Configure Server/Client Side SSL and CRL for OAS Apache Server (10.1.2)

See this post on how to create an Oracle Wallet with Wallet Manager.

See orapki manual for details.

* Open ssl.conf file located in the Apache conf directory
* Modify SSLWallet directive to point to the new wallet file

SSLWallet file:C:\product\10.1.3.1\OracleAS_2\Apache\Apache\conf\ssl.wlt\wallet1

* Restart Apache server
* Test to see that https://www.my.com can be accessed.

* See the “Generate Client Key and Certificate” section on this post to generate a client Key and certificate using OpenSSL.

* See the “Setup Firefox Browser for Client Authentication” section on this post on how to setup Firefox browser for client side SSL authentication.
* Restart Firefox browser

* Add SSLVerifyClient directive to ssl.conf file

<VirtualHost _default_:443>
  ...
  SSLVerifyClient require
</VirtualHost>

* Restart Apache server
* Test to see that https://www.my.com can be accessed.

* Copy CRL file to Apache conf\ssl.crl directory
* For multiple CRL files, concatenate multiple CRL files into one master CRL file
* Add the following line and point SSLCARevocationFile directive to the master CRL file

  SSLCARevocationFile C:\product\10.1.3.1\OracleAS_2\Apache\Apache\conf\ssl.crl\exampleca.crl

* Copy CRL file, e.g. exampleca.crl, to Apache conf/ssl.crl directory
* Go to Apache conf/ssl.crl directory
* Run make utility to setup symbolic links to CRL files

/opt/oracle/oas/Apache/Apache/conf/ssl.crl >make
exampleca.crl   ... 513cbb9e.r0

* Add the following line and point SSLCARevocationPath directive to the ssl.crl directory

  SSLCARevocationPath /opt/oracle/oas/Apache/Apache/conf/ssl.crl/

* Restart Apache server
* Test to see that https://www.my.com can NOT be accessed.
* Check that ssl_engine_log file located in the Apache logs directory contains the error message similar to the following:

[error] Certificate with serial 3 (0x3) revoked per CRL from issuer /CN=Example CA/ST=Virginia/C=US/Email=ca@exampleca.com/O=Example CA

* Try comment out SSLCARevocationFile directive and restart Apache https://www.my.com can now be accessed again.

* Configure Apache 2 Certificate Revocation List (CRL)
* Enabling SSL for Oracle HTTP Server
* http://www.nextre.it/oracledocs/certificates02.html
* Configuring HTTP Server to use SSL in Oracle Application Server 10g (10.1.2 – 10.1.3) [ID 341904.1]
* Master Note for SSL Configuration in Oracle Application Server 10g (10.1.2 – 10.1.3) [ID 1281035.1]