Configure SSL for JD Edwards at Royal Koopmans

 

 

Content

1.      Create Java keystore. 2

2.      Generate a Certificate Signing Request from your Keystore. 2

3.      Import the CA root and wildcard certificate into the java keystore. 3

4.      Enable SSL in Weblogic. 3

5.      Configure Weblogic to use the java keystore. 3

6.      Enable support for wildcard certificates in Weblogic. 4

7.      Adjust HTML Server in Server Manager. 4

8.      Renew certificate. 5

Documentation. 6

 

 
 

 

  1. Create Java keystore

 

From a command-line execute the commands in bold below.

 

d:

cd d:\Java_64\jdk\bin

keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore    d:\Oracle\SSL\erp_royalkoopmans_com.jks -dname "CN=erp.royalkoopmans.com, OU=Royal Koopmans, O=IT Department, L=Leeuwarden, ST=Friesland, C=NL"

 

Enter keystore password: < Staat in Lastpass >

Re-enter new password: < Staat in Lastpass >

 

Enter key password for <server>

        (RETURN if same as keystore password): [RETURN]

 

 

Warning:

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore d:\Oracle\SSL\erp_royalkoopmans_com.jks -destkeystore d:\Oracle\SSL\erp_royalkoopmans_com.jks -deststoretype pkcs12".

 

 

 

keytool -importkeystore -srckeystore d:\Oracle\SSL\royalkoopmans_com.jks -destkeystore

   d:\Oracle\SSL\royalkoopmans_com.jks -deststoretype pkcs12

 

Enter source keystore password: < Staat in Lastpass >

 

Entry for alias server successfully imported.

Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

 

 

 

Warning:

Migrated "d:\Oracle\SSL\royalkoopmans.com.jks" to Non JKS/JCEKS. The JKS keystore is backed up as "d:\Oracle\SSL\royalkoopmans.com.jks.old".

 

 

 

  1. Generate a Certificate Signing Request from your Keystore

 

keytool -certreq -alias server -keyalg RSA -file d:\Oracle\SSL\erp_royalkoopmans.com.csr

 -keystore d:\Oracle\SSL\erp_royalkoopmans_com.jks

 

Enter keystore password: < Staat in Lastpass >

 

 

This creates the file d:\Oracle\SSL\royalkoopmans_com.csr.

 

Sent this file to the Certificate Authority authorized to sign the request on behalf of Royal Koopmans.

 

 

  1. Import the CA root and wildcard certificate into the java keystore

 

Back-up d:\Oracle\SSL

 

 

keytool -import -trustcacerts -alias server -file d:\Oracle\SSL\erp_royalkoopmans_com.p7b 
-keystore d:\Oracle\SSL\erp_royalkoopmans_com.jks

 

 

 

 

 

 

  1. Enable SSL in Weblogic

 

  1. On your WebLogic server, expand the Servers node and select the server you need to configure.

 

  1. Next, go to Configuration-->General.

 

  1. Click Lock & Edit

 

  1. Select SSL Listen Port Enabled

 

  1. Set the SSL Listen Port to 443 (for production/p-jdewe01 only !!)

 

  1. Click Save and Activate Changes.

 

 

  1. Configure Weblogic to use the java keystore

 

  1. On your WebLogic server, expand the Servers node and select the server you need to configure.

 

  1. Next, go to Configuration--> Keystores.

 

Note: Under Keystore Configuration, several default Keystores or previously installed Keystores may be displayed.

 

  1. To enable your new keystore, under Keystores, click the Change... link

 

  1. Select Custom Identity and Java Standard Trust as your keystore configuration type, and then click Save.

 

  1. As the Custom Identity Keystore file name, type the full path to the erp_royalkoopmans_com.jks file on your WebLogic server, including the file name itself.

 

  1. For Custom Identity Keystore Type, select jks.

 

  1. For Custom Identity Keystore PassPhrase, type the <password> you created when creating the Keystore.

 

  1. When asked again, type your Keystore password and confirm.

 

(Leave the Trust section as it is.)

 

  1. Click Save

 

  1. Click the SSL tab.

 

  1. Accept Keystores as the default value for Identity and Trust Locations.

 

  1. Specify the Private Key Alias (“server”) and Passphrase (identical to the keystore password) that were used when creating your Keystore.

 

  1. Click Save.

 

 

  1. Enable support for wildcard certificates in Weblogic

 

  1. On your WebLogic server, expand the Servers node and select the server you need to configure.

 

  1. Next, go to Configuration-->SSL.

 

  1. Go to Advanced. Click Lock & Edit

 

  1. Set the Hostname Verification field to Custom Hostname Verifier.

 

  1. In the Custom Hostname Verifier field, enter the name of the implementation of the weblogic.security.SSL.HostnameVerifier interface: 

 

weblogic.security.utils.SSLWLSWildcardHostnameVerifier

 

  1. Click Save and Activate Changes.

 

  1. Navigate to d:\Oracle\Middleware\user_projects\domains\base_domain\bin and update setDomainEnv.cmd with this line:

 

set EXTRA_JAVA_PROPERTIES=-Dweblogic.security.SSL.hostnameVerifier=weblogic.security.utils.SSLWLSWildcardHostnameVerifier

 

 

 

 

 

 

 

 

 

 

 

  1. Restart the Admin and Manager Server.

 

  1. Check logs

  1. Adjust HTML Server in Server Manager

 

  1. In Server Manager, click on the link of the HTML Server
  2. In the Instance Access Configuration section, adjust the domain name to royalkoopmans.com and enable SSL

Perform this actions for each HTML Server.

 

  1. Renew certificate

 

  1. Logon to P-JDEWE01
  2. Create a back-up of d:\Oracle\SSL
  3. From a command-line navigate to d:\Java_64\jdk\bin
  4. Create a new certificate request by executing the following command:

(Maybe you will first have to delete the existing request:

keytool.exe -delete -alias server) *de alias is sever*

 

keytool -certreq -alias server -keyalg RSA -file d:\Oracle\SSL\new_erp_royalkoopmans.com.csr

-keystore d:\Oracle\SSL\erp_royalkoopmans_com.jks

Enter keystore password:  Staat in Lastpass

  1. Import the new certificate:

keytool -import -trustcacerts -alias server -file d:\Oracle\SSL\new_erp_royalkoopmans_com.p7b 

-keystore d:\Oracle\SSL\erp_royalkoopmans_com.jks

Enter keystore password: Staat in Lastpass

 

  1. Na deze bewerking moet er worden ingelogd op weblogic dan naar environmentà servers en dan kiezen voor J2EE_HTML_PD920

A screenshot of a computerDescription automatically generated


 

 

  1. Daarna naar: Control à Start/Stop en kiezen voor Restart SSL

A screenshot of a computerDescription automatically generated with medium confidence

  1. Kies bij de laatste melding nog voor Yes: A screenshot of a computerDescription automatically generated with medium confidence

Nieuwe sessies zullen dan het nieuwe certificaat krijgen

 

 

 


 

Documentation

 

  • How to Configure WebLogic Server to Support Wildcard Certificates (Doc ID 1474989.1)
  • https://www.digicert.com/kb/csr-ssl-installation/weblogic-8-12x.htm
  • https://coderanch.com/t/692329/application-servers/Wildcard-Certificate-WebLogic-cR