{"id":2639,"date":"2011-06-30T13:18:41","date_gmt":"2011-06-30T18:18:41","guid":{"rendered":"http:\/\/jianmingli.com\/wp\/?p=2639"},"modified":"2011-06-30T13:20:41","modified_gmt":"2011-06-30T18:20:41","slug":"configure-serverclient-ssl-and-crl-for-oracle-oas-apache-server-10-1-2","status":"publish","type":"post","link":"https:\/\/jianmingli.com\/wp\/?p=2639","title":{"rendered":"Configure Server\/Client Side SSL and CRL for OAS Apache Server (10.1.2)"},"content":{"rendered":"

Create Wallet<\/h2><\/span>\n

Create Wallet with Oracle Wallet Manager (owm)<\/h3><\/span>\n

See this post<\/a> on how to create an Oracle Wallet with Wallet Manager.<\/p>\n

Create Wallet with orapki Utility<\/h3><\/span>\n

See orapki manual for details.<\/p>\n

Configure Server Side SSL Authentication<\/h2><\/span>\n

* Open ssl.conf file located in the Apache conf directory
\n* Modify SSLWallet directive to point to the new wallet file<\/p>\n

\r\nSSLWallet file:C:\\product\\10.1.3.1\\OracleAS_2\\Apache\\Apache\\conf\\ssl.wlt\\wallet1\r\n<\/pre>\n
* Restart Apache server
\n* Test to see that https:\/\/www.my.com can be accessed.<\/p>\n
Configure Client Side SSL Authentication<\/h2><\/span>\n
Generate Client Certificate<\/h3><\/span>\n
* See the “Generate Client Key and Certificate” section on this post<\/a> to generate a client Key and certificate using OpenSSL.<\/p>\n
Setup Firefox Browser<\/h3><\/span>\n
* See the “Setup Firefox Browser for Client Authentication” section on this post<\/a> on how to setup Firefox browser for client side SSL authentication.
\n* Restart Firefox browser<\/p>\n
Enable Client Side SSL Authentication<\/h3><\/span>\n
* Add SSLVerifyClient directive to ssl.conf file<\/p>\n
\r\n\r\n  ...\r\n  SSLVerifyClient require\r\n<\/VirtualHost>\r\n<\/pre>\n
Test Client Side SSL Authentication<\/h3><\/span>\n
* Restart Apache server
\n* Test to see that https:\/\/www.my.com can be accessed.<\/p>\n
Setup CRL<\/h2><\/span>\n
Using SSLCARevocationFile<\/h3><\/span>\n
* Copy CRL file to Apache conf\\ssl.crl directory
\n* For multiple CRL files, concatenate multiple CRL files into one master CRL file
\n* Add the following line and point SSLCARevocationFile directive to the master CRL file<\/p>\n
\r\n  SSLCARevocationFile C:\\product\\10.1.3.1\\OracleAS_2\\Apache\\Apache\\conf\\ssl.crl\\exampleca.crl\r\n<\/pre>\n
Unix Only: Using SSLCARevocationPath<\/h3><\/span>\n
* Copy CRL file, e.g. exampleca.crl, to Apache conf\/ssl.crl directory
\n* Go to Apache conf\/ssl.crl directory
\n* Run make utility to setup symbolic links to CRL files<\/p>\n
\r\n\/opt\/oracle\/oas\/Apache\/Apache\/conf\/ssl.crl >make\r\nexampleca.crl   ... 513cbb9e.r0\r\n<\/pre>\n
* Add the following line and point SSLCARevocationPath directive to the ssl.crl directory<\/p>\n
\r\n  SSLCARevocationPath \/opt\/oracle\/oas\/Apache\/Apache\/conf\/ssl.crl\/\r\n<\/pre>\n
Test CRL<\/h3><\/span>\n
* Restart Apache server
\n* Test to see that https:\/\/www.my.com<\/a> can NOT be accessed.
\n* Check that ssl_engine_log file located in the Apache logs directory contains the error message similar to the following:<\/p>\n
\r\n[error] Certificate with serial 3 (0x3) revoked per CRL from issuer \/CN=Example CA\/ST=Virginia\/C=US\/Email=ca@exampleca.com\/O=Example CA\r\n<\/pre>\n
* Try comment out SSLCARevocationFile directive and restart Apache https:\/\/www.my.com<\/a> can now be accessed again.<\/p>\n
References<\/h2><\/span>\n
* Configure Apache 2 Certificate Revocation List (CRL)<\/a>
\n* Enabling SSL for Oracle HTTP Server<\/a>
\n* http:\/\/www.nextre.it\/oracledocs\/certificates02.html<\/a>
\n* Configuring HTTP Server to use SSL in Oracle Application Server 10g (10.1.2 – 10.1.3) [ID 341904.1]<\/a>
\n* Master Note for SSL Configuration in Oracle Application Server 10g (10.1.2 – 10.1.3) [ID 1281035.1]<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Create Wallet Create Wallet with Oracle Wallet Manager (owm) See this post on how to create an Oracle Wallet with Wallet Manager. Create Wallet with orapki Utility See orapki manual for details. Configure Server Side SSL Authentication * Open ssl.conf … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[21,69,35,55],"tags":[],"class_list":["post-2639","post","type-post","status-publish","format-standard","hentry","category-apache","category-oc4j","category-oracle","category-ssl"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8cRUO-Gz","_links":{"self":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2639"}],"version-history":[{"count":20,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2639\/revisions"}],"predecessor-version":[{"id":2670,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2639\/revisions\/2670"}],"wp:attachment":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}