SSL Configuration of OHS in front of WLS

 

Guys , in recent past I worked with SSL configuration of OHS 11.1.1.9 in front of WLS 10.3.6 with JDK 1.7.Sharing the steps as ready made solution for the flow Client -- HTTPS --> Oracle HTTP Server ( mod_wl_ohs ) -- HTTPS --> WebLogic Managed Server(s). For this POC , I’ve only WLS admin server & OHS standalone installation on Windows.

1. Creation of Keystore for WLS.

Created my own identity & trust store as below ,

keytool -genkey -alias selfsignedcert -keyalg RSA -sigalg SHA256withRSA -keypass welcome1 -keystore identity.jks -storepass welcome1 -validity 365

keytool -export -alias selfsignedcert -sigalg SHA256withRSA -file root.cer -keystore identity.jks
 
keytool -import -alias selfsignedcert -sigalg SHA256withRSA -trustcacerts -file root.cer -keystore trust.jks

As a result you’ll get identity.jks & trust.jks keystore created.

2. Configuration of Keystore for WLS

Configure custom identtity & custom trust for WLS , I’m not going through details for this step

Set host name verification none & client cert not requested.

Set WLS Console–> Admin server –> General –>Advanced –> .WebLogic Plug-In Enabled checked.

Set WLS Console –> Domain –> Configuration –> Web Applications –>WebLogic Plugin Enabled checked.

Set WLS Console–> Admin server –>SSL—> Advanced –> Use JSSE SSL checked.

3. That’s all from WLS side , bounce the server & access the SSL port to verify whether WLS console is opening or not.

4. Creation of Wallet for OHS.

Here I’m going to create blank wallet using orapki utility with auto login option & add the WLS certificate from identity.jks.

orapki wallet create -wallet D:\shrik\WT\Oracle_WT1\instances\instance1\OHS\ohs1\wallet -auto_login_only

orapki wallet jks_to_pkcs12 -wallet D:\shrik\WT\Oracle_WT1\instances\instance1\OHS\ohs1\wallet -keystore D:\shrik\IAM\user_projects\domains\test_domain\identity.jks -jkspwd welcome1

orapki wallet display -wallet D:\shrik\WT\Oracle_WT1\instances\instance1\OHS\ohs1\wallet

Change the patch accordingly to reflect your environment.

5. Configuration of ssl.conf for OHS

Under the SSL Virtual Host section change below

#Path to the wallet
   SSLWallet D:/shrik/WT/Oracle_WT1/instances/instance1/config/OHS/ohs1/keystores/wallet

6.Configuration of mod_wl_ohs.conf

I’m pasting mine here , paths are customized for windows,

# NOTE : This is a template to configure mod_weblogic.

LoadModule weblogic_module   D:/shrik/WT/Oracle_WT1/ohs/modules/mod_wl_ohs.so

# This empty block is needed to save mod_wl related configuration from EM to this file when changes are made at the Base Virtual Host Level
<IfModule weblogic_module>
#      WebLogicHost <WEBLOGIC_HOST>
#      WebLogicPort <WEBLOGIC_PORT>
#      Debug ON
#      WLLogFile /tmp/weblogic.log
#      MatchExpression *.jsp
 WebLogicSSLVersion TLSv1.2
</IfModule>

# <Location /weblogic>
#      SetHandler weblogic-handler
#      PathTrim /weblogic
#      ErrorPage  http:/WEBLOGIC_HOME:WEBLOGIC_PORT/
#  </Location>

<Location /console>
    SetHandler weblogic-handler
    WebLogicHost shroycho-in.in.oracle.com
    WebLogicPort 7112
    Debug ALL
    WLLogFile D:/shrik/WT/Oracle_WT1/instances/instance1/OHS/ohs1/wllog.txt
    DebugConfigInfo ON
    WLProxySSL ON
    SecureProxy ON
    Idempotent ON
    WlSSLWallet D:/shrik/WT/Oracle_WT1/instances/instance1/config/OHS/ohs1/keystores/wallet
</Location>

Highligted the lines to be added to access WLS console over SSL port via OHS.

7. Thast’s all for OHS , start the instance and try to access first OHS SSL port . Then append /console and see whether it’s redirecting to WLS SSL enabled console or not.

For any issue you can check the wllog.txt file.