Hi All,
This post assists in configuring SSL for EBS R12 from command line using orapki rather than owm utility. This illustrates example for self signed certificates.
This involves below series of steps to setup SSL.
- Create New Wallet
- Create a Certificate Request
- Upload Certificate to Wallet
- Modify the OPMN wallet
- Import certs to cacerts
- Update the Context File
- Settings for DB Tier
Login EBS
Application server and source using environment file
(APPS<sid_machine>.env) located in the APPL_TOP directory.
- Navigate to the
$INST_TOP/ora/10.1.3 and source the env file to set your 10.1.3
ORACLE_HOME variables.
- Navigate to the
$INST_TOP/certs/Apache directory.
- Take backup of existing
wallet files to a backup directory.
- Create New
wallet using orapki utility as below
bash-4.1$ cd $INST_TOP/Apache
bash-4.1$ orapki wallet
create -wallet . -auto_login -pwd apps123
bash-4.1$ ls -ltr
total 16
-rw------- 1 oracle dba
7912 Apr 15 13:33 ewallet.p12
-rw------- 1 oracle dba
7940 Apr 15 13:33 cwallet.sso
Create a Certificate Request
Create new
certificate request file by passing appropriate details as input which is
used for generating a SSL Certificate.
- Below are the
details required to be passed to generate csr file.
Common Name name of
server with domain, e.g. mylinux.domain.com
Organizational Unit: The unit within your organization, e.g. HR
Organization: is the name of your organization, e.g. Home
Locality/City: is your locality or city, e.g. New York
State/Province: is the full name of your State or Province - do not
abbreviate,
Country: Select country
from drop down list, e.g. USA
Keysize: Encryption level
and min is 1024, recommended value - 2048
- Use command as
below to generate certificate request file and export it.
$ orapki wallet add
-wallet . -dn "CN=mylinux.domain.com,OU=HR,O=Home,L=New york,ST=Newyork,C=USA" -keysize 2048 -pwd apps123
$ orapki wallet add -wallet . -dn "CN=mylinux.domain.com,OU=HR,O=Home,L=New york,ST=Newyork,C=USA" -keysize 2048 -request server.txt -pwd apps123
- Verify the
certificate request file from wallet as below.
$ cd $INST_TOP/certs/Apache/
$ orapki wallet display -wallet .
Requested Certificates:
Subject: CN=mylinux.domain.com,OU=HR,O=Home,L=New york,ST=Newyork,C=USA ß
File requested
User Certificates:
Trusted Certificates:
Subject: CN=GTE CyberTrust Root,O=GTE
Corporation,C=US
Subject: CN=Entrust.net Certification Authority
(2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by
ref. (limits liab.),O=Entrust.net
Subject: OU=Class 1 Public Primary Certification
Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Class 2 Public Primary Certification
Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Class 3 Public Primary Certification
Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Secure Server Certification
Authority,O=RSA Data Security\, Inc.,C=US
Subject: CN=Entrust.net Secure Server
Certification Authority,OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS
incorp. by ref. (limits liab.),O=Entrust.net,C=US
Subject: CN=GTE CyberTrust Global Root,OU=GTE
CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US
Subject: CN=Entrust.net Secure Server
Certification Authority,OU=(c) 2000 Entrust.net
Limited,OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.),O=Entrust.net
Then submit the
generated request file(server.txt) to Certifying authority to request a
self-signed certificate.
Upload Certificate to Wallet
- As the
certificate provided is self signed, once Certifying authority provides
Self-signed Server Certificate we need additional certificates to import
them to the wallet. We need to download root certificate, intermediate
certificates to import server certigficate to wallet.
Note: Save certificate in base-64 format.
- Once certificate
is received save the file as server.crt in ($INST_TOP/certs/Apache). Also
import all the root certificates of this certificate and save certificates
with necessary conventions as below.
Root Certifciate - ca.crt
Intermediate Certificate -
intermediate_base64.cer
Server.crt - server_base64.cer
Root & Intermediate certificates can be obtained from Internal Certifying authority if you are using self signed certificates.
- Ftp the
certificate files to the server and place them in $INST_TOP/certs/Apache
directory.
- Upload these
certificates to Wallet using commands as below.
bash-4.1$ cd $INST_TOP/certs/Apache
$ orapki wallet add
-wallet . -trusted_cert -cert SSL/ca.crt -pwd apps123
$ orapki wallet add
-wallet . -trusted_cert -cert SSL/intermediate_base64.cer -pwd apps123
$ orapki wallet add
-wallet . -user_cert -cert SSL/123080_base64_certificate.cer -pwd apps123
- Display Wallet
contents and you should see all the certificates uploaded to wallet.
bash-4.1$ orapki wallet display -wallet .
Requested Certificates:
User
Certificates:
Subject: CN=mylinux.domain.com,OU=HR,O=Home,L=New york,ST=Newyork,C=USA
Trusted Certificates:
Subject: CN=GTE CyberTrust Root,O=GTE
Corporation,C=US
Subject: OU=Class 1 Public Primary Certification
Authority,O=VeriSign\, Inc.,C=US
Subject: CN=Intermediate
Authority,O=Home,C=US
Subject: OU=Secure Server Certification
Authority,O=RSA Data Security\, Inc.,C=US
Subject: CN=GTE CyberTrust Global Root,OU=GTE
CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US
Subject: CN=Entrust.net Certification Authority
(2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by
ref. (limits liab.),O=Entrust.net
Subject: OU=Class 2 Public Primary Certification
Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Class 3 Public Primary Certification
Authority,O=VeriSign\, Inc.,C=US
Subject: CN=Entrust.net Secure Server
Certification Authority,OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS
incorp. by ref. (limits liab.),O=Entrust.net,C=US
Subject: CN=Home Root Certificate
Authority,O=Home
Subject: CN=Entrust.net Secure Server
Certification Authority,OU=(c) 2000 Entrust.net
Limited,OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.),O=Entrust.net
- We
need to import root & intermediate certificates to
b64InternetCertificate.txt file located in the 10.1.2
ORACLE_HOME/sysman/config directory.
$ cd $INST_TOP/certs/Apache/
$ cat SSL/ca.crt
>>$ORACLE_HOME/sysman/config/b64InternetCertificate.txt ß
root cert
$ cat
SSL/infra_intermediate_base64.cer
>>$ORACLE_HOME/sysman/config/b64InternetCertificate.txt ß Inter cert
$ cat
SSL/Infra_East_Base64.cer >> $ORACLE_HOME/sysman/config/b64InternetCertificate.txt
ßInter cert
As default opmn
wallet comes with demo wallet files, these should be now replace with
newly created wallets as below.
- Navigate to the
$INST_TOP/certs/opmn directory.
- Create a new directory
named BAK
- Move the
ewallet.p12 and cwallet.sso files to the BAK directory just created.
- Copy the
ewallet.p12 and cwallet.sso files from the $INST_TOP/certs/Apache
directory to the $INST_TOP/certs/opmn directory.
$ cd $INST_TOP/certs/opmn
$ mkdir BAK
$ mv * BAK/
$ cp ../Apache/ewallet.p12
.
$ cp ../Apache/cwallet.sso
.
Import certs to cacerts
Now the new
certificates files needs to be uploaded to cacerts under
$OA_JRE_TOP/security/lib for proper functioning of XML Piublisher, OPP,
etc.,
- Navigate to the
$OA_JRE_TOP/lib/security directory
- Backup the
existing cacerts file.
cd
$OA_JRE_TOP/lib/security
cp cacerts cacerts.orig
- Copy your ca.crt
and server.crt files to this directory and issue the following command to
insure that cacerts has write permissions:
5.
Add
your Apache ca.crt and server.crt to cacerts as below.
bash-4.1$ cd -
/oracle/orainst1/d112uk/inst/apps/d112uk_camcfnldap01/certs
bash-4.1$ cd Apache/SSL/
bash-4.1$ ls
Server_base64_certificate.cer ca.crt
intermediate_base64.cer
bash-4.1$ cat
intermediate_base64.cer >> ca.crt
bash-4.1$ cp -pr ca.crt
$OA_JRE_TOP/lib/security
bash-4.1$ cp -pr
Server_base64_certificate.cer $OA_JRE_TOP/lib/security
bash-4.1$ cd
$OA_JRE_TOP/lib/security
$ keytool -import -alias ApacheRootCA_2048 -file ca.crt
-trustcacerts -v -keystore cacerts
When prompted enter the
keystore password (default password is changeit).
$ keytool -import -alias ApacheServer_2048 -file
123080_base64_certificate.cer -trustcacerts -v -keystore cacerts
Trust this certificate?
[no]: Yes
Certificate was added to
keystore
Update the Context File
- Backup existing
context file under $INST_TOP/appl/admin/<db>_<server>.xml
- Modify all below
variables in the context file and save it.
|
SSL
Related Variables in the Context File
|
|
Variable
|
Non-SSL
Value
|
SSL
Value
|
|
s_url_protocol
|
http
|
https
|
|
s_local_url_protocol
|
http
|
https
|
|
s_webentryurlprotocol
|
http
|
https
|
|
s_active_webport
|
same as s_webport
|
same as s_webssl_port
|
|
s_webssl_port
|
not applicable
|
4443 (port pool 0)
|
|
s_https_listen_parameter
|
not applicable
|
same as s_webssl_port
|
|
s_login_page
|
|
|
|
s_external_url
|
|
|
- Run autoconfig
using adautocfg.sh file.
- Restart the
middle tier services.
Settings for DB Tier
To enable SSL on
the Database Tier, We need to import server certificate,ca.crt (and
intca.crt if it exists) by creating an empty wallet.
- Connect to
database and find the wallet location as below.
SQL> select
fnd_profile.value('FND_DB_WALLET_DIR') from dual
SQL> /
FND_PROFILE.VALUE('FND_DB_WALLET_DIR')
--------------------------------------------------------------------------------
/oracle/u011/mydb/db/tech_st/11.2.0/appsutil/wallet
- After setting
your environment for the database tier, navigate to the
$ORACLE_HOME/appsutil directory.
- Verify for
directory waller, if It doesn’t exist create now.
- Navigate to the
newly created wallet directory.
- Create a new
empty wallet in this directory
orapki wallet create
-wallet $ORACLE_HOME/appsutil/wallet -auto_login -pwd apps123
- FTP the
certificate files from application server to database server and import
them into this newly created wallet as below.
bash-4.1$ pwd
/oracle/u011/mydb/db/tech_st/11.2.0/appsutil/wallet
$ orapki wallet add
-wallet $ORACLE_HOME/appsutil/wallet -trusted_cert -cert root_base64.cer -pwd
apps123
$ orapki wallet add
-wallet $ORACLE_HOME/appsutil/wallet -trusted_cert -cert
intermediate_base64.cer -pwd apps123
$ orapki wallet add
-wallet $ORACLE_HOME/appsutil/wallet -trusted_cert -cert
123080_base64_certificate.cer -pwd apps123
- Test the wallet
created from above steps as below and it should return page content.
SQL> select
UTL_HTTP.REQUEST
( url =>
fnd_profile.value('APPS_FRAMEWORK_AGENT')||'/OA_HTML/IRCRESUMEUK1.xsl',
proxy =>
hr_util_web.proxyForURL(fnd_profile.value('APPS_FRAMEWORK_AGENT')),
wallet_path=>'file:'||fnd_profile.value('FND_DB_WALLET_DIR'),
wallet_password=>fnd_preference.eget('#INTERNAL','WF_WEBSERVICES','EWALLETPWD','WFWS_PWD'))
from dual;
The above query should
return HTML output.
-- This completed SSL Setup
