7 Enabling SSL

7.1 Overview of SSL

In Oracle Application Server, components send requests to and receive responses from other components. These components can be Oracle Application Server components (such as OracleAS Single Sign-On, OracleAS Web Cache, or Oracle HTTP Server) or external clients such as browsers.

To secure these communications, you can configure Oracle Application Server to use SSL, which is an industry standard for securing communications. Oracle Application Server supports SSL versions 2 and 3, as well as TLS version 1.

SSL secures communication by providing message encryption, integrity, and authentication. The SSL standard allows the involved components (such as browsers and HTTP servers) to negotiate which encryption, authentication, and integrity mechanisms to use.

7.2 Using the SSL Configuration Tool

The SSL Configuration Tool is designed to be run after a successful Oracle Application Server installation to automate many of the manual steps currently required for securing HTTP. You use the tool after all Oracle homes you plan to install are successfully installed. If you have a topology where both an OracleAS Infrastructure and middle tier are present, be sure to run the SSL Configuration Tool against the OracleAS Infrastructure first, then the middle tier.

If you install Oracle Application Server and choose to make some configuration changes before running the SSL Configuration Tool, you should run the tool and then refer to the SSL Configuration Tool log files to verify that your changes were not overwritten. The SSL Configuration Tool creates log files in the directory from which the tool is run. A new log file is created each time the tool is run. For these reasons, it is suggested that you create a separate directory from which you can run the SSL Configuration Tool.

If you encounter any problems, you should run the SSL Configuration Tool with the -rollback option to revert back to your configuration environment prior to running the tool.

The SSL Configuration Tool is available with any Oracle Application Server installation type. OracleAS Infrastructure installations are the only installation type that support SSL configuration during the installation. This option is available on one of the installation screens. See Oracle Application Server Installation Guide for more information.

In some cases, the SSL Configuration Tool cannot completely configure SSL for your specific topology. When this occurs, you should refer to the appropriate component documentation for instructions on how to complete your SSL configuration manually. For some links to documentation containing manual steps, see Chapter 14, "Using the SSL Configuration Tool" in the Oracle Application Server Administrator's Guide.

SSLConfigTool ( -config_w_prompt
               | -config_w_file <input_file_name>
               | -config_w_default
               | -rollback )
               [-dry_run]
               [-wc_for_infra]
               [-secure_admin]
               [-opwd <orcladmin_pwd>]
               [-ptl_dad <dad_name>]
               [-ptl_inv_pwd <ptl_inv_pwd>]

7.3 SSL Communication Paths in the Infrastructure

This section identifies all the SSL communication paths used in the Oracle Application Server Infrastructure, and provides cross-references to the configuration instructions in component guides in the Oracle Application Server documentation library.

The following lists the communication paths through the Oracle Application Server Infrastructure, and the related SSL configuration instructions:

• Oracle HTTP Server to the OC4J_SECURITY instance

  To configure AJP communication over SSL, you must configure how mod_oc4j communicates with the iaspt daemon. To do this, follow the instructions in the Oracle HTTP Server Administrator's Guide, the section titled "Configuring mod_oc4j to Use SSL."

• Oracle HTTP Server to iaspt (Port Tunneling) and then to the OC4J_SECURITY instance

  To configure this connection path for SSL, follow the instructions in the Oracle HTTP Server Administrator's Guide, the section titled "Understanding Port Tunneling."

• OC4J_SECURITY instance to Oracle Internet Directory

  To configure this connection path for SSL, follow the instructions in the Oracle Application Server Single Sign-On Administrator's Guide. It explains how to configure SSL communication between the browser and the OracleAS Single Sign-On server (section titled "Enable SSL on the Single Sign-On Middle Tier".

  Oracle Delegated Administration Services is SSL-enabled after you configure the Oracle HTTP Server for SSL. The Oracle Delegated Administration Services communication to Oracle Internet Directory is always SSL-enabled; you do not have to perform any configuration tasks to accomplish this. (OracleAS Single Sign-On, Oracle Application Server Certificate Authority, and Oracle Delegated Administration Services communicate with Oracle Internet Directory in SSL mode by default.)

• Oracle Directory Integration and Provisioning to Oracle Internet Directory and Oracle Internet Directory replication server to Oracle Internet Directory

  As shown in Figure 7-1, you can configure several components and communication paths for SSL. The following lists references to the instructions for each:

  • Communication between the Oracle Internet Directory Replication server and the Oracle Internet Directory server: Oracle Application Server High Availability Guide, section titled "Secure Sockets Layer (SSL) and Oracle Internet Directory Replication"

  • Communication between Oracle Directory Integration and Provisioning and the Oracle Internet Directory server: Oracle Identity Management Integration Guide, chapter titled "Oracle Directory Integration and Provisioning Server Administration"

• The OC4J_SECURITY instance to the Metadata Repository database and Oracle Internet Directory to the Metadata Repository database

  If Oracle Internet Directory is configured to accept SSL connections on the SSL port specified, then you need to specify only the SSL protocol and SSL port in the JDBC URL requesting an application, as follows:

  ldaps://host:sslport/...

  Note that when you are using a secure connection, you must add an s to the name of the protocol. For example, use ldaps instead of ldap.

  If Oracle Internet Directory is not configured to accept SSL connections on the SSL port, then you must modify the configuration. Refer to the section titled "Secure Sockets Layer (SSL) and the Directory" in the Oracle Internet Directory Administrator's Guide.

Figure 7-1 Identity Management Components and SSL Connection Paths

Description of "Figure 7-1 Identity Management Components and SSL Connection Paths"

7.4 Common SSL Configuration Tasks for the Infrastructure

This section provides references to the component guides in the Oracle Application Server documentation library that provide instructions for configuring SSL in individual components.

7.5 SSL Communication Paths in the Middle Tier

This section identifies all SSL communication paths used in the Oracle Application Server middle-tier installation types, and provides cross-references to the configuration instructions in component guides in the Oracle Application Server documentation library.

The following lists the communication paths through the Oracle Application Server middle tier, and the related SSL configuration instructions:

• External Clients or Load Balancer to Oracle HTTP Server

  To configure the Oracle HTTP Server for SSL, follow the instructions in the Oracle HTTP Server Administrator's Guide, section titled "Enabling SSL."

• External Clients or Load Balancer to OracleAS Web Cache

  To configure OracleAS Web Cache for SSL, follow the instructions in "Configuring OracleAS Web Cache for HTTPS Requests" in the Oracle Application Server Web Cache Administrator's Guide.

• OracleAS Web Cache to Oracle HTTP Server

  To configure OracleAS Web Cache for SSL, follow the instructions in "Configuring OracleAS Web Cache for HTTPS Requests" in the Oracle Application Server Web Cache Administrator's Guide.

• Oracle HTTP Server to OC4J Applications (AJP)

  To configure the AJP communication over SSL, you must configure mod_oc4j's communication with the iaspt daemon. To do this, follow the instructions in the Oracle HTTP Server Administrator's Guide, section titled "Configuring mod_oc4j to Use SSL."

• Oracle HTTP Server to iaspt and then to OC4J

  To configure this connection path for SSL, follow the instructions in the Oracle HTTP Server Administrator's Guide, section titled "Understanding Port Tunneling."

• OC4J (the JAAS provider) to Oracle Internet Directory

  To configure the provider, follow the instructions in the Oracle Application Server Containers for J2EE Security Guide. To configure the provider for SSL, set the SSL_ONLY_FLAG to true.

• OC4J to the database (ASO)

  If Oracle Internet Directory configured to accept SSL connections on the SSL port specified, you need only specify the SSL protocol and SSL port in the JDBC URL requesting an application, as follows:

  ldaps://host:sslport/...

  Note that when you are using a secure connection, you must add an s to the name of the protocol. For example, use ldaps instead of ldap.

  If Oracle Internet Directory is not configured to accept SSL connections on the SSL port, you must modify the configuration. See Oracle Internet Directory Administrator's Guide, section titled "Secure Sockets Layer (SSL) and the Directory."

• ORMI (Oracle Remote Method Invocation, a custom wire protocol) over HTTP and HTTP over SSL

  ORMI over SSL is not supported. To configure similar functionality, you can configure ORMI over HTTP, and then configure HTTP for SSL.

  See the Oracle Application Server Containers for J2EE Services Guide, section titled "Configuring ORMI Tunnelling Through HTTP" for instructions on how to configure ORMI/HTTP.

• SSL into standalone OC4J (HTTPS)

  To configure this connection path for SSL, follow the instructions in the Oracle Application Server Containers for J2EE Security Guide, section titled "Configuring SSL in OC4J" explains how to use SSL to secure communication between clients and an OC4J instance.

• OracleAS Portal Parallel Page Engine (the servlet in the OC4J_PORTAL instance) to OracleAS Web Cache (HTTPS)

  To configure this connection path for SSL, follow the instructions in the Oracle Application Server Containers for J2EE Security Guide, section titled "Configuring SSL in OC4J."

7.6 Common SSL Configuration Tasks for the Middle Tier

This section identifies some commonly used SSL configurations in the Oracle Application Server middle-tier installation types, and provides cross-references to the configuration instructions in component guides in the Oracle Application Server documentation library.