Saucepan

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
======Install APEX SSL======
Follow the process described in [[http://download.oracle.com/docs/cd/B15904_01/web.1012/b14007/ssl.htm|Enabling SSL for Oracle HTTP Server]].

Locations of the appropriate Oracle components can be determined by using Oracle Universal Installer.

In particular ensure:
  - the correct instance of Oracle Application Server (containing Oracle HTTP Server) is used
  - the correct wallet and version is used
  - the server type of 'oracle' is selected when generating the public key in Thawte

=====Useful URLs=====
  * http://download.oracle.com/docs/cd/B14099_11/web.1012/b14007/ssl.htm#sthref1468
  * http://download.oracle.com/docs/cd/B14099_11/core.1012/b13995/wallets.htm#BABEGJGA
  * http://www.nextre.it/oracledocs/certificates02.html

=====Create New SSL Certificate=====
  - Log onto the machine 'oracle' (Windows 2000 box).
  - Open up a console (Start->Run->Type 'cmd' and press enter).
  - Enter the following to launch the Oracle Wallet Manager
  - <code>C:</code>
  - <code>cd C:\oracle\product\10.2.0\db\bin</code>
  - <code>C:\oracle\product\10.2.0\db\BIN\launch.exe "C:\oracle\product\10.2.0\db\bin" owm.cl</code>
  - Click on the file menu Wallet->New
  - Enter a password (ensure that this is stored in keypass) and set Wallet Type to 'Standard'.
  - Press Okay and you will be asked if you want to create a certificate request at this time. Click Yes and fill in the following information (Clicking Ok when done).
  - * Common Name: apex.example.com
  - * Organizational Unit: Department
  - * Organization: Company Name
  - * Location/City: = City
  - * State/Province: = County
  - * Country: GB
  - * Key Size: 2048
  - The wallet is then populated with a Certificate request. Click on this. On the right hand side of the screen you will see a load of text, copy all of this and create a file with it called apex.csr
  - Also, paste this into the thwarte web page when asked for CSR (Certificate Signing Request) and order your certificate.
  - In the Wallet Manager, click Wallet->Save As and save to ''C:\oracle\wallets\as2014''. You asked if you want to create this location. Say yes.
  - Once Thwate has generated the certificate, they will email it to you. Save this as apex.cer
  - You will also have to log into the certificate center ([[https://www.thawte.com/log-in/index.html|here]]), select the certificate and click 'Pick up certificate' under the 'Status' tab.
  - You then set the format to X.509 (Apache and others). You will then see three certificates displayed named
  - * Primary Intermediate Certificate
  - * Secondary Intermediate Certificate
  - * End Entity Certificate
  -Copy these to text files and save them respectively
  - * thwate.primary.intermediate.cer
  - * thwate.secondary.intermediate.cer
  -*  thwate.end.entity.cer
  - Get the ROOT CA from Thwate from [https://search.thawte.com/support/ssl-digital-certificates/index?page=content&actp=CROSSLINK&id=AR1470 here] and call it thwate.root.cer
  - Then, in the wallet manager, click "Operations->Import Trusted Certificate...". Import 
  - * thwate.primary.intermediate.cer
  - * thwate.secondary.intermediate.cer
  - * thwate.end.entity.cer
  - * thwate.root.cer
  - Then, in the wallet manager, click "Operations->Import User Certificate...". Import apex.cer
  - Save the wallet and close the wallet manager.
  - Now you have a wallet ready to go. All we have to do is point the Oracle web server at the new wallet and restart the web server.
=====Reconfigure Oracle HTTP Server=====
  - To point the Oracle web server at the new wallet, edit ''C:\oracle\product\10.2.0\db\Apache\Apache\conf\ssl.conf''
  - Edit the line with ''SSLWallet file:C:\oracle\wallets\as''
  - Ensure ''C:\oracle\product\10.2.0\db\opmn\conf\opmn.xml'' has start mode set to "ssl-enabled" instead of "ssl-disabled".
  - Reload OPMN ''C:\oracle\product\10.2.0\db\opmn\bin\opmnctl reload''
  - Stop Oracle HTTP Server ''C:\oracle\product\10.2.0\db\opmn\bin\opmnctl verbose stopproc ias-component=HTTP_Server''
  - Start Oracle HTTP Server ''>C:\oracle\product\10.2.0\db\opmn\bin\opmnctl verbose startproc ias-component=HTTP_Server''

=====Replace SSL Certificate on Glassfish=====
When we used to run Oracle 10 on Windows Server 2000, we ran APEX on the Oracle HTTP server. Since upgrading to APEX 4.2.2, we have run the APEX listener on a Glassfish Application Server running on Linux.

Install APEX as shown here: Install_APEX

Then SSH to the machine apex.example.com and<code>su - oracle</code>
<code>cd /oracle/glassfish/glassfish4/glassfish/domains/domain1/config</code>
Backup your current keystore and trust store
<code>cp cacerts.jks cacerts.jks.backup`date +"%Y-%m-%d"`
cp keystore.jks keystore.jks.backup`date +"%Y-%m-%d"`</code>
Change master-password for the server. Stop the domain and issue
<code>asadmin change-master-password --savemasterpassword</code>
Delete the default self-signed certificate
<code>keytool -delete -alias s1as -keystore cacerts.jks -storepass <store_passwd>
keytool -delete -alias s1as -keystore keystore.jks -storepass <store_passwd></code>
Generate a new key pair for the application server. In addition to generating a key pair, the command wraps the public key into a self-signed certificate and stores the certificate and the private key in a new keystore entry identified by the alias. Please leave alias as s1as – the default alias of Glassfish keystore.
<code>keytool -genkeypair -keyalg RSA -keystore keystore.jks -validity 1095 -alias s1as</code>
You will be asked for the following information. For HTTPS hostname verification, it is important to ensure that the name of the certificate (CN) matches the fully-qualified hostname of your site (fully-qualified domain name). If the names do not match, clients connecting to the server will see a security alert stating that the name of the certificate does not match the name of the site
<code>
What is your first and last name?
  [Unknown]:  apex.example.com
What is the name of your organizational unit?
  [Unknown]:  Department
What is the name of your organization?
  [Unknown]:  Company Name
What is the name of your City or Locality?
  [Unknown]:  City
What is the name of your State or Province?
  [Unknown]:  County
What is the two-letter country code for this unit?
  [Unknown]:  GB
Is CN=apex.example.com, OU=Department, O=Company Name, L=City, ST=Hampshire, C=GB correct?
  [no]:  yes</code>

Generate a Certificate Signing Request (CSR):
<code>keytool -certreq -alias s1as -file s1as.csr -keystore keystore.jks -storepass <password></code>
Backup the file and submit the CSR to a Certificate Authority -Thawte
https://ssl-certificate-center.thawte.com/process/retail/console_login?application_locale=THAWTE_US

Download Twawte secondary and primary certificates according to this document

https://search.thawte.com/support/ssl-digital-certificates/index?page=content&id=SO15518&actp=search&viewlocale=en_US

Use the "SSL Web Server" links to download Primary.crt and Secondary.crt certificates 

Download your certificate when it is ready and Store the signed server certificate from the CA, including the markers —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–, into a file such ass1as.cert. Download the CA certificate and any intermediate CA certificates and store them in local files.

Import the CA certificate (if not already present) and any intermediate CA certificates (if not already present) indicated by the CA into the truststore cacerts.jks:
<code>keytool -import -v -trustcacerts -alias s1as -file Primary.crt -keystore cacerts.jks -storepass <password>
keytool -import -v -trustcacerts -alias  Intermediate -file Secondary.crt -keystore cacerts.jks -storepass <password></code>
Download the certficate from Thwate (p7b format)

Replace the original self-signed certificate with the certificate you obtained from the CA, as stored in a file such as s1as.p7b. This will import the certificate using the same original alias s1as, keytool treats it as a command to replace the original certificate with the certificate obtained as a reply to a CSR. After running the command, you should see that the certificate s1as in the keystore is no longer the original self-signed certificate, but is now the response certificate from the CA. 
<code>keytool -import -v -trustcacerts -alias  s1as -file nameoffile.p7b -keystore keystore.jks -storepass <password></code>
Test certificate in keystore:
<code>keytool -v -list -keystore keystore.jks</code>
Start domain:
<code>asadmin start-domain domain1</code>
Enable secure communications on port 4848 by issuing command:
<code>asadmin enable-secure-admin
asadmin restart-domain domain1</code>
<code></code>
=====Change SSL Cert On Linux APEX=====
<code>su - oracle
cd /oracle/glassfish/glassfish4/glassfish/domains/domain1/config

cp cacerts.jks cacerts.jks.backup`date +"%Y-%m-%d"`
cp keystore.jks keystore.jks.backup`date +"%Y-%m-%d"`

keytool -delete -alias s1as -keystore cacerts.jks -storepass Pa55word
keytool -delete -alias s1as -keystore keystore.jks -storepass Pa55word

keytool -import -v -trustcacerts -alias s1as -file test/crossRootCA.cer -keystore cacerts.jks -storepass Pa55word
keytool -import -v -trustcacerts -alias  Intermediate -file test/IntermediateCA.cer -keystore cacerts.jks -storepass Pa55word

keytool -import -v -trustcacerts -alias  s1as -file test/ssl_certificate.p7b -keystore keystore.jks -storepass Pa55word
keytool -v -list -keystore keystore.jks
asadmin start-domain domain1</code>