HTTP SSL on PI 7.31

Hi Experts,
I need some expert opinion on enabling SSL using SOAP Web Services.
We currently have a PI 7.31 system where a few interfaces are built using protocols other than HTTP ( Proxies, RFCs JDBC etc.)
However for next developments, we need to go ahead with web services for which client demands SSL communication. Now I have been browsing to material on HELP. SAP and SDN blogs but still need some clarification.
1. Can we enable SSL communication selectively for some interfaces or once we enable SSL ( HTTPS), all our interfaces have to be SSL communication enabled ? In the other words can some Web services access PI using port 50000 and other using 50001 at the same time ?
2. When we enable SSL by performing all activities, does URL of our PI ( and SLD etc.) changes to HTTPS with change in port number ?? If yes. won't all other systems get impacted by this single interface requirement ? I think this shouldn't happen however want expert opinion.
3. Do we need to change anything with existing interfaces if we enable SSL on PI ? ( RFCs and JDBCs, Proxies etc.)
4. Our SOAP sender channel doesn't show security options ( Like HTTPS Without client authentication , HTTPS with client authentication etc. ). We found same symptoms in note - 1669840 - PI 7.30 SOAP Adapter Sender: Inbound Security Checks Missing. However note seems to be applicable for 7.3 . Can the patches and downloads be considered for 7.31 as well ?
In case any question is not clear I am happy to be more verbose.
Thanks..
regards,
Omkar.

Hi Omkar,
yes, you can open PI with HTTP or HTTPS port. Please refer the below blogs for detail
http://scn.sap.com/people/rajendra.badi/blog/2011/08/24/configuring-wsse-digital-signing-and-encryption-using-sap-pi-711-aae-soap-adapter
http://scn.sap.com/people/rajendra.badi/blog/2011/11/23/pi-711-transport-level-secuirty-communicating-with-external-web-service-from-soap-adapter-through-ssl
http://scn.sap.com/blogs/antony.jeyakar4/2013/02/12/configuring-ws-receiver-with-client-certificates-in-pi-73
the below discussion will also useful
SOAP Receiver with HTTPS(without certificate) | SCN
regards,
Harish

Similar Messages

Swf file not loading over Https(SSL) on Internet Explorer...

hi ,
I have a .swf file used in html file and i try to browse using "https(SSL)".it will loads fine in Firefox, but in Internet Explorer wont able to load. When right-clicking it says "movie not loaded".
even i googling for the same and i got below option but i am still not able to get flash on html page. it will working fine in Internet Explorer,FireFox etc when we use"http".
1) add headers like "Cache-Control: must-revalidate" or "Cache-Control: max-age=0" or "Cache-Control: no-store" etc
2) use CrossDomain.xml
we also able to load swf in https on Internet Explorer but for that we have to do below settings in Internet Explorer browser.
1) Go to Tools --> Click on Internet Option --> click on Advanced tab --> Now in security section checked mark on "Do not save encrypted pages to disk".
but above way is not a proper way to resolve the https issue
Thanks.

found this within the Adobe forums, seems to solve your issue.
I would make sure to use the crossdomain file as well.

Https ssl config Oracle AS, webcache, portal...almost works

Hi,
I have searched the forums and I havent found anything that works for me.
I have Oracle infrastructure on one server, and Oracle App server/portal on another server. I can get as far as the http server showing the "welcome to oracle" page in https form. When I try to access a page in the portal (plsql) I get a blank page. It does convert the "https://myserver:xxxx//pls/portal/url/page/IRWEB/HOME
" to "https://myserver:xxxx/portal/page?_pageid=73,86254,73_86264:73_86316:73_8632...." but nothing comes up.
Also, it uses the Infrastructure server for single-sign-on...so I need to make the app server do the single sign-on. I've tried by adding /pls/orasso entry in DADS.conf of http server..
So as far as I can tell...the http server IS operating in https/ssl, but the single-sign-on and the pages in the portal are not.
I have to do everything manually since I am using 10.1.2 (no Oracle Collab Suite installed, so no SSLConfigTool and other assistants)
Here is what I've done to get https://myserver:xxxx/ to come up ok.
server 1: Oracle Infrastructure and Oracle database release 1 10.1.2.0.0
server 2: Oracle Application Server / Portal with webcache release 2 10.1.2
using Oracle Wallet for certificate,
http server -> process management "ssl-enabled",
http server -> advanced -> ssl.config: SSLWallet file:, SSLWalletPassword, virtual host for ssl
webcache -> added settings for ssl (I used the current entries for non-ssl as a guide for the ssl entries)
Interesting issue...with the ports in the ssl.conf file example:
Port 4459
Listen 4459
VirtualHose myserver.blah.edu:4450
Port 4458
When I get the blank page trying to use ssl and 4459, I can manually change the url in my browser to 4458 (or maybe its the other way around) and get this message: "Error: The portlet could not be contacted"
Is this a problem with webcache? Do I have to do any ssl config on the server with the database?
I've even tried disabling the webcache, both with the oracle sql script and through web interface but neither made a difference...same problem.
Any help would be greatly appreciated..I feel as if I'm almost there.
If I did not post enough info for accurate help, please ask what you need to know to provide help! Thanks in advance.

Hi,
Yes you can go for SSl configuration without re-installing any of the components.
Regards,
access_tammy

Https / SSL needed for my website

I hope someone can help me.
I have a website
http://www.to-shea.com
I purchased a SSL package from register.com (they host my
site too). They told me "anyone who sees my site would see the
https prefix. I received an email from them stating that they could
not put the https prefix on my site, although it is on their secure
servers. needless to say, I was quite upset. Anyone on the web
knows that an https prefix means it is a secure site. Is there ANY
thing I can do to fix this problem. (it only cost me $28.00)
Is there a program I can use to force the https prefix.
I am on a Mac (OSX) and I use Dreamweaver CS3. I am a LITTLE
familiar with html code but not a alot.
Can someone there help me???

What exactly are you asking a question about?
https and SSL are usually only used for secure transfer of
information when
ordering and sending sensitive information. You do not want
people viewing
the web site using https and not completing an order to be in
https SSL
because it slows things down. It involves encoding/decoding
of everything in
the page including graphics.
In other words- I shop at the site. I add things to the cart.
I am viewing
the site in http until it's time to check out and i am asked
for my card
numbers.
Does the certificate not work or throw an error?
Do you understand how to change links from https to http?
When to use http or https?
And if you want to force https, what is the server side
scripting language.
What's the question please.
Alan
Adobe Community Expert, dreamweaver
http://www.adobe.com/communities/experts/

How the external system will talk to ECXpert 3.5 for transfering files via HTTP SSl?

We are using ECxpert3.5 on Solaris box. One of our Trading Partner want to communicate through HTTP-SSL and we are doing XML/EDI mapping. Could you guide us what steps we need to take care to implement this.
How the external system will talk to ECXpert for transferring files. (We need the syntax for the URL). How ECXpert will receive XML file through HTTP-SSL protocol from External System and file submittion.
Please send is there any other document which explain about. Thanks in advance for your help. [email protected] or [email protected]

Hi Steve,
You can bring the GRC framework to a state equivalent to a raw install by following options:
Option 1.) You should have a base-line backup before GRC installation. If so then apply that base-lin backup and deploy GRC components. If there is no base-lin backup, then
Option 2.) Uninstall and re-install J2EE and then follow up with rest of the installation process. If you don't want to go through re-install process, then
**Correction to Option 3**
Option3.) SAP is in process of creating a SAP Note for Delete script, Instead of delivering Delete Script script via OSS message. Will update you as soon as the Note gets released.
Please refere to Note # 1416728 to Manage your deletion in RAR 5.3 SP10.
Hope this helps.
Best Regards,
Sirish Gullapalli.

WebDAV over HTTPS/SSL

Will Oracle Portal support WebDAV using HTTPS/SSL?

Jeff, while OraDAV does suppot SSL, some WebDAV clients do not. For example, on NT/Windows 2000 Web Folders, IE, and Mozilla (Netscape 7.0) support SSL. Dreamweaver and GoLive do not. On Unix, Linux and the Mac OS, Mozilla and Cadaver support SSL.

Do oracle HTTP servers support https/SSL failover??

Dear all,
my company plans to use a load balancer (F5) to distribute the workload to multiple
oracle http servers and oc4j servers (in different machines).
we prefer to put the ssl encrypt/decrypt to the http server (ssl pass throuhgh, not put
on the load balancer due to some reasons).
so i want to know if using https / ssl, will the ssl state replicate to multiple oracle http
servers so that when one http server / machine down, the existing ssl traffic can
transparently rout to other servers?
if yes, how can i achieve that ??
thanks.
lsp

I now have the standalone version of the Oracle HTTP server 10g.
I also have a signed certificate that I have been using on the old 9i Oracle HTTP server (with the parameters mentioned above).
It seems on the 10g version I have to use a wallet file.
I go into Oracle Wallet manager but I can't import a certificate request, I can only create a new one. Then when I import the signed user certificate I already
have, it tells me it doesn't match the certificate request file. I need to be able to create a wallet for my existing signed certificate.
cheers
Robert

ACE: HTTP followed by HTTPs/SSL termination, stickiness

Dear Helpers,
I'm trying to figure out the best sticky/persistence method for the following for ACE,
Client X ----(HTTP)--------------------------------------------ACE LB ---to----Server 1
Client X -----(HTTPs)---ACE/SSL termination ------ACE LB ---to---- Server1
Both HTTP and HTTPs use the same VIP for HTTP and HTTPs)
The same client to stick/persist to the same server using both HTTP and HTTPs. HTTPs/SSL is terminated by ACE.
Could you point me to sample configurations for this requirement, please.
Thank you
SS

HI Gilles,
thanks for the response. Sorry had gotten distracted with a bunch of other things, didn't get a chance to get back to this. Anyway, so, I can generate the 302 response in my web-servers except I need to turn it around to a different domain name. Now assuming I use URL re-write when I see this coming back from the web-server, I can rewrite this to https and send to the client? A few questions about this and the links you sent above with using redirect service.
a) can I do a a redirect to an https address or does it only do http (considering I only saw examples configs only using www.domain.com/index.html type redirects without specifying the protocol to use)?
b) If not, then I use URL rewrite in conjunction with the 302 from the web-servers. But for my SSL off-load in a pair of CSS using VIP and Virtul Interface redundancy, do I buy 2xSSL Certs for the same domain-name or do I buy ONE (i.e. generate the key-pair/CSR in Master CSS) and import the same rsakey and SSL Cert recd. from CA into both CSSs?
c) Does the CSS handle a wildcard SSL Cert without problems?
Thanks again,
\R

How to invoking secured service(HTTPS/SSL)from bpel Process

Hi all,
i am very new to fusion middle ware. i used jdeveloper 10.1.3.3 and soa-server 10.1.3.1.i need to pass secured wsdl(HTTPS/SSL) from one bpel Process to other. Let me know any certificates are required to do this?
I am looking forward to getting any advice from our forum.
thanks & Reagards,
Hari.

First of all make sure your jdeveloper and soa suite versions match otherwise you will get unpredictable results. I suggest that you upgrade SOA Suite to 10.1.3.4 as this is the latest version.
That aside I'm assuming that the bpel process are on the same instance. If this is the case Yes you do need certificates as you need to implement SSL on your SOA Installation. If you use a common certificate such as verisign then the process is simpler as you don't need to worry about the public key as they are standard with Oracle as they are with your browser. If you want to sign your own certificate then you will need to add your public key.
If your server is already SSL and it is verisign then you should have no issues you will be able to connect.
cheers
James

Cisco CSS as non-HTTPS SSL-traffic terminator

Hi!
Does anybody know is it real to use Cisco CSS as SSL-traffic terminator. I need to terminate non-HTTPS SSL-traffic on this device (i.e. SSL-encrypted sessions of any particular TCP-based application-layer protocol, not https)? If not, is there any CISCO device capable of doing such a job?
Regards, Amir

Hi!
Thank you very much for your reply.
I know about the S model - as per my post - but unfortunately I have realized after making the purchase.
Can you please help me with the following issue: my unit is not able to boot from FTP, even if I follow up the CISCO official documentation for that version (I issue all the commands as in the manual). More than that, if I setup the Primary Boot Configuration and then I want to check it up there is nothing in that field. The Secondary Boot Configuration keeps its settings and after the Primary failure it will try the Network Booting but with Failed status - returning me to the OffDM.
I mention that I am using the OffDM because the unit I bought has no Flash Card.
Also I am not sure how can I have a "network mounted filesystem" and in the meantime to use the FTP protocol; setting up a NFS server wont provide me with Windows style absolute path like k:/.... as per CISCO official guide. Is that a plain-ftp generically called as Network File System??? "First, create these subdirectories on the FTP server, then copy the files from the boot image to the subdirectories"
Is this linked with the fact that I am using a Linux box for my FTP Server? Can you please help me to understand what the following line from CISCO official guide means "A network boot is not supported on UNIX workstations"
Thank you!

Flash video (.flv) not loading under HTTPS (SSL)

Hi,
We have developed a rich media eLearning simulation
application that dynamically loads separate .FLVs (animated talking
characters). The client implementation is in a learning management
system on an internal HTTPS connection. The FLVS do not work on
this LMS server but DO work when they open the same application
from our external (to the client) test web server (e.g. plain and
simple HTTP).
The PCs are the same machines. They are connecting from
within the same LAN (behind the firewall) e.g. all conditions are
exactly the same except for the HTTP/HTTPS difference.
The client is checking that the server MIME types are
correctly specified (it is believed that they are).
So...any advice why HTTPS/SSL might affect the FLV loading?
For reference: We are compiling in Flash 9. Client players
are running 9.0.124.0. All the files reside on the server(s) e.g.
no cross-domain file issues.
Thanks.
Kevin
Kevin Corti
PIXELearning Ltd
www.pixelearning.com

found this within the Adobe forums, seems to solve your issue.
I would make sure to use the crossdomain file as well.

Fail to contact HTTPS/SSL p2 repositories

I'm trying to add a custom HTTPS/SSL url repository to install from it an get. The repo is fine and can be installed otherwise. [You can only use links to eclipse.org sites while you have fewer than 5 messages. Therefore the link lacks the protocol https://]
ERROR: org.eclipse.equinox.p2.transport.ecf code=1002 Unable to read repository at bndtools.ci.cloudbees.com/job/bndtools.master/lastSuccessfulBuild/artifact/build/generated/p2/content.xml.
javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:554)
at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:435)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.updateSecureConnection(DefaultClientConnectionOperator.java:216)
at org.apache.http.impl.conn.ManagedClientConnectionImpl.layerProtocol(ManagedClientConnectionImpl.java:394)
at org.apache.http.impl.client.DefaultRequestDirector.establishRoute(DefaultRequestDirector.java:814)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:615)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
at org.eclipse.ecf.provider.filetransfer.httpclient4.HttpClientFileSystemBrowser.runRequest(HttpClientFileSystemBrowser.java:259)
at org.eclipse.ecf.provider.filetransfer.browse.AbstractFileSystemBrowser$DirectoryJob.run(AbstractFileSystemBrowser.java:69)
at org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)

Am 30.06.2015 um 15:11 schrieb Peter Kirschner:
> I'm trying to add a custom HTTPS/SSL url repository to install from it an get. The repo is fine and can be installed
> otherwise. [You can only use links to eclipse.org sites while you have fewer than 5 messages. Therefore the link lacks
> the protocol https://]
And you've double-checked that that repository can be correctly loaded/used through p2's normal UI?

Persistent HTTPS/SSL connections

Dear all,
Does anybody know how to make an HTTPS/SSL connection persistent.
We need to make multiple HTTPS requests to a server and we found that most of the time it gets new SSL session ID and makes all the master-secret processing whenever it gets the enw session ID.
I have seen (with -Djavax.net.debug=ssl option) that the JSSE tries to resume, but the server sends new session id, do I need to set/force anything from my side?
Thanks in advance for the answer!
Vijay

We have solved the problem!
For those who wish to know what happened
I have done some debugging with the JRE option -Djavax.net.debug=ssl and I could see the JSSE libraries (1.0.2, with JDK 1.3.1) trying to resume the seesion with the SSL session ID which it got from previous communication, however, the server gave a new session ID back and it had to do all the compautations for the secret exchanges from scratch.
Then we found the load balancer transfers each requests to different servers causing the creation of new session IDs. The problem is solved after making our requests "sticky" to the load balancer and the SSL accelerator.

Pesistent HTTPS/SSL connections

Dear all,
Does anybody knows how to make an HTTPS/SSL connection persistent.
We need to make multiple HTTPS requests to a server and we found that most of the time it gets new SSL session ID and makes all the crypto/certificate processing whenever it gets the enw session ID.
I have seen (with -Djavax.net.debug=ssl option) that the JSSE tries to resume, but the server sends new session id, do I need to set/force anything from my side?
Thanks in advacne for the answer!
Vijay

We have solved the problem!
For those who wish to know what happened
I have done some debugging with the JRE option -Djavax.net.debug=ssl and I could see the JSSE libraries (1.0.2, with JDK 1.3.1) trying to resume the seesion with the SSL session ID which it got from previous communication, however, the server gave a new session ID back and it had to do all the compautations for the secret exchanges from scratch.
Then we found the load balancer transfers each requests to different servers causing the creation of new session IDs. The problem is solved after making our requests "sticky" to the load balancer and the SSL accelerator.

How To Force Access Via HTTPS/SSL?

Forgive me if this question reveals how little I know about SSL, but... ;-)
What is the standard, best practice way to force a web client (via browser)
to use HTTPS/SSL? Our configuration is that the clients hit an IIS server
first, which then uses the WebLogic proxy/forward plug-ins to the WebLogic
server. The URLs that our clients follow come from an email we send, which
has https:// on the front. Access seems to stay in https as long as they
follow our links, but if the client edits the URL and changes https to
http, the access is now without SSL. How can I restrict access to https
only, or otherwise make sure they never use non-SSL access?
Thanks in advance for any explanations or pointers to references, etc.
-Paul

Paul,
You can disable the http port between IIS and weblogic. Configure only the SSL
connection. That way if any request comes to weblogic as http , it will be rejected.
Udit
Paul Hodgetts <[email protected]> wrote:
Thanks for the reply! What if the web server (the front end IIS server)
also serves static web pages that are allowed to be accessed without
HTTPS/SSL? It's primarily the requests forwarded through to JSP/servlets
on the WebLogic server that must use HTTPS/SSL.
Thanks,
-Paul
Robert Patrick <[email protected]> wrote:
One way would be to close the HTTP port in your firewall so that non-HTTPS
traffic cannot reach the web server...
Paul Hodgetts wrote:
Forgive me if this question reveals how little I know about SSL,
but... ;-)
What is the standard, best practice way to force a web client (viabrowser)
to use HTTPS/SSL? Our configuration is that the clients hit an IISserver
first, which then uses the WebLogic proxy/forward plug-ins to theWebLogic
server. The URLs that our clients follow come from an email we send,which
has https:// on the front. Access seems to stay in https as long
as they
follow our links, but if the client edits the URL and changes httpsto
http, the access is now without SSL. How can I restrict access tohttps
only, or otherwise make sure they never use non-SSL access?
Thanks in advance for any explanations or pointers to references,etc.
-Paul

ECXpert3.5- How to setup HTTP-SSL for xml protocol

Hi,
We are using ECXpert3.5 on Solaris box. One of our Trading Partner want to communicate through HTTP-SSL and we are doing XML/EDI mapping. Could you guide us what steps we need to take care to implement this.
How the external system will talk to ECXpert for transferring files.(We need the syntax for the URL). Could you suggest how to setup the HTTP SSL for XML protocol to receive xml files from remote system.
Thanks in advance for your help!
Regards,
Ravi.

Hi,
We are using ECXpert3.5 on Solaris box. One of our Trading Partner want to communicate through HTTP-SSL and we are doing XML/EDI mapping. Could you guide us what steps we need to take care to implement this.
How the external system will talk to ECXpert for transferring files.(We need the syntax for the URL). Could you suggest how to setup the HTTP SSL for XML protocol to receive xml files from remote system.
Thanks in advance for your help!
Regards,
Ravi.

HTTP SSL on PI 7.31

Similar Messages

Maybe you are looking for