Installation of the VeriSign digital certification in Oracle HTTP Server

Question

I am not obtaining to generate to the pair of keys and the CSR in Oracle HTTP Server, will have some tip I is thankful.
Thanks
Leandro

Answer 1

Hi Leandro,
Here are some steps to setup digital certificates into Oracle HTTP Server for Unix.
1. The temporary working directory is /u01/tmp/myssl.
2. The contents of <9iAS_HOME>/Apache/open_ssl/bin have been copied to the
temporary working directory created in Assumption #1.
3. SSL file names are priv.key (private key), certreq.csr (certificate request),
and cert.crt (SSL certificate). The actual SSL certificate file could be
named other than 'cert.crt'.
4. By default, SSL is configured using port 443, which requires ROOT access to
start the web listener.
If you want to change this from the default port, you will need to change
the following two parameters in the httpd.conf file to an unused port number:
Listen 443
<VirtualHost default:443>
5. All necessary UNIX environment variables are set correctly for your Oracle
product before implementing these procedures.
6. User must be familiar with UNIX concepts like shell navigation, UNIX
environments, file manipulation/search, file copy/backups, etc.
How to Request and Configure an SSL Certificate for Oracle9i Application Server
Step-by-Step Instructions:
1. Change your present working directory to the temporary working directory, e.g.,
/u01/tmp/myssl. Ensure the contents of <9iAS_HOME>/Apache/open_ssl/bin have
been copied into this temporary working directory.
2. Copy 5 large files, each at least 250KB, into your temporary working directory.
Suggest looking in any /bin directory for large sized binary files. Execute
the following command to generate the random character file:
     % openssl md5 * > rand.rnd
3. Execute the following command to generate the private key (priv.key):
% openssl genrsa -rand rand.rnd -des3 1024 > priv.key
     - when prompted, enter a "PEM pass phrase" password
     - re-enter password when prompted to verify password
     -- remember the pass phrase password you entered
     - this command generates the priv.key file and associated pass phrase
     - set permissions on the priv.key file to prevent unauthorized editing
     % chmod 400 priv.key
     - backup the priv.key file to a secure location
NOTE
The PEM pass phrase must be at least 4 characters in length. Remember this
pass phrase, you will be prompted to enter it in the next step and each
time you start up the Oracle HTTP Server (OHS) in SSL mode.
Optionally, you can unencrypt the value of the private key, so that you
will not be prompted for the PEM pass phrase every time you start up OHS
in SSL mode.
To unencrypt the private key, execute the following two commands (Note:
ensure file permissions set to r+w):
     % cp priv.key priv.key.bak
     % openssl rsa -in priv.key.bak -out priv.key
- the demo certificate shipped with Oracle9iAS does not require a pass
phrase to start OHS in SSL mode.
- on UNIX, to generate the certificate request and start OHS in SSL mode,
the pass phrase must be entered, unless you executed the above steps
to unencrypt.
- on Windows NT/2000, if a certificate is used that has a pass phrase,
the OHS will hang; therefore, on Windows NT/2000, you must execute
the steps to unencrypt.
4. Execute the following command to generate an SSL certificate request
(certreq.csr) based on your private key.
     % openssl req -new -key priv.key -out certreq.csr -config openssl.cnf
     - when prompted, enter the "PEM pass phrase" set when the private key
was created.
     - when prompted, enter the requested fields that make up the
Distinguished Name.
     -- each entry must be valid information, i.e., email, state, location, etc.
     - when prompted for the "Common Name", you MUST enter the fully
qualified name which will be accessed via client browsers; e.g.,
if clients will use:
https://mysite.domain.com
     -- then, you must enter mysite.domain.com as the "Common Name"
     - the requested 'extra' attributes, i.e., "challenge password" and
"optional company name", are OPTIONAL; just hit ENTER to use NULL values.
5. You should now have the private key and certificate request files (priv.key
and certreq.csr) in your temporary working directory.
NOTE
At this point, you can use your certificate request file 'certreq.csr' to
order a valid SSL certificate from any CA-vendor, e.g., Verisign.
After you receive your SSL certificate, skip to Step #6 for instructions
on how to deploy your SSL files.
OPTIONAL
You can start 9iAS in SSL mode (see Step #12) and test the pre-installed demo
certificate and private key included for testing purposes.
It is a good idea to test to be sure the Oracle HTTP Server SSL mode works
successfully before deploying your new SSL certificate. To try these demo
files, access the 9iAS index page in a browser using the HTTPS protocol and
the appropriate SSL Listen port. URL format:
https://myhost.domain.com:<ssl_port>
The user will see a Security Alert (IE), or New Site Certificate (Netscape)
warning message, click Continue/Next to accept.
OPTIONAL
To create a self-signed certificate, execute the following commands:
(csh) % setenv RANDFILE rand.rnd
<sh or ksh> % export RANDFILE=rand.rnd
% openssl x509 -req -days 30 -in certreq.csr -signkey priv.key > tempcert.crt
- when prompted, enter the "PEM pass phrase" set when the private key was created.
- this command generates a temporary self-signed certificate file 'tempcert.crt'
valid for 30 days, which can be used while awaiting a valid SSL certificate
purchased from an authorized CA-vendor.
- if this option is used, after generating the 'tempcert.crt' file, skip to
Step #6 for instructions on how to deploy your SSL files.
OPTIONAL
These steps are specifically for requesting a TRIAL certificate from the
CA-vendor Verisign.
- Go to www.verisign.com and click on "Free Guides and Trials" link and
follow instructions to request a "Free Trial SSL ID". During this process,
you will be asked to provide certificate request information.
- Open the 'certreq.csr' file using your text editor of choice.
- Starting with "-----BEGIN NEW CERTIFICATE REQUEST-----" copy all lines
including the BEGIN and END of certificate lines.
- Paste this copied data into the Verisign page where requested and continue.
- You will see the Verisign web site decode your certificate request
information. This decoded information is presented to you to verify it is
correct. If it is, then continue with the process.
- You will be presented with another set of questions from Verisign. Be sure
to answer with the correct email address, as this address will be used to
send your SSL certificate.
- After you answer all these questions, you will be sent a TRIAL 14-day
SSL certificate via email.
- WARNING! You must follow this step carefully, you cannot copy and paste
information from an email to a new text file. After you get your TRIAL
certificate, save the entire email message to a text file. Open this file
using your text editor of choice. You will see the email address header
information and the line:
-----BEGIN CERTIFICATE-----
- Delete all text that appears before the -----BEGIN CERTIFICATE----- line.
The modified file should contain only certificate information. After you
delete the email header, save this text file inside your temporary directory
with the filename 'trialcert.crt'.
6. Now you are ready to configure Oracle9i Application Server (9iAS) with your
SSL certificate files.
7. Back up your existing <9iAS_HOME>/Apache/Apache/conf/httpd.conf file.
8. Open the httpd.conf file with your text editor of choice.
9. Edit the following httpd.conf directives to use your generated private key
and SSL certificate file, which could be the filename for either the
temporary self-signed certificate, the TRIAL test certificate, or the
purchased valid certificate. The information following the # symbol are
comments.
NOTE
The directory of the SSL files (private key and certificate file)
can reside in any location you choose. The temporary working
directory will continue to be referenced in these procedure steps.
# use the appropriate (i.e., valid, temporary, or trial) certificate filename
SSLCertificateFile /u01/tmp/myssl/tempcert.crt
#private key from Step #4 above:
SSLCertificateKeyFile /u01/tmp/myssl/priv.key
10. Save your modified httpd.conf and exit the text editor.
11. Log in as authorized user (if default ports 80 and 443 are used, ROOT user
must execute commands in next step).
12. Execute the following command to stop, then start Apache in SSL mode
(ensure proper UNIX environments are set; else, execute command from
<9iAS_HOME>/Apache/Apache/bin.)
For Oracle8iAS 1.x:
% httpdsctl stop
% httpdsctl startssl
For Oracle9iAS 1.0.2.x:
% apachectl stop
% apachectl startssl
- when prompted, enter the "pass phrase" created in Step #3.
-- not required if you unencrypted the private key file
- when the Oracle HTTP Server starts successfully in SSL mode, access the
9iAS index page in a browser using the HTTPS protocol and the appropriate
SSL Listen port. URL format:
https://myhost.domain.com:<ssl_port>
- if using a temporary self-signed or TRIAL test certificate, the user will
see a Security Alert (IE), or New Site Certificate (Netscape) warning message,
click Continue/Next to accept.
====================
I hope this help !!
Ilan Salviano