Friday, April 9, 2010

Couple of things you need to know when setting up SSL on Weblogic server

  • Choose 443 as your default SSL Listen Port.
  • Put this into your start.cmd - -Dweblogic.security.SSL.ignoreHostnameVerification=true. Wonder why? If you use weblogic for local development sandbox, then that line will help you get rid of annoying "failed hostname verification check" error.
  • If you use a nodemanager, then instead of -D line above, use this line in your nodemanager script- -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false
  • There are two trust stores by default in weblogic, one demo trust store, another jdk one. Don't use the jdk one as it probably would throw you a  sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Instead, set -Djavax.net.ssl.trustStore=%WL_HOME%\server\lib\DemoTrust.jks in your startup script. There is no need to specify a passphrase, i.e. -Djavax.net.ssl.trustStorePassword is not required.
  • If you encounter issues with SSL at runtime, adding this -D will help you troubleshoot with more debug information printed out, -Djavax.net.debug=ssl,handshake,trustmanager.
The goal of this post is to get you started quickly on enabling SSL on weblogic, so that you can focus on your application development or problem resolutions.However, setting up proper SSL, either one or two-ways on weblogic for production environment is a different kettle of fish. It requires more thorough planning and execution.

No comments: