Generating and Signing selfsigned Cert

 Generating Keys

You can generate private and public certificate pairs by using the keytool command.
The following command creates an identity keystore (support.jks):

$JAVA_HOME/jre/bin/keytool -genkey
-alias support
-keyalg RSA
-keysize 1024
-dname "CN=localhost, OU=Identity, O=Oracle Corporation,C=US"
-keypass KEYSTORE_PASSWORD
-keystore support.jks
-storepass weblogic1

Signing the Certificates
Use the following keytool command to sign the certificates that you created:


$JAVA_HOME/jre/bin/keytool -selfcert -alias support
  -sigalg MD5withRSA -validity 2000 -keypass weblogic1
  -keystore support.jks
  -storepass KEYSTORE_PASSWORD

generating self signed certificate

 openssl req -newkey rsa:2048 -nodes -keyout signcert.key -x509 -days 365 -out sign.cer


./orapki wallet create -wallet /tmp/wallet -auto_login

./orapki wallet display -wallet /tmp/wallet

 ./orapki wallet add -wallet /tmp/wallet -dn "CN=Gms Signing Certificate" -keysize 2048 -self_signed -validity 1825 -pwd Welcome1

keytool -list -keystore /path/to/certificate

keytool -exportcert -alias certificatename.cert -file /tmp/certfilename -storepass password

OIF Fedlet error Cannot run program "keytool": error=2, No such file or directory

$JAVA_HOME/java -classpath WEB-INF/lib/opensso-sharedlib.jar:WEB-INF/lib/openfedlib.jar:install/lib/configurefedlet.jar oracle.security.fed.fedlet.install.ConfigureFedlet

Error
Cannot run program "keytool": error=2, No such file or directory


Solution:
I have resolved this error by specifying

export JAVA_OPTS="-d64"

along with other commands to export JAVA_HOME and PATH

change the communication to ssl

 Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"



Martin: NameVirtualHost

Martin: NameVirtualHost *:7777<VirtualHost *:7777>    ServerName <servername>   Redirect / https:<servername>:443/</VirtualHost>


Click to add to Favorites How to Configure HTTP Strict Transport Security (HSTS) for Oracle HTTP Server 11g? To BottomTo Bottom

In this Document
Goal
Solution

APPLIES TO:

Oracle HTTP Server - Version 11.1.1.0.0 to 11.1.1.9.0 [Release Oracle11g]
Information in this document applies to any platform.
GOAL

How to configure HTTP Strict Transport Security (HSTS) for Oracle HTTP Server 11g?


SOLUTION

There is no official documentation from Oracle for this configuration, but you can add below parameters in $INSTANCE_HOME/config/OHS/ohs1/ssl.conf.

1. Add below line to VirtualHost in $INSTANCE_HOME/config/OHS/ohs1/ssl.conf file

<VirtualHost IPaddress:sslport>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</VirtualHost>
2. Restart OHS

3. To test if HSTS has been configured, access OHS on ssl port and capture headers through "Live HTTP Headers extension" on Chrome (you can use the curl utility too)

GET / HTTP/1.1
Host: examplehost.exampledomain.com:4443
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip,deflate
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Keep-Alive
Content-Language: en
Content-Length: 11028
Content-Type: text/html
Date: Tue, 16 Sep 2014 10:29:44 GMT
ETag: "1600000002481e-2b14-4fdc5d4d121b8"
Keep-Alive: timeout=5, max=100
Last-Modified: Wed, 09 Jul 2014 17:13:47 GMT
Server: Oracle-Application-Server-11g
Strict-Transport-Security: max-age=31536000; includeSubDomains

How to Change password for OIM, MDS, SOAINFRA, OPSS, ORASDPM schema OIM 11g R2

How to Change password for OIM, MDS, SOAINFRA, OPSS, ORASDPM schema OIM 11g R2 from Oracle

SOLUTION

Description of each of the above schema could be found in the following Document

http://docs.oracle.com/cd/E27559_01/core.1112/e28516/meta.htm

Password change for the following schema can be performed in the following ways.

1. Stop all the Managed servers and Application Server.
2. Take a back up of the entire domain and take the backup of the database.
3. Start the Application Server
4. Change the xxxx_OPSS user password.
   1. Execute the following to change the password for xxxx_OPSS:
   2. SQL> alter user xxxx_OPSS identified by <new_pwd_here>;
   3. SQL>commit;
   4. Invoke wlst (oracle_common\common\bin).
   5. Run "modifyBootStrapCredential". See Oracle Fusion Middleware Application Security Guide 11g Release 1 (11.1.1) Chapter 10 Managing the Credential Store - 10.5.4 modifyBootStrapCredentia            modifyBootStrapCredential(jpsConfigFile='<DOMAIN_NAME>/config/fmwconfig/jps-config.xml', username='<xxxx>_OPSS', password='newpassword')
5. Run the setDomainenv.sh under the domain  bin folder ( ./setDomainEnv.sh)
6. Invoke the following command:
   1.  bin/java weblogic.security.Encrypt
   2.  password: <newpassword>
   3. {AES}JHyrhOMB5hVRuDU/pV0qX86qz98ZV0xWXBSEAANA4Gs=
7. Edit the <DOMAIN_NAME>\Config\jdbc\OPSSdbs.xml file:
8. Replace the current encrypted password with the newly encrypted password value e.g.
      {AES}JHyrhOMB5hVRuDU/pV0qX86qz98ZV0xWXBSEAANA4Gs=
9. Save the file.
10. Login to Weblogic Console, Navigate to Services->Data Sources
11. Click on opss-DBDS->Connection Pool and enter the new password set to xxxx_opss in step 4.2 Save
12. Restart Application Server but do not start managed servers.
13. Connect to the database with sqlplus as system user
    1. 1. Execute the following to change the password of xxx_OIM:
       2. SQL> alter user xxx_OIM identified by <new_pwd_here>;
       3. SQL>commit
       4. Execute the following to change the password for xxx_MDS:
       5. SQL> alter user xxx_MDS identified by <new_pwd_here>;
       6. SQL>commit;
       7. Execute the following to change the password for xxx_SOAINFR
       8. SQL> alter user xxx_SOAINFRA identified by new_pwd_here>;
       9. SQL>commit
       10. Execute the following to change the password for xxx_ORASDPM:
       11. SQL> alter user xxx_ORASDPM identified by <new_pwd_here>;
       12. SQL>commit;
14. Check that the passwords have been changed, by trying to login to the database with sqlplus and the four users and the new passwords
15. Open a browser and connect to WebLogic console
16. Navigate to Services->Data Sources
    1. click on oimJMSStoreDS->Connection Pool and enter the new password set to xxx_OIM in step 13.2 above
    2. Click on oimOperationsDB->Connection Pool and enter the new password set to xxx_OIM in step 13.2 above
    3. Click on ApplicationDB->Connection Pool and enter the new password set to xxx_OIM in step 13.2 above
    4. Click on mds-oim->Connection Pool and enter the new password set to xxx_MDS in step 13.5 above
    5. Click on mds-owsm->Connection Pool and enter the new password set to xxx_MDS in step 13.5 above
    6. Click on mds-soa->Connection Pool and enter the new password set to xxx_MDS in step 13.5 above
    7. Click on EDNDataSource->Connection Pool and enter the new password set to xxx_SOAINFRA in step 13.8 above
    8. Click on EDNLocalTxDataSource->Connection Pool and enter the new password set to xxx_SOAINFRA in step 13.8 above
    9. Click on SOADataSource->Connection Pool and enter the new password set to xxx_SOAINFRA in step 13.8 above
    10. Click on SOALocalTxDataSource->Connection Pool and enter the new password set to xxx_SOAINFRA in step 13.8 above
    11. Click on OraSDPMDataSource->Connection Pool and enter the new password set to xxx_ORASDPM in step 13.11 above
17.  Change OIMAuthenticationProvider configuration:
18. In the WebLogic Administrative console, navigate to Security Realms, myrealm, and then Providers.
    1. Click OIMAuthenticationProvider
    2. Click Provider Specific.
    3. In the DBPassword field, enter the new Oracle Identity Manager database schema password
    4. Click Save to save the changes
19. Change domain credential store configuration:
    1. 19.1 Login to Enterprise Manager by using the following URL:
    2. http://ADMIN_SERVER:<PORT_NUMBER>/em
    3. 19.2 Navigate to Weblogic Domain, and then DOMAIN_NAME.
    4. 19.3 Right click navigate to Security, Credentials, and then oim.
    5. 19.4 Select OIMSchemaPassword, and click Edit.
20. In the Password field, enter the new password, and click OK
21. Restart the WLS AdminServer
22. Start the SOA/OIM managed server 

orapki certificate display

orapki cert display -cert certificate_location [-summary|-complete]

• The -cert parameter specifies the location of the certificate you want to display.
• You can use either the -summary or the -complete parameter to display the following information:
  • -summary displays the certificate and its expiration date
  • -complete displays additional certificate information, including the serial number and public key

OIF generating self signed certificate How To Generate A Wallet Containing A Self Signed Certificate Using ORAPKI

How To Generate A Wallet Containing A Self Signed Certificate Using ORAPKI from Oracle

SOLUTION

This self-signed certificate should be used for testing purposes only with Oracle Application Server (OAS 10.1.2 - 10.1.3)  or Fusion Middleware (FMW 11.1.1.X)

Before attempting this with ORAPKI for FMW 11.1.1.X or FMW 12.1.X, please read: Note 1218603.1 Understanding Wallets and Keystores in Fusion Middleware 11g/12c

• Important: This is not a substitute for the Oracle Documentation or comprehensive orapki options. This provides sample commands using orapki to create a basic wallet and certificate. If you need advanced options such as SHA2 or higher keysize, ensure to add in the -sign_alg sha256 and/or -keysize 2048 parameters. See the Oracle Documentation for your version for options available on your version.

The steps below show how to create a Wallet, and a Self-Signed certificate using orapki:

1. Create the Wallet:

For OAS:

$ORACLE_HOME/bin/orapki wallet create -wallet <path_to_where_wallet_will_be_created> -pwd <wallet_pwd> -auto_login

For example:

$ORACLE_HOME/bin/orapki wallet create -wallet /oracle/app/product/oracle/russ/orapki/ -pwd Welcome1 -auto_login

For FMW:

Note the commands below show $MIDDLEWARE_HOME. $MIDDLEWARE_HOME should be used for FMW 11.1.X. If using FMW 12.1.X , use $ORACLE_HOME instead

To create a Password Protected Wallet(ewallet.p12 and cwallet.sso):

$MIDDLEWARE_HOME/oracle_common/bin/orapki wallet create -wallet <path> -auto_login

For example:

>$MIDDLEWARE_HOME/oracle_common/bin/orapki wallet create -wallet /fmw11g/instances/webtier/wallet -auto_login
    Enter password: **********
    Enter password again: **********

To create an Auto-Login Wallet (cwallet.sso only):

$MIDDLEWARE_HOME/oracle_common/bin/orapki wallet create -wallet <path> -auto_login_only

For example:

$MIDDLEWARE_HOME/oracle_common/bin/orapki wallet create -wallet /fmw11g/instances/webtier/wallet -auto_login_only

This generates an Auto-Login Wallet in the desired location. It currently contains no user certificate.



2. Create a Self Signed Certificate:

For OAS:

$ORACLE_HOME/bin/orapki wallet add -wallet <path_to_where_wallet_was_created_above> -dn '<certificate_DN_you_require> -keysize 1024 -self_signed -validity <days> -pwd <wallet_pwd>

For example:

$ORACLE_HOME/bin/orapki wallet add -wallet /oracle/app/product/oracle/russ/orapki/ -dn 'CN=server.uk.oracle.com, OU=Support, O=Oracle, L=Reading, ST=Berkshire, C=GB' -keysize 1024 -self_signed -validity 365 -pwd Welcome1

For FMW:

$MIDDLEWARE_HOME/oracle_common/bin/orapki wallet add -wallet wallet_location -dn user_dn -keysize 512|1024|2048|4096 -self_signed [-pwd][-auto_login_only]

For example:

For a Password Protected Wallet:

$MIDDLEWARE_HOME/oracle_common/bin/orapki wallet add -wallet /fmw11g/instances/webtier/wallet -dn 'CN=server.uk.oracle.com, OU=Support, O=Oracle, L=Reading, ST=Berkshire, C=GB' -keysize 1024 -self_signed -validity 365 -pwd Welcome1

 For an Auto-Login Wallet:

 $MIDDLEWARE_HOME/oracle_common/bin/orapki wallet add -wallet /fmw11g/instances/webtier/wallet -dn 'CN=server.uk.oracle.com, OU=Support, O=Oracle, L=Reading, ST=Berkshire, C=GB' -keysize 1024 -self_signed -validity 365 -auto_login_only

Note: On Windows use double quotes for the -dn option i.e: -dn "CN=server.uk.oracle.com,
OU=Support, O=Oracle, L=Reading, ST=Berkshire, C=GB"

If you open the Wallet in Wallet Manager, you will see it says Certificate: Ready, and also contains the Trusted Certificate.

This Wallet is ready to use with Application Server or Fusion Middleware for testing purposes.

REFERENCES

NOTE:1281035.1 - Master Note for SSL Configuration in Oracle Application Server 10g (10.1.2 - 10.1.3)
NOTE:1628909.1 - Master Note for SSL Configuration in Fusion Middleware 12c (12.1.x)
NOTE:1218695.1 - Master Note for SSL Configuration in Fusion Middleware 11g
NOTE:341904.1 - Configuring HTTP Server to Use SSL in Oracle Application Server 10g (10.1.2 - 10.1.3)
NOTE:342155.1 - Configuring Web Cache with SSL in Oracle Application Server 10G Release 2 (10.1.2.X.X)