Certificate error while admin server startup (solaris 8, wls 8.1.4)

Question

HI All,
I am getting the following error while starting up my admin server using startWebLogic.sh.
<Feb 5, 2010 7:51:19 AM GMT> <Notice> <WebLogicServer> <BEA-000327> <Starting WebLogic Admin Server "BOS1-ADMIN" for domain "BOS1">
java.io.IOException: Inconsistent security configuration, Certificate expired: [
Version: V3
Subject: EMAILADDRESS=******************, CN=***********, OU=********, O=************, L=*******, ST=*******, C=**
Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4
Key: com.sun.net.ssl.internal.ssl.JSA_RSAPublicKey@672
Validity: [From: Thu Feb 03 11:25:08 GMT 2005,
To: Tue Feb 02 11:25:08 GMT 2010]
Issuer: EMAILADDRESS=******************, CN=***********, OU=********, O=************, L=*******, ST=*******, C=**
SerialNumber: 00
Certificate Extensions: 3
[1]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: E9 1E E1 30 86 89 7E 1A 67 A2 58 5B 9D 8A 9E 7A ...0....g.X[...z
0010: C1 CF C4 DA ....
[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: E9 1E E1 30 86 89 7E 1A 67 A2 58 5B 9D 8A 9E 7A ...0....g.X[...z
0010: C1 CF C4 DA ....
EMAILADDRESS=******************, CN=***********, OU=********, O=************, L=*******, ST=*******, C=**
SerialNumber: 00]
[3]: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:true
PathLen:2147483647
Algorithm: MD5withRSA
Signature:
0000: 74 15 DF 05 54 27 1D 1D D5 35 F4 99 24 1A 84 1C t...T'...5..$...
0010: BF 93 25 FA 50 D7 1E 36 66 7F 30 1A EF 67 2A 79 ..%.P..6f.0..g*y
0020: 4A 72 FD C1 3B 33 05 61 D0 52 92 2D 15 89 68 67 Jr..;3.a.R.-..hg
0030: E8 13 A6 60 18 38 16 53 16 22 CC 4D 87 19 9F 30 ...`.8.S.".M...0
0040: 28 F3 3C C0 4C C2 C4 34 69 D3 BA 5C B2 4D 8A FF (.<.L..4i..\.M..
0050: AA DD BD 04 96 AF 69 05 73 77 8D 93 89 90 5D 23 ......i.sw....]#
0060: E9 D0 CA 02 5A 20 39 40 85 12 A9 67 04 ED 7B 59 ....Z [email protected]
0070: 34 FB 31 E7 AD F6 C0 AE E4 5E 66 BB 8E 7D 45 72 4.1......^f...Er
at weblogic.t3.srvr.SSLListenThread.initSSLContext(SSLListenThread.java:205)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:139)
at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:1637)
at weblogic.t3.srvr.T3Srvr.initializeHere(T3Srvr.java:890)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:664)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:342)
at weblogic.Server.main(Server.java:32)
Any thoughts to share mates????
I have already posted this topic in general discussion forum and as suggested by faisal posting here as well..Please let me know how to renew certificates????
Cheers,
Dinesh

Answer 1

Hi Dinesh,
Below are the steps to renew / get new certificates.
Step A -- Create a Keystore file
1. Using keytool, enter the following:
keytool -genkey -alias server -keyalg RSA -keystore your_domain.jks
'your_domain' in the command above should be the name of the domain you are securing. If you are ordering a Wildcard Certificate, do not include the * in the filename as it is not a valid filename character.
2. You will be prompted to enter the information for your certificate.
Please note: When prompted for the first and last name, DO NOT enter your first and last name. Instead, enter the name to which the certificate is being issued (e.g., www.yourdomain.com, mail.yourdomain.com, *.yourdomain.com).
3. When prompted, enter 'y' or 'yes' to confirm. You will next be asked for a password. You will need to use this same password when generating a CSR and importing your certificates.
Step B -- Generate a CSR from your new keystore
1.     Use keytool to create a Certificate Signing Request from your keystore:
keytool -certreq -alias server -keyalg RSA -file your_domain.csr -keystore your_domain.jks
Again, 'your_domain' is the name of the domain you are securing. (without the * character if you are ordering a Wildcard Certificate).
2.     Enter the keystore password.
3.     Submit the CSR to the Certificate Authority for the certificates.
Step C: Import and Install the Certificates.
1.     First you will need to install the Root CA Certificate into your keystore. Copy-and-paste the root certificate from the body of the fulfillment email into a simple text editor such as Notepad.
2.     Save the file to your server as trustroot.pem in the same directory where your keystore was created.
3.     Using the java keytool command line utility, import the root certificate geotrustroot.pem into your keystore using the following command:
keytool -import -alias geotrustca -keystore mykeystore -file geotrustroot.pem
The command should be typed on one line. This command imports the GeoTrust Root CA Certificate into the keystore named mykeystore.
Step D: Import and Install the SSL Server Certificate
1.     Next install your SSL Server Certificate (public key) into your keystore. Copy-and-paste the server certificate from the body of the fulfillment email into a simple text editor such as Notepad.
2.     Save the file to your server as public.pem in the same directory where your keystore was created.
3.     Using the java keytool command line utility, import the SSL server certificate public.pem into your keystore using the following command:
keytool -import -alias tomcat -keystore mykeystore -file public.pem
The command should be typed on one line. This command imports the SSL server certificate into the keystore named
mykeystore.
Step E: Configuring Keystores
1.     Both the GeoTrust root CA and SSL server certificates are now installed on your server. Next you will need to configure the keystores by following the instructions in the WebLogic documentation section Configuring Keystores.
2.     Restart the WebLogic server.
Hope the information helps.
Regards,
Raj