WebLogic配置自訂密鑰庫和SSL的操作手冊

WebLogic配置自訂密鑰庫和SSL的操作手冊

WebLogic配置自訂密鑰庫和SSL的操作手冊

(定製標識和定製信任&Keytool&TLS1.0)

1、啟用SSL連接埠

 

儲存，重啟受管Server

 

IE瀏覽器訪問

Google瀏覽器訪問

2、查看密鑰庫和SSL配置密鑰庫

SSL

 

3、手動製作identity.jks和trust.jks建立jks目錄

[weblogic@Weblogic201 ~]$ mkdir jksHL

[weblogic@Weblogic201 ~]$ cd jksHL/

 

產生標識identity.jks密鑰庫

如下標黃色背景部分的說明：

weblogicHL為“SSL—私人密鑰別名”；

keypass123為“SSL—私人密鑰密碼短語”；

storepass123為“密鑰—標識(identity)—定製標識密鑰庫密碼短語”；

storepass123為“密鑰庫—信任(trust)—定製標識密鑰庫密碼短語”；

3650為自訂認證的有效期間，單位為天；

[weblogic@Weblogic201 jksHL]$ keytool -genkey -alias weblogicHL -keyalg RSA -keypass keypass123 -keystoreidentity.jks -storepass storepass123-validity 3650

What is your first and last name?

[Unknown]: HaiLang

What is the name of your organizationalunit?

[Unknown]: GZCSS

What is the name of your organization?

[Unknown]: GZCSS

What is the name of your City or Locality?

[Unknown]: GZ

What is the name of your State or Province?

[Unknown]: GD

What is the two-letter country code forthis unit?

[Unknown]: CN

Is CN=HaiLang, OU=GZCSS, O=GZCSS, L=GZ,ST=GD, C=CN correct?

[no]: yes

匯出密鑰憑證的cer檔案

[weblogic@Weblogic201 jksHL]$ keytool -export -alias weblogicHL -file root.cer -keystore identity.jks

Enter keystore password: storepass123

Certificate stored in file

產生信任trust.jks密鑰庫

將上一步產生的root.cer密鑰憑證匯入並產生trust.jks密鑰庫

[weblogic@Weblogic201 jksHL]$ keytool -import -alias weblogicHL -trustcacerts -file root.cer -keystoretrust.jks

Enter keystore password: storepass123

Re-enter new password: storepass123

Owner: CN=HaiLang, OU=GZCSS, O=GZCSS, L=GZ,ST=GD, C=CN

Issuer: CN=HaiLang, OU=GZCSS, O=GZCSS,L=GZ, ST=GD, C=CN

Serial number: 559a5ac9

Valid from: Mon Jul 06 18:39:05 HKT 2015until: Thu Jul 03 18:39:05 HKT 2025

Certificate fingerprints:

MD5: 04:F2:4F:97:5B:8B:32:23:AB:69:D0:6A:42:1D:C7:77

SHA1:A0:B3:6F:90:08:0D:6B:55:6F:A6:13:C6:3B:C0:F4:CE:E1:B5:72:F9

Signature algorithm name: SHA1withRSA

Version: 3

Trust this certificate? [no]: yes

Certificate was added to keystore

 

至此identity.jks和trust.jks製作完成！

4、在Console配置新的密鑰庫和SSL修改預設的Demo密鑰庫“密鑰庫—更改”

選擇“定製標識和定製信任”—“儲存”

填寫密鑰庫的配置

定製標識密鑰庫：/home/weblogic/jksHL/identity.jks

定製信任密鑰庫：/home/weblogic/jksHL/trust.jks

定製標識/信任密鑰類型：jks

 

點擊“儲存”，設定完成。

SSL的配置

私人密鑰別名：weblogicHL

私人密鑰密碼短語：keypass123

 

點擊“儲存”；重啟Server，密鑰庫和SSL配置完成！

5、瀏覽器驗證Server開機記錄

[weblogic@Weblogic201 bin]$./startManagedWebLogic.sh appSrv02 http://Weblogic201:7001

.

.

JAVA Memory arguments: -Xms1024m -Xmx1024m-XX:CompileThreshold=8000 -XX:PermSize=128m -XX:MaxPermSize=256m

.

WLS Start Mode=Development

.

CLASSPATH=/home/weblogic/Oracle/Middleware/patch_wls1035/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/home/weblogic/Oracle/Middleware/patch_ocp360/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/home/weblogic/jdk1.6.0_45/lib/tools.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/home/weblogic/Oracle/Middleware/modules/features/weblogic.server.modules_10.3.5.0.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/home/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/home/weblogic/Oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/common/derby/lib/derbyclient.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/xqrl.jar:.:/home/weblogic/jdk1.6.0_45$/lib:/home/weblogic/jdk1.6.0_45$/lib/tools.jar

.

PATH=/home/weblogic/Oracle/Middleware/wlserver_10.3/server/bin:/home/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/bin:/home/weblogic/jdk1.6.0_45/jre/bin:/home/weblogic/jdk1.6.0_45/bin:/home/weblogic/jdk1.6.0_45/bin:/home/weblogic/jdk1.6.0_45/jre/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/weblogic/bin

.

***************************************************

* Tostart WebLogic Server, use a username and *

* password assigned to an admin-level user. For *

* server administration, use the WebLogic Server *

* console at http://hostname:port/console *

***************************************************

starting weblogic with Java version:

java version "1.6.0_45"

Java(TM) SE Runtime Environment (build1.6.0_45-b06)

Java HotSpot(TM) 64-Bit Server VM (build20.45-b01, mixed mode)

Starting WLS with line:

/home/weblogic/jdk1.6.0_45/bin/java-client -Xms1024m -Xmx1024m-XX:CompileThreshold=8000 -XX:PermSize=128m -XX:MaxPermSize=256m -Dweblogic.Name=appSrv02-Djava.security.policy=/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.policy-Dweblogic.security.SSL.trustedCAKeyStore=/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/cacerts -Xverify:none -da -Dplatform.home=/home/weblogic/Oracle/Middleware/wlserver_10.3-Dwls.home=/home/weblogic/Oracle/Middleware/wlserver_10.3/server-Dweblogic.home=/home/weblogic/Oracle/Middleware/wlserver_10.3/server -Dweblogic.management.discover=false -Dweblogic.management.server=http://Weblogic201:7001 -Dwlw.iterativeDev=false-Dwlw.testConsole=false -Dwlw.logErrorsToConsole=false-Dweblogic.ext.dirs=/home/weblogic/Oracle/Middleware/patch_wls1035/profiles/default/sysext_manifest_classpath:/home/weblogic/Oracle/Middleware/patch_ocp360/profiles/default/sysext_manifest_classpath weblogic.Server

Enter username to boot WebLogicserver:weblogic

Enter password to boot WebLogic server:

WebLogic Server 10.3.5.0 Fri Apr 1 20:20:06 PDT 2011 1398638 >

說明自訂的密鑰庫載入成功！

IE瀏覽器訪問

 

繼續瀏覽此網站，訪問成功！

 

查看認證資訊

 

從有效期間和憑證簽發者資訊可知，該認證正是我們之前製作的：

What is your first and last name?

[Unknown]: HaiLang

What is the name of your organizationalunit?

[Unknown]: GZCSS

What is the name of your organization?

[Unknown]: GZCSS

What is the name of your City or Locality?

[Unknown]: GZ

What is the name of your State or Province?

[Unknown]: GD

What is the two-letter country code forthis unit?

[Unknown]: CN

Is CN=HaiLang, OU=GZCSS, O=GZCSS, L=GZ,ST=GD, C=CN correct?

Google瀏覽器訪問

同樣會提示認證不安全

 

繼續前往

 

查看認證資訊

 

至此，配置自訂密鑰庫和SSL的操作已完成！

---------------------------------------------------------------------------------------------------------------------------------

12306的SSL認證加密技術：