Installing Verisign Certificate for SSL - please help

Question

I'm trying to configure SSL for the first time on my WebLogic Server 6.1 SP1 instance
on a Win2K Server. I have used the built-in certificate generator servlet to
generate a CSR. I sent the CSR to Verisign and received a certificate back (looks
like it's in .pem format). Now, I've gone to the admin console and entered what
I thought were the right values in the right places, but WLServer doesn't seem
to like what I've entered and/or the files themselves. Here's what I have:
Server Key File Name: config/mydomain/my_domain_com-key.der (name changed of course
from the actual domain name) - This is the file generated automatically by the
certificate servlet that I moved into this directory.
Server Certificate File Name: config/mydomain/mycert.pem (this is the file that
was sent to me by Verisign, supposedly my 40-bit certificate).
Server Certificate Chain File Name: config/mydomain/verisignca.pem (I created
this file by going to the verisign site and copy/pasting their .pem format 'intermediate'
cert into this file - documentation real fuzzy on this step so it's probably wrong).
SSL is enabled, listening on the default port of 7001, client certificate not
enforced.
Now, when I boot the server, I get the following error in the log file: ####<Nov
19, 2001 12:45:03 PM EST> <Alert> <WebLogicServer> <VDWEB1> <myserver> <main>
<system> <> <000296> <Security configuration problem with certificate file config/mydomain/my_domain_com-key.der,
java.io.EOFException>.
What am I doing wrong here? I thought i put that file in the location I specified,
so does that error mean it can't find it or that the file itself is corrupt?
That's just the file that was autogenerated by the servlet, i don't see how it
could be corrupt! Also, I assume that's just the first error ... if I fix that
one, there likely will be more. I especially don't understand the part about
the chain file as the documentation is so unclear to me about putting multiple
certs in the chain file ...
Thanks for any pointers,
Josh

Answer 1

Hi Josh,
Jus to reconfirm are you sure that the Server key and Server Cert are not
interchanged ?
The error message indicates that private key is being read as a certificate.
Maybe its not a explicit error message and instead should be
Security configuration problem with private key file
config/mydomain/my_domain_com-key.der
Are you able to run with the democerts provided with weblogic ?
yeshwant
<system> <> <000296> <Security configuration problem with certificate
file config/mydomain/my_domain_com-key.der,Josh Daynard wrote:
Hey Yeshwant,
Thanks for the tip. I did not use a password when creating the CSR request and
the 'Key Encrypted' box is unchecked in my console. Any other thoughts???
Thanks,
Josh
Yeshwant <[email protected]> wrote:
Hi Josh
when you generated the csr using the certificate webapp , did you use
a password ie are you using a password
envrypted private key ?
if yes you will have to provide that value in the start sript using the
system property
weblogic.management.pkpassword=actualpassword and also make sure that
the Use Encrypted box is checked.
If not make sure that the Use Encrypted box in the console under the
ssl tab is unchecked.
Yeshwant
Josh Daynard wrote:
I'm trying to configure SSL for the first time on my WebLogic Server6.1 SP1 instance
on a Win2K Server. I have used the built-in certificate generatorservlet to
generate a CSR. I sent the CSR to Verisign and received a certificateback (looks
like it's in .pem format). Now, I've gone to the admin console andentered what
I thought were the right values in the right places, but WLServer doesn'tseem
to like what I've entered and/or the files themselves. Here's whatI have:
Server Key File Name: config/mydomain/my_domain_com-key.der (name changedof course
from the actual domain name) - This is the file generated automaticallyby the
certificate servlet that I moved into this directory.
Server Certificate File Name: config/mydomain/mycert.pem (this is thefile that
was sent to me by Verisign, supposedly my 40-bit certificate).
Server Certificate Chain File Name: config/mydomain/verisignca.pem(I created
this file by going to the verisign site and copy/pasting their .pemformat 'intermediate'
cert into this file - documentation real fuzzy on this step so it'sprobably wrong).
SSL is enabled, listening on the default port of 7001, client certificatenot
enforced.
Now, when I boot the server, I get the following error in the log file:####<Nov
19, 2001 12:45:03 PM EST> <Alert> <WebLogicServer> <VDWEB1> <myserver><main>
<system> <> <000296> <Security configuration problem with certificatefile config/mydomain/my_domain_com-key.der,
java.io.EOFException>.
What am I doing wrong here? I thought i put that file in the locationI specified,
so does that error mean it can't find it or that the file itself iscorrupt?
That's just the file that was autogenerated by the servlet, i don'tsee how it
could be corrupt! Also, I assume that's just the first error ... ifI fix that
one, there likely will be more. I especially don't understand thepart about
the chain file as the documentation is so unclear to me about puttingmultiple
certs in the chain file ...
Thanks for any pointers,
Josh