SSL on OAS 4.0.8.1

Hello,
We want to test SSL on the OAS 4.0.8.1 but we have no CA certificate on our
hand.
Is there any free trail certificate for testing?
By the way, there are three files needed for configurating the SSL form,
like,
1. cert file
2. dist name file
3. private key file.
In general, there are only two SSL certificates files, including, cert file
and key file.
May we use these files for testing and ignoring dist name file.
Thanks a lot.
Alex
null

Hi Patrick,
to do some simple evaluation I would recommend downloading a test certificate from e.g. Verisign ( I used Deutsche Telekom here in Germany ) and follow the steps in the OAS online documentation. It's actually pretty straight forward. Don't forget to install the certificate of your "test" authority, since this is ( of course ) not already known as a CA.
Regards,
Armin
Armin Gattung
Oracle Germany
Consulting ATS, Internet & eCommerce
[email protected]

Similar Messages

Can a pl sql cartridge get the client certificate through ssl in OAS

I am In a web publishing system project, I use SSL and client certificate to verify the user, the environment is OAS4.0.6 and Oracle 8i, and I use PL SQL cartridge to proceed the http request , Now the problem is how can I get the client certificate infomation in my pl sql scripts, I do not know where should i post this problem, So I post it here, If you have any experience in using SSL of OAS, pls help me!
tsailiang
[email protected]
thank you very much!

Sorry wrong forum.....
This forum is for the Internet File Server (ifs) not the oracle application server (oas), sometimes known as iAS or Oracle9i Applicaiton Server.
null

Enabling SSL on OAS 10g (9.0.4)

Hi,
I want to know the method to enable SSL in OAS to use https for accessing our application.
Appreciate your help.
Regards,
Younis

Have you checked the [url http://download.oracle.com/docs/cd/B10464_05/index.htm]documentation, especially the Oracle Application Server 10g Administration Guide? There are lots of SSL references in this document.
But why are you using 9.0.4? This release has already been desupported by Oracle a long time ago.

SSL enabling OAS 10.1.2.3.0 Forms/Reports Home installation

I need the steps to SSL enable to this type of Oracle App Home. Thx

I need the steps to SSL enable to this type of Oracle App Home. Thx

How to disable SSL v3 for sun os 5.6 (OAS 4.0.8), I am facing POODLE vulnerability issue?

my Website is hosted on Sun OS 5.06 (OAS 4.0.8) and using web server : Oracle_Web_Listener/4.0.8. Website is configured to use https for secure pages and it was working fine from last 10 years but suddenly i am getting complaints from my customers that they can not browse site on chrome version 40 and above and firefox 34 and above.
I searched for this issue and found that there is POODLE attack which may causing this issue. now the only solution i can see is to disable SSL v3 on server.
Can any help me out with the process or an idea, How to disable SSL V3 on this Olde server? its sun microsystem server.

Hi Aamir,
   This is old software, been a while since I saw one of these.
    Normally when SSL was setup there were two listeners, one with SSL and one without, in a different port, so you could try to find this second port, which may work without any need to change the configuration.
    Else, try to check on the OAS manager (Usually on port 8888), the HTTP listener -> WWW -> Network, if there is a setup only for the SSL port, you will need to add a new line, with the same configuration, but a different port and the security disabled.
    Also, there may be some setting on the application itself for the url path. If so, when you navigate in the application it will try to redirect you back to the SSL port. In that case you will need to figure out where to change that, which depend on the application itself.
   Found this page on google with the process to setup SSL on OAS 4.0, you need to do the inverse of step 5.
WoSign Support: SSL Certificates Installation Instruction - Oracle Web Server (OAS 4.0.8)
Regards,
Luis

How to make OAS use SSL

I'm trying to install SSL under OAS 3.0.0.
There's a note in a documentation, that I can generate a request for CA by <b>genreq</b> utility. I can't find it. Where's it placed and does it exist at all?
Can i use request generators from other web servers(IIS, ...)?

I'm trying to install SSL under OAS 3.0.0.
There's a note in a documentation, that I can generate a request for CA by <b>genreq</b> utility. I can't find it. Where's it placed and does it exist at all?
Can i use request generators from other web servers(IIS, ...)?

Connecting to Tibco JMS through SSL

Hi,
How to we connect to a Tibco JMS Provider using SSL through OAS 10.1.3. Is there a way to configure OAS to use SSL when connecting to Tibco JMS Provider.
Thanks

Did you figure out a solution for this? I have the same need and I'm investigating using JAAS configuration to accomplish.

Deployment files for IIOP/SSL applets against 8i

I was reading 8i's docs on SSL authentication with IIOP clients.
I am particularly interested in deployment issues with regards to
java applets (e.g.: what JAR files and others needs to be
installed on the client machine).
The 8i EJB/CORBA doc mentioned that you need vbj30ssl.jar
installed on the cleint for the applet to communicate via
IIOP/SSL.
Then, on the other hand, reading OAS 4.0.7 documentation, it
mentioned that for clients to communicate via IIOP/SLL to OAS,
the following files are needed:
* vbjorb.jar (for basic IIOP)
* vbj30ssl.jar (for IIOP/SSL)
... and the following files for win clients:
* vbj30ssl.dll for Win/Netscape
* vbmissl.dll for Win/IE
Since 8i and OAS basically use the same ORB (Visibroker) and the
same version of SSL and visibrokker version, I am confused as to
what are really needed on the client side.
My questions are:
1) Do the windows client browsers REALLY need vbj30ssl.dll and
vbmissl.dll for IIOP/SSL to work??? Neither of these DLLs are
mentioned in 8i doc nor with JDeveloper doc, only in OAS doc.
2) If these DLLs are needed, they are not included with
JDeveloper nor with OAS anyway. Meaning I have to buy the
visibroker SSL pack (version 3.2).
3) Has anyone done work with applets talking via IIOP/SSL to
OAS/8i?
4) I am concerned about how to make the client talk via IIOP in
the first place, since applets cannot talk to another machine
except from where it was downloaded (I am planning on 8i and
Apache on separate machines). Our network guys mentioned that all
we need is a proxy server so that, as far as the applet is
concerned, it is talking to the same host as where it was
downloaded, even though the proxy send the actual IIOP packets to
the 8i host.
Thanks,
John Salvo
null

Jesus,
I'm not sure about the client-DLL item you mentioned in your
original note.
For applets, you need to deploy everything that is required by
the applet at design-time. In your JDeveloper project where you
have designed the applet, check Project Properties to view the
list of libraries that were used by the project.
To find out what archives make up that library, click the
Libraries button. Select the library you want to look at, and
it's source archives or directory paths will be listed in the
Classpath field. Note that some libraries are made up of more
than one archive.
If your applet compiles and runs within JDeveloper, then you need
to make sure that everything your applet has access to within
JDeveloper is also available at runtime.
This is probably a little more reliable a method than relying on
the docs.
Laura
Jesus M. Salvo Jr. (guest) wrote:
: Okay, JDeveloper also has aurora_client.jar, vbjorb.jar, and
: vbj30ssl.jar. Do ALL of these needs to be deployed with my
applet
: for IIOP/SSL to work??
: Jesus M. Salvo Jr. (guest) wrote:
: : I was reading 8i's docs on SSL authentication with IIOP
: clients.
: : I am particularly interested in deployment issues with
regards
: to
: : java applets (e.g.: what JAR files and others needs to be
: : installed on the client machine).
: : The 8i EJB/CORBA doc mentioned that you need vbj30ssl.jar
: : installed on the cleint for the applet to communicate via
: : IIOP/SSL.
: : Then, on the other hand, reading OAS 4.0.7 documentation, it
: : mentioned that for clients to communicate via IIOP/SLL to
OAS,
: : the following files are needed:
: : * vbjorb.jar (for basic IIOP)
: : * vbj30ssl.jar (for IIOP/SSL)
: : ... and the following files for win clients:
: : * vbj30ssl.dll for Win/Netscape
: : * vbmissl.dll for Win/IE
: : Since 8i and OAS basically use the same ORB (Visibroker) and
: the
: : same version of SSL and visibrokker version, I am confused as
: to
: : what are really needed on the client side.
: : My questions are:
: : 1) Do the windows client browsers REALLY need vbj30ssl.dll
and
: : vbmissl.dll for IIOP/SSL to work??? Neither of these DLLs are
: : mentioned in 8i doc nor with JDeveloper doc, only in OAS doc.
: : 2) If these DLLs are needed, they are not included with
: : JDeveloper nor with OAS anyway. Meaning I have to buy the
: : visibroker SSL pack (version 3.2).
: : 3) Has anyone done work with applets talking via IIOP/SSL to
: : OAS/8i?
: : 4) I am concerned about how to make the client talk via IIOP
in
: : the first place, since applets cannot talk to another machine
: : except from where it was downloaded (I am planning on 8i and
: : Apache on separate machines). Our network guys mentioned that
: all
: : we need is a proxy server so that, as far as the applet is
: : concerned, it is talking to the same host as where it was
: : downloaded, even though the proxy send the actual IIOP
packets
: to
: : the 8i host.
: : Thanks,
: : John Salvo
null

Problem with OAS Instance Name y Host Name to create trial ssl certificate

Hi, everyone
I have a problem when creating a trial ssl certificate from Verisign page, affer a live assistance, that page rejected my CSR generated from OAS, saying thay my common name has invalid characters.
My Oracle Application Server installation name: Instance.HostName is:
IAS_IND01.ind-internet
So, Verisign told me this name can't contain "_" or "-" characters for example.
I need to know if it's possible to change the instance name and if OAS host name changes also if i change server's host name.
I wouldn't like to reinstall all over again.
Please help.
Regards
David

Hi,
No your AS server will not automatic. even if you change your host name.
If U 'll try to change your host name, be carefull when U 'll try to start you AS instacne
it ' not start anymore , AS user hosts fill to get full quallified name of your host.
U 've two choices
-1 delete your AS, then change your hosts name, then new installtion of AS
2- If U 've exprience with AS, just breng your AS down, change your hosts name,
U 'll need to do some changes in your AS, just read admininstrator Guide.
Cheers,
Hamdy

Move from NON-SSL to SSL (OAS 9.0.4.1)

We installed OAS 9.0.4.1 (two Midtier and 1 Infst).
We have Application based on forms. We installed and configure OAS default like non-ssl and forms using port 7778. Now we need to use SSL.
If somebody give me detail what should be done?
Actually, what I did
1. I stop midtier Using EM.
2. I modified httpd.conf file changed only "Listen from 7778 to 4445" I didn't change port.
3. Run dcmctl updateconfig -ct ohs
4. start midtier using EM.
I can run forms using //http:localhost:4445/forms90/f90servlet? -succesufully
but My portal is not available. Did I miss something?
Please help. It is emergency we need to go to PROD.
Thanks

I started from beginning install again OAS 9.0.4 and followed instruction in
whitepaper in the Internet deployment section titled "Oracle Forms 10g - Configuring Security with SSL ".
Everything was goung okay until last peice run test form using ssl -- https
I have error
java.io.IOException: javax.net.ssl.SSLException: Failed set trust point in ssl context
     at oracle.security.ssl.OracleSSLSocketImpl.startHandshake(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsClient.doConnect(Unknown Source)
     at sun.net.www.http.HttpClient.openServer(Unknown Source)
     at sun.net.www.http.HttpClient.openServer(Unknown Source)
     at sun.net.www.http.HttpClient.<init>(Unknown Source)
     at sun.net.www.http.HttpClient.<init>(Unknown Source)
     at sun.plugin.protocol.jdk12.http.HttpClient.<init>(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsClient.<init>(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsClient.New(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsURLConnection$1.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at oracle.jinitiator.protocol.https.HttpsURLConnection.connect(Unknown Source)
     at sun.plugin.protocol.jdk12.http.HttpURLConnection.getInputStream(Unknown Source)
     at oracle.jre.protocol.jar.HttpUtils.followRedirects(Unknown Source)
     at oracle.jre.protocol.jar.JarCache$CachedJarLoader.download(Unknown Source)
     at oracle.jre.protocol.jar.JarCache$CachedJarLoader.load(Unknown Source)
     at oracle.jre.protocol.jar.JarCache.get(Unknown Source)
     at oracle.jre.protocol.jar.CachedJarURLConnection.connect(Unknown Source)
     at oracle.jre.protocol.jar.CachedJarURLConnection.getJarFile(Unknown Source)
     at sun.misc.URLClassPath$JarLoader.getJarFile(Unknown Source)
     at sun.misc.URLClassPath$JarLoader.<init>(Unknown Source)
     at sun.misc.URLClassPath$2.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.misc.URLClassPath.getLoader(Unknown Source)
     at sun.misc.URLClassPath.getLoader(Unknown Source)
     at sun.misc.URLClassPath.getResource(Unknown Source)
     at java.net.URLClassLoader$1.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at java.net.URLClassLoader.findClass(Unknown Source)
     at sun.applet.AppletClassLoader.findClass(Unknown Source)
     at sun.plugin.security.PluginClassLoader.findClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at sun.applet.AppletClassLoader.loadClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at sun.applet.AppletClassLoader.loadCode(Unknown Source)
     at sun.applet.AppletPanel.createApplet(Unknown Source)
     at sun.plugin.AppletViewer.createApplet(Unknown Source)
     at sun.applet.AppletPanel.runLoader(Unknown Source)
     at sun.applet.AppletPanel.run(Unknown Source)
     at java.lang.Thread.run(Unknown Source)
WARNING: Unable to cache https://houorcl324.corp.kbr.com:4444/forms90/java/f90all_jinit.jar
load: class oracle.forms.engine.Main not found.
java.lang.ClassNotFoundException: java.io.IOException: javax.net.ssl.SSLException: Failed set trust point in ssl context
     at oracle.security.ssl.OracleSSLSocketImpl.startHandshake(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsClient.doConnect(Unknown Source)
     at sun.net.www.http.HttpClient.openServer(Unknown Source)
     at sun.net.www.http.HttpClient.openServer(Unknown Source)
     at sun.net.www.http.HttpClient.<init>(Unknown Source)
     at sun.net.www.http.HttpClient.<init>(Unknown Source)
     at sun.plugin.protocol.jdk12.http.HttpClient.<init>(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsClient.<init>(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsClient.New(Unknown Source)
     at oracle.jinitiator.protocol.https.HttpsURLConnection$1.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at oracle.jinitiator.protocol.https.HttpsURLConnection.connect(Unknown Source)
     at sun.plugin.protocol.jdk12.http.HttpURLConnection.getInputStream(Unknown Source)
     at java.net.HttpURLConnection.getResponseCode(Unknown Source)
     at sun.applet.AppletClassLoader.getBytes(Unknown Source)
     at sun.applet.AppletClassLoader.access$100(Unknown Source)
     at sun.applet.AppletClassLoader$1.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.applet.AppletClassLoader.findClass(Unknown Source)
     at sun.plugin.security.PluginClassLoader.findClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at sun.applet.AppletClassLoader.loadClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at sun.applet.AppletClassLoader.loadCode(Unknown Source)
     at sun.applet.AppletPanel.createApplet(Unknown Source)
     at sun.plugin.AppletViewer.createApplet(Unknown Source)
     at sun.applet.AppletPanel.runLoader(Unknown Source)
     at sun.applet.AppletPanel.run(Unknown Source)
     at java.lang.Thread.run(Unknown Source)
Do I need SSL webcache too? It was not in instruction
please help

Client Certification and Just Server Certification IN SSL OAS 10.1.2.3

We are trying to find out how to setup the ssl.conf as a part of our OAS 10.1.2.3 to accept two different types of users with two different URL. We need to setup the Oracle HTTP Server to NOT TO ASK for the CLIENT VERIFICATION SMART CARD and Cert Information if the URL that is entered by the user includes /web_html for example as a part of the total URL.
We think it might be doable by using SSLRequire ( %{SSL_CIPHER} but so far no luck.
If anyone has any example to share, we greatly appreciate it.
Thanks so much in advance for your time,
KA

Resolved. Command "dcmctl resetfiletransaction" and then opmnctl stop and startall cleared the process. It was dcm-daemon that was still alive.

Question: OAS + SSL + certificate

How I can take client X.509 certificate information on OAS side by using servlet or different way?

There are cases where you don't have a trustworthy and reliable way to pre-load certificates.
Where you want or need to have a chain of authority back to a pre-loaded root CA.
Where you're unwilling to learn how to create and load (securely) your own root CA.
Or unable to get your own root CA loaded onto the client boxes in a secure fashion.
Yes, certificates can be a component of mail's client-to-server communications; useful and used for communications between your mail client(s) and your mail server.
No, SMTP mail servers don't use certificates for server-to-server communications, and don't encrypt these server-to-server port 25 communications. These communications are "authenticated" using the reverse DNS and the MX record of the sending server, and potentially gray-listing and anti-spam services such as Spamhaus Zen.
Here's an old [SSL Cert How-to|http://www.eclectica.ca/howto/ssl-cert-howto.php] and see [cacert.org|http://www.cacert.org> and see [how to install trusted root certificates|http://www.askdavetaylor.com/howto_install_trusted_root_certificatemac.html] and some interesting reading at [hacker news|http://news.ycombinator.com/item?id=1244444], among other sites.

OAS , Http listener , Netscape Enterprise Server, SSL

Hi All,
We are planning to implement SSL 3.0 on OAS Pl/SQL cartridge.
We will be configuring Netscape Enterprise server as the hhtp
listener.
I have a couple of questions.
1. Can the Netscape Enterprise server(NES) be on a different
machine and can we configure it to be a listener for the OAS?
2. When NES is the listener , should we get a digital
certificate for NES or OAS by using genreq(for SSL
implementation)? Which certificate should be installed?
Is it enuf if the NES alone has a certificate?
Please respond as soon as possible.
Thanx a lot for any help given
Radhika
null

Hi,
Please let me know, The below information.
1. is there any errors? in error log.
3. let me know the .perf output of your server.
4. iWS service pack ??
And please try to increase RqThrottle(magnus.conf) and file descriptors value( at OS side).
and let see any improvements.
(http://docs.iplanet.com/docs/manuals/ enterprise/41/scaling/html/estune.htm)
And to confirm the sceniro iWS becomes
unresponsive after particular load. I would request you
to create one more test instance without enableing
Cylink PrivateWire security software. And test it out
whether iWS becomes unresponsive after some concurrent users increase.
Thanks,
Thanks,
Dakshin.
Developer Technical Support
Sun Microsystems
http://www.sun.com/developers/support.

Confirming connections are over ssl - OAS - advanced security

I have both ssl encrypted, via OAS, and non-ssl connection support configured. During a transition time, before I disable the clear text connection support, I'd like to monitor how clients are making the connection and hopefully, be able to identify them so they can "adjusted" away from clear text. I can do this with a tcpdump filter on the server, but is there some way to collect this information in the database?
I consider net8 tracing on the server a silly response to this question, too much overhead and it requires a restart to turn tracing on. tcpdump is a much easier way to attack the problem down near that layer. This query will tell you about your current session, but I need to know about all sessions.
select sys_context('USERENV','NETWORK_PROTOCOL') from dual;
Thanks.

I was curious about why I would get the periodic close() callsBecause RMI does connection pooling, which you can also control via those system properties, and part of that is closing idle connections.
and also about why the ServerHello might be timing out. Any further insight?Network problems?
Would the DNS configuration still come into play even if we were connecting purely to the IP address?Yes because Java does reverse DNS lookups when opening sockets.
Do the domain names in the cert chain(s) possibly get resolved every time?No.

SSL 128 bits on OAS 4.0.8.1 for LINUX ?

We used to use the solaris version. To reduce cost, we are moving to Linux. Before, when you needed 128 bits security, you had to order a special patch from tech support.
The linux version we received is the export version and it is NOT 128 bits SSL.
Does 128 bits SSL exist ?
Also, LINUX support from oracle seems REALLY BAD. I'm wondering if we're doing a nice move here... ?
Thanks
null

After I fixed some of the things I broke while searching for the wrksf failure, the PL/SQL Cartridge now works for me too. And, after failing to get the DB Browser to work by loading it into the SCOTT schema, I got it to work by loading it into SYS. (SCOTT can't see the DBA_* views so loading the DB Browser into the database failed.) I haven't tried any Java Servlets yet, but that's next on my list.
If you want to try my wrksf workaround, rather than using Christoph's, here's how you can do it.
1. Backup liborb.so in the $ORACLE_HOME/orb/4.0/lib directory, just in case something goes wrong.
2. Using a hex editor, such as emacs hexl-find-file or ghex, to edit liborb.so, find the string "/proc/stat".
3. Change the directory, "/proc" to something like "/pfoo" and write the shared library file back to liborb.so. You now have the required modified liborb.so.
4. Make the /pfoo directory and cp /proc/stat /pfoo.
5. Edit /pfoo/stat and duplicate the first line, which should be the cpu line. This will let the metrics parser handle it. Make sure that /pfoo/stat has read access.
Of course, the values that the metrics code gets are now bogus, but that does not seem to be a fatal problem.
Hopefully somebody from Oracle is reading this and the real fix will be in the mail soon.

SSL on OAS 4.0.8.1

Similar Messages

Maybe you are looking for