How to enable ssl in ohs

Question

I installed the web tier (ohs and web cache) 11.1.1.2 on 2008 r2 64 bits. Also I patched that to 11.1.1.3 I did not think and this may
be where I went wrong, I needed to install weblogic?. I have not done anything with webcache. yet.
I had imagined I could enable ssl in apache the way it is done on other installations just by putting entries in
the ssl.conf like SSLCertificateFile and SSLCertificateKeyFile . But no. The software will not allow you to do that.
I believe the certificate has to go in a wallet (for ohs. Other fusion things want a different plan). There's multiple
wallet programs already there such as from installing the database. I find that the wallet program will not allow
me to use the csr I already created that was used to get the certificate I have gotten. oops!
So anyone know if there is a way around this so I can use the .crt and .key I have for this domain name?
This is really taking a lot of time. I suppose I could install apache, the regular one, on this machine so that I
could use an ssl connection to that and then hand it over to ohs. Since it wasn't going anywhere it wouldn't
be much of a problem the traffic wasn't encrypted.
Edited by: lake on Nov 23, 2010 7:11 PM

Answer 1

I thought I'd never get this to work. No one should bother trying without reading the docs
1226484.1 and 1218603.1 on metalink.
While it could be that one could use a reverse proxy such as using proxypass and proxypass reverse
in an apache web server so that ssl could be configured in the other server, I saw reports of that not always working.
Otherwise if one did not install weblogic I believe the only way to configure ssl with this version of ohs is with orapki the command line
interface for handling wallets, or the gui wallet application which I found on the 11gr2 database menu under "integrated management tools". You may be able to add an existing csr to a wallet via the orapki interface.
If you were using a separate key and certificate you may be able to change them to the wallet requirements given sufficient knowledge of opensll. That was more knowledge than I had. So what I did
was start over from scratch totally. I created the csr in the wallet gui, exported it, submitted it, and got a totally new cert from our cert source.
What I used for the wallet "operations, import user certificate" was a .cer file, and it worked. The wallet already had our CA in it so I did not have to fight that battle. Hallelujah.
It is essential to check on the "Wallet" menu the "Auto Login" selection before saving it. When you save a wallet
it will be called cwallet.sso if it is autologin. If the saved file is called ewallet.p12 it is not autologin and will not
work for ohs.
After you have saved your wallet as cwallet.sso say in
"....instances\instance1\config\OHS\ohs1\mykeys"
then you would need to check the ssl.conf and it would need to be like so:
SSLWallet "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/mykeys"
Note that is to the directory the sso file is in.
But wait there's more....
on windows 2008 r2, you need to get fire up windows explorer and navigate to your cwallet.sso file
Under properties, security you need to add SYSTEM in "group or user names" and give it all permissions possible.
Secondly, you need to go under properties, security, advanced, owner and change the owner to SYSTEM.
Without these changes it will never work because the web server cannot open the wallet.
Remember by default the logs go in
"....instances\instance1\diagnostics\logs\OHS\ohs1"
I became very familiar with them :-)