Generate certificate chains with OpenSSL (keytool) for 2-way SSL authentication of WebLogic (Doc ID 1497413.1)

Last updated on AUGUST 03, 2023

Applies to:

Oracle WebLogic Server - Version 9.2 and later
Information in this document applies to any platform.

Purpose

For development, deployment within intranet, customer may expect to build a experimental PKI infrastructure with OpenSSL instead of commercial vendor, since they have full control of the Certificate Authority distribution. This practice gives detailed instruction to generate 3-tier certificate chain, and how to configure them to support 2-way SSL authentication against WebLogic.

Scope

Details

	To view full details, sign in with your My Oracle Support account.
	Don't have a My Oracle Support account? Click to get started!

In this Document

1 Setting up OpenSSL to Create Certificates

1.1 Create base directory

1.2 Create two subdirectories

1.3 Create a database to keep track of each signed certificate

1.4 Customize OpenSSL default options

1.5 Create a root certificate

1.6 Create an intermediate certificate & sign it with root CA

1.7 Generate server Identity CSR with keytool

1.8 Sign CSR with intermediate CA

1.9 Import certificate chains into keystore

2 Configure WebLogic Server (Server Identity)

3 Client Identity

3.1 Create myIdentity CSR

3.2 Sign myIdentity with Demo Intermediate CA

3.3 Import Demo CA (root) as trusted item in mykeystore.jks

3.4 Import myIdentity certificate chain into keystore

3.5 Re-configure to support client certificate check

3.5.2 Google Chrome Browser

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.