias mycert -keyalg RSA -keypass weblogic1 -keystore identity.jks -storepass weblogic1 -validity 365

Below questions will be asked. Answer them according to your environment:

What is your first and last name?
[Unknown]: techworldrocks.wordpress.com….( NOTE: You need to provide Fully Qualified domain name of your machine where weblogic server is hosted)
What is the name of your organizational unit?
[Unknown]: Middleware
What is the name of your organization?
[Unknown]: techworldrocks
What is the name of your City or Locality?
[Unknown]: Bangalore
What is the name of your State or Province?
[Unknown]: KA
What is the two-letter country code for this unit?
[Unknown]: IN
Is CN=techworldrocks.wordpress.com, OU=Middleware, O=techworldrocks, L=Bangalore, ST=KA, C=IN correct?
[no]: yes

Now we have created a private key in identity.jks file. As we are configuring self signed certificate we will not be creating CSR to order certs from external authority.

4. As its self signed cert we will export same cert which will be also called root in this case from identity.jks:

> keytool -export -alias mycert -file root.cer -keystore identity.jks -storepass weblogic1

5. Now we will import same cert into trust.jks which generally contains only root cert.

NOTE: We can use same identity.jks file in place of trus.jks as we will be having same cert in both but as a good practice we should have both separate. In prod where we have chain of certs it recommended to create two jks stores.

> keytool -import -alias mycert -trustcacerts -file root.cer -keystore trust.jks -storepass weblogic1

Owner: CN=techworldrocks.wordpress.com, OU=Middleware, O=techworldrocks, L=Bangalore, ST=KA, C=IN
Issuer: CN=techworldrocks.wordpress.com, OU=Middleware, O=techworldrocks, L=Bangalore, ST=KA, C=IN
Serial number: 4f738bae
Valid from: Thu Mar 29 03:37:42 IST 2012 until: Fri Mar 29 03:37:42 IST 2013
Certificate fingerprints:
MD5: 19:B9:AB:EC:50:09:F6:D6:46:8D:B0:AD:71:77:22:60
SHA1: 5F:3E:D2:9D:9A:84:D4:06:13:12:A2:9B:C5:F8:A2:EA:83:FB:48:47
Signature algorithm name: SHA1withRSA
Version: 3
Trust this certificate? [no]: yes
Certificate was added to keystore

Now both keystores are ready for configuration. Repeat this process on all physical machines where weblogic servers are hosted

II. Configuring jks with weblogic:

1. Login to admin console

2. Navigate to servers>[server_name]>Configuration>Keystores

3. Select Custom Identity and Custom Trust and provide below details:

-Custom Identity Keystore: <Location of identity.jks>

-Custom Identity Keystore Type: jks

-Custom Identity Keystore Passphrase:weblogic1

-Confirm Custom Identity Keystore Passphrase:weblogic1

-Custom Trust Keystore:  <Location of trust.jks>

-Custom Trust Keystore Type: jks

-Custom Trust Keystore Passphrase:weblogic1

-Confirm Custom Trust Keystore Passphrase:weblogic1

4. Then click on SSL tab next to Keystores and provide values for below parameters:

-Private Key Alias: mycert

-Private Key Passphrase: weblogic1

-Confirm Private Key Passphrase: weblogic1

NOTE: As I have given identity keystore password same as private key password I will give same password here. If you have given different make sure to give different password

5. Then enable SSL port for that particular weblogic server by navigating servers>[server_name]>Configuration>General

Also provide Fully Qualified Domain Name (FQDN) in Listen Address field.

6. Save and activate changes. Repeat this 2nd half procedure for all weblogic servers which intend to use SSL

III. CONFIGURING NODE MANAGER

Modify nodemanager.properties file available in $WL_HOME/common/nodemanager folder. Insert the following lines at the end:

KeyStores=CustomIdentityAndCustomTrust

CustomIdentityKeystoreType=jks

CustomIdentityKeyStoreFileName=<Location of identity.jks>

CustomIdentityKeyStorePassPhrase=weblogic1

CustomTrustKeystoreType=jks

CustomTrustKeyStoreFileName=<Location of trust.jks>

CustomTrustKeyStorePassPhrase=weblogic1

CustomIdentityAlias=mycert

CustomIdentityPrivateKeyPassPhrase=weblogic1

NOTE: Make sure SecureListener is set to true which is already present in this file. Also mention Fully Qualified Domain Name (FQDN) in ListenAddress field which is blank by default.

IV. DISABLING HOSTNAME VERIFICATION

NOTE: As we are using self signed certs we need to disable host name verification whereas in production environment we should keep it enabled by configuring certificates authorized by internal or external certificate authority.

i) Disable host name verification at server level

1. Navigate to servers>[server_name]>Configuration>SSL
2. Click on advanced
3. Make Hostname Verification NONE
4. Save and activate changes.
5. Repeat these steps fore all servers in domain for which self signed certs are configureii) Disable host name verification for Node managerAdd parameter -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false in startNodeManager.sh/startNodeManager.cmd file as given below:

   “${JAVA_HOME}/bin/java” ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS} -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false -Djava.security.policy=”${WL_HOME}/server/lib/weblogic.policy” -Dweblogic.nodemanager.javaHome=”${JAVA_HOME}” -DListenAddress=”${LISTEN_ADDRESS}” -DListenPort=”${LISTEN_PORT}” weblogic.NodeManager -v

   else
"${JAVA_HOME}/bin/java" ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS} -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false -Djava.security.policy="${WL_HOME}/server/lib/weblogic.policy" -Dweblogic.nodemanager.javaHome="${JAVA_HOME}" -DListenPort="${LISTEN_PORT}" weblogic.NodeManager -v
fi
else
if [ "$LISTEN_ADDRESS" != "" ]
then
"${JAVA_HOME}/bin/java" ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS} -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false -Djava.security.policy="${WL_HOME}/server/lib/weblogic.policy" -Dweblogic.nodemanager.javaHome="${JAVA_HOME}" -DListenAddress="${LISTEN_ADDRESS}" weblogic.NodeManager -v
else
"${JAVA_HOME}/bin/java" ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS} -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false -Djava.security.policy="${WL_HOME}/server/lib/weblogic.policy" -Dweblogic.nodemanager.javaHome="${JAVA_HOME}" weblogic.NodeManager -v

Now restart Node manager, you do not have to restart servers if they are already running. This completes SSL configuration with self signed certs.

NOTE: Sometimes you might get some SSL issue at Node manager, in that case import CertGenCA.der into custom trust store trust.jks so that Admin server can trust Node manager.

> keytool -import -alias mycert-trustcacerts -file “<location of CertGenCA.der>” -keystore trust.jks