WebLogic配置自己定义密钥库和SSL的操作手冊
WebLogic配置自己定义密钥库和SSL的操作手冊
(定制标识和定制信任&Keytool&TLS1.0)
1、启用SSLport
保存。重新启动受管Server
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
IE浏览器訪问
谷歌浏览器訪问
2、查看密钥库和SSL配置
密钥库
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
SSL
3、手动制作identity.jks和trust.jks
新建jks文件夹
[weblogic@Weblogic201 ~]$ mkdir jksHL
[weblogic@Weblogic201 ~]$ cd jksHL/
生成标识identity.jks密钥库
例如以下标黄色背景部分的说明：
weblogicHL为“SSL—私有密钥别名”。
keypass123为“SSL—私有密钥password短语”；
storepass123为“密钥—标识(identity)—定制标识密钥库password短语”。
storepass123为“密钥库—信任(trust)—定制标识密钥库password短语”。
3650为自己定义证书的有效期，单位为天；
[weblogic@Weblogic201 jksHL]$ keytool -genkey -alias
weblogicHL -keyalg RSA -keypass keypass123 -keystoreidentity.jks -storepass
storepass123-validity
3650
What is your first and last name?
[Unknown]: HaiLang
What is the name of your organizationalunit?
[Unknown]: GZCSS
What is the name of your organization?
[Unknown]: GZCSS
What is the name of your City or Locality?
[Unknown]: GZ
What is the name of your State or Province?
[Unknown]: GD
What is the two-letter country code forthis unit?
[Unknown]: CN
Is CN=HaiLang, OU=GZCSS, O=GZCSS, L=GZ,ST=GD, C=CN correct?
[no]: yes
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
导出公钥证书的cer文件
[weblogic@Weblogic201 jksHL]$ keytool -export -alias
weblogicHL -file root.cer -keystore identity.jks
Enter keystore password: storepass123
Certificate stored in file <root.cer>
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
生成信任trust.jks密钥库
将上一步生成的root.cer公钥证书导入并生成trust.jks密钥库
[weblogic@Weblogic201 jksHL]$ keytool -import -alias
weblogicHL -trustcacerts -file root.cer -keystoretrust.jks
Enter keystore password: storepass123
Re-enter new password: storepass123
Owner: CN=HaiLang, OU=GZCSS, O=GZCSS, L=GZ,ST=GD, C=CN
Issuer: CN=HaiLang, OU=GZCSS, O=GZCSS,L=GZ, ST=GD, C=CN
Serial number: 559a5ac9
Valid from: Mon Jul 06 18:39:05 HKT 2015until: Thu Jul 03 18:39:05 HKT 2025
Certificate fingerprints:
MD5: 04:F2:4F:97:5B:8B:32:23:AB:69:D0:6A:42:1D:C7:77
SHA1:A0:B3:6F:90:08:0D:6B:55:6F:A6:13:C6:3B:C0:F4:CE:E1:B5:72:F9
Signature algorithm name: SHA1withRSA
Version: 3
Trust this certificate? [no]: yes
Certificate was added to keystore
至此identity.jks和trust.jks制作完毕！
4、在Console配置新的密钥库和SSL
改动默认的Demo密钥库
“密钥库—更改”
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
选择“定制标识和定制信任”—“保存”
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
填写密钥库的配置
定制标识密钥库：/home/weblogic/jksHL/identity.jks
定制信任密钥库：/home/weblogic/jksHL/trust.jks
定制标识/信任密钥类型：jks
点击“保存”。设置完毕。
SSL的配置
私有密钥别名：weblogicHL
私有密钥password短语：keypass123
点击“保存”；重新启动Server。密钥库和SSL配置完毕。
5、浏览器验证
Server启动日志
[weblogic@Weblogic201 bin]$./startManagedWebLogic.sh appSrv02 http://Weblogic201:7001
.
.
JAVA Memory arguments: -Xms1024m -Xmx1024m-XX:CompileThreshold=8000 -XX:PermSize=128m -XX:MaxPermSize=256m
.
WLS Start Mode=Development
.
CLASSPATH=/home/weblogic/Oracle/Middleware/patch_wls1035/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/home/weblogic/Oracle/Middleware/patch_ocp360/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/home/weblogic/jdk1.6.0_45/lib/tools.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/home/weblogic/Oracle/Middleware/modules/features/weblogic.server.modules_10.3.5.0.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/home/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/home/weblogic/Oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/common/derby/lib/derbyclient.jar:/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/xqrl.jar:.:/home/weblogic/jdk1.6.0_45$/lib:/home/weblogic/jdk1.6.0_45$/lib/tools.jar
.
PATH=/home/weblogic/Oracle/Middleware/wlserver_10.3/server/bin:/home/weblogic/Oracle/Middleware/modules/org.apache.ant_1.7.1/bin:/home/weblogic/jdk1.6.0_45/jre/bin:/home/weblogic/jdk1.6.0_45/bin:/home/weblogic/jdk1.6.0_45/bin:/home/weblogic/jdk1.6.0_45/jre/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/weblogic/bin
.
***************************************************
* Tostart WebLogic Server, use a username and *
* password assigned to an admin-level user. For *
* server administration, use the WebLogic Server *
* console at http://hostname:port/console *
***************************************************
starting weblogic with Java version:
java version "1.6.0_45"
Java(TM) SE Runtime Environment (build1.6.0_45-b06)
Java HotSpot(TM) 64-Bit Server VM (build20.45-b01, mixed mode)
Starting WLS with line:
/home/weblogic/jdk1.6.0_45/bin/java-client -Xms1024m -Xmx1024m-XX:CompileThreshold=8000 -XX:PermSize=128m -XX:MaxPermSize=256m -Dweblogic.Name=appSrv02-Djava.security.policy=/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/weblogic.policy-Dweblogic.security.SSL.trustedCAKeyStore=/home/weblogic/Oracle/Middleware/wlserver_10.3/server/lib/cacerts
-Xverify:none -da -Dplatform.home=/home/weblogic/Oracle/Middleware/wlserver_10.3-Dwls.home=/home/weblogic/Oracle/Middleware/wlserver_10.3/server-Dweblogic.home=/home/weblogic/Oracle/Middleware/wlserver_10.3/server -Dweblogic.management.discover=false -Dweblogic.management.server=http://Weblogic201:7001
-Dwlw.iterativeDev=false-Dwlw.testConsole=false -Dwlw.logErrorsToConsole=false-Dweblogic.ext.dirs=/home/weblogic/Oracle/Middleware/patch_wls1035/profiles/default/sysext_manifest_classpath:/home/weblogic/Oracle/Middleware/patch_ocp360/profiles/default/sysext_manifest_classpath
weblogic.Server
<Jul 6, 2015 7:20:17 PM HKT><Info> <Security> <BEA-090905> <Disabling CryptoJ JCEProvider self-integrity check for better startup performance. To enable thischeck, specify -Dweblogic.security.allowCryptoJDefaultJCEVerification=true>
<Jul 6, 2015 7:20:18 PM HKT><Info> <Security> <BEA-090906> <Changing the defaultRandom Number Generator in RSA CryptoJ from ECDRBG to FIPS186PRNG. To disablethis change, specify -Dweblogic.security.allowCryptoJDefaultPRNG=true>
<Jul 6, 2015 7:20:18 PM HKT><Info> <WebLogicServer> <BEA-000377> <Starting WebLogicServer with Java HotSpot(TM) 64-Bit Server VM Version 20.45-b01 from SunMicrosystems Inc.>
<Jul 6, 2015 7:20:19 PM HKT><Info> <Security> <BEA-090065> <Getting boot identity fromuser.>
Enter username to boot WebLogicserver:weblogic
Enter password to boot WebLogic server:
<Jul 6, 2015 7:20:24 PM HKT><Info> <Management> <BEA-141107> <Version: WebLogic Server10.3.5.0.7 PSU Patch for BUG16088411 Mon Apr 01 15:13:52 IST 2013
WebLogic Server 10.3.5.0 Fri Apr 1 20:20:06 PDT 2011 1398638 >
<Jul 6, 2015 7:20:26 PM HKT><Notice> <WebLogicServer> <BEA-000365> <Server statechanged to STARTING>
<Jul 6, 2015 7:20:26 PM HKT><Info> <WorkManager> <BEA-002900> <Initializingself-tuning thread pool>
<Jul 6, 2015 7:20:26 PM HKT><Notice> <LoggingService> <BEA-320400> <The log file/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/appSrv02.logwill be rotated. Reopen the log file if tailing has stopped. This can happen
onsome platforms like Windows.>
<Jul 6, 2015 7:20:26 PM HKT><Notice> <LoggingService> <BEA-320401> <The log file hasbeen rotated to/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/appSrv02.log00018.Log messages will continue to be logged in/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/appSrv02.log.>
<Jul 6, 2015 7:20:26 PM HKT><Notice> <Log Management> <BEA-170019> <The server log file/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/appSrv02.logis opened. All server side log events will be written to this file.>
<Jul 6, 2015 7:20:29 PM HKT><Notice> <Security> <BEA-090082> <Security initializingusing security realm myrealm.>
<Jul 6, 2015 7:20:30 PM HKT><Notice> <LoggingService> <BEA-320400> <The log file/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/access.logwill be rotated. Reopen the log file if tailing has stopped. This can happen onsome
platforms like Windows.>
<Jul 6, 2015 7:20:30 PM HKT><Notice> <LoggingService> <BEA-320401> <The log file hasbeen rotated to/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/access.log00012.Log messages will continue to be logged in/home/weblogic/Oracle/Middleware/user_projects/domains/myDomain/servers/appSrv02/logs/access.log.>
<Jul 6, 2015 7:20:31 PM HKT><Notice> <WebLogicServer> <BEA-000365> <Server statechanged to STANDBY>
<Jul 6, 2015 7:20:31 PM HKT><Notice> <WebLogicServer> <BEA-000365> <Server statechanged to STARTING>
<Jul 6, 2015 7:20:33 PM HKT><Notice> <Log Management> <BEA-170027> <The Server hasestablished connection with the Domain level Diagnostic Servicesuccessfully.>
<Jul 6, 2015 7:20:33 PM HKT><Notice> <Cluster> <BEA-000197> <Listening forannouncements from cluster using unicast cluster messaging>
<Jul 6, 2015 7:20:33 PM HKT><Notice> <Cluster> <BEA-000133> <Waiting to synchronizewith other running members of Cluster1.>
<Jul 6, 2015 7:20:46 PM HKT><Notice> <Cluster> <BEA-000142> <Trying to downloadcluster JNDI tree from server appSrv04.>
<Jul 6, 2015 7:20:46 PM HKT><Notice> <Cluster> <BEA-000164> <Synchronized cluster JNDItree from server appSrv04.>
<Jul 6, 2015 7:20:46 PM HKT><Notice> <WebLogicServer> <BEA-000365> <Server statechanged to ADMIN>
<Jul 6, 2015 7:20:46 PM HKT><Notice> <WebLogicServer> <BEA-000365> <Server statechanged to RESUMING>
<Jul 6, 2015 7:20:46 PM HKT><Notice> <Cluster> <BEA-000162> <Starting"async" replication service with remote cluster address"150.18.23.201:8001,150.18.23.201:8002,150.18.23.202:8001,150.18.23.202:8002">
<Jul 6, 2015 7:20:47PM HKT> <Notice> <Security> <BEA-090171> <Loading theidentity certificate and private key stored under the alias weblogicHL from thejks keystore file /home/weblogic/jksHL/identity.jks.>
<Jul 6, 2015 7:20:47PM HKT> <Notice> <Security> <BEA-090169> <Loadingtrusted certificates from the jks keystore file /home/weblogic/jksHL/trust.jks.>
<Jul 6, 2015 7:20:47 PM HKT><Notice> <Server> <BEA-002613> <Channel"DefaultSecure" is now listening on 150.18.23.201:8012 for protocolsiiops, t3s, CLUSTER-BROADCAST-SECURE, ldaps, https.>
<Jul 6, 2015 7:20:47 PM HKT><Notice> <Server> <BEA-002613> <Channel"Default" is now listening on 150.18.23.201:8002 for protocols iiop,t3, CLUSTER-BROADCAST, ldap, snmp, http.>
<Jul 6, 2015 7:20:47 PM HKT><Notice> <WebLogicServer> <BEA-000332> <Started WebLogicManaged Server "appSrv02" for domain "myDomain" running inDevelopment Mode>
<Jul 6, 2015 7:20:48 PM HKT><Notice> <WebLogicServer> <BEA-000365> <Server statechanged to RUNNING>
<Jul 6, 2015 7:20:48 PM HKT><Notice> <WebLogicServer> <BEA-000360> <Server started inRUNNING mode>
说明自己定义的密钥库载入成功！
IE浏览器訪问
继续浏览此站点，訪问成功！
查看证书信息
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">
从有效期和证书颁发者信息可知。该证书正是我们之前制作的：
What is your first and last name?
[Unknown]: HaiLang
What is the name of your organizationalunit?
[Unknown]: GZCSS
What is the name of your organization?
[Unknown]: GZCSS
What is the name of your City or Locality?
[Unknown]: GZ
What is the name of your State or Province?
[Unknown]: GD
What is the two-letter country code forthis unit?
[Unknown]: CN
Is CN=HaiLang, OU=GZCSS, O=GZCSS, L=GZ,ST=GD, C=CN correct?
谷歌浏览器訪问
相同会提示证书不安全
继续前往
查看证书信息
至此。配置自己定义密钥库和SSL的操作已完毕！
---------------------------------------------------------------------------------------------------------------------------------
12306的SSL证书加密技术：
WebLogic配置自己定义密钥库和SSL的操作手冊的更多相关文章
- Weblogic配置SSl使用Https
一 .可以开启自带的SSL连接 启动weblogic,进入左侧菜单,点击左侧的安全领域-->点击myrealm-->点击角色和策略-->点击服务器AdminServer 点击保存,w ...
- JMeter分布式执行环境的搭建 ( 使用基于SSL的RMI的有效密钥库 )
JMeter分布式执行环境的搭建 ( 使用基于SSL的RMI的有效密钥库 ) 在上一篇的基础之上,提供一个简单的例子: Master和Slave不是同一台,采用默认端口 Master:10.86.16 ...
- 【转载】Java密钥库及keytool使用详解
---------------- 版权声明:本文为CSDN博主「adrninistrat0r」的原创文章,遵循CC 4.0 BY-SA版权协议,转载请附上原文出处链接及本声明. 原文链接:https: ...
- JavaSE--【转】网络安全之证书、密钥、密钥库等名词解释
转载 http://www.cnblogs.com/alanfang/p/5600449.html 那些证书相关的名词解释(SSL,X.509,PEM,DER,CRT,CER,KEY,CSR,P12等 ...
- 配置自己的OpenGL库，glew、freeglut库编译，库冲突解决（附OpenGL Demo程序）
平台:Windows7,Visual C++ 2010 1. 引言 实验室的一个项目,用到OpenGL进行实时绘制,还用到一些其他的库,一个困扰我很久的问题就是编译时遇到的各种符号未定义,符号重定义之 ...
- Xcode 6配置里定义${ARCHS_STANDARD}为armv7, arm64以及错误
转发:http://www.cocoachina.com/ios/20141013/9897.html 最近一次的Xcode 6更新默认不再支持arm7s架构,究竟是要废除不用呢还是仅仅只是一个疏忽? ...
- keytool 错误: java.lang.Exception: 密钥库文件不存在: keystore
通过Android Studio编译器获取SHA1 第一步.打开Android Studio的Terminal工具 第二步.输入命令:keytool -v -list -keystore keysto ...
- Java工具创建密钥库，用于Unity 3D打包、签名、发布
Java工具创建密钥库 本文提供全流程,中文翻译.Chinar坚持将简单的生活方式,带给世人!(拥有更好的阅读体验 -- 高分辨率用户请根据需求调整网页缩放比例) Chinar -- 心分享.心创新! ...
- 密钥库文件格式[keystore]代码
密钥库文件格式[keystore]代码 格式 : JKS 扩展名 : .jks/.ks 描述 : [Java Keystore]密钥库的Java实现版本,pro ...
随机推荐
- [CF911C]Three Garlands
题目大意: 给你三个灯,分别以k1秒一次,k2秒一次和k3秒一次的频率闪烁着. 你可以自定义三个灯开启的时间,问是否有一种方案,使得max(k1,k2,k3)秒之后,每秒钟都至少有一盏灯闪烁. 思路: ...
- C#SerialPort实现串口控制继电器
最近做了一个小系统,麻雀虽小五脏俱全呀,用到各种线程控制,串口控制等技术.其中串口控制最麻烦,因为继电器的响应很快,根据不同的转接口,返回的数据质量是不一样的,所以不能直接wirte,然后马上read ...
- Android App升级Intent
点击“更新检查”,自动下载最新版本安装包,然后开始安装,进入安装界面后很快闪退. 在这两天的适配中,发现这样一个问题,即:在升级覆盖安装软件时,程序能进入安装的界面,但会很快闪退.经过多次尝试,终于找 ...
- mongodb_性能监控
一.使用mongostat.exe cd C:\Program Files\MongoDB\Server\3.0\bin\ --> mongostat.exe --> mongostat ...
- 解决IIS服务和用户上传的文件分别部署在不同的电脑上时，解决权限的问题
为解决IIS服务和用户上传的文件分别部署在不同的电脑上时,解决权限的问题. 定义: A:iis服务器 B:文件服务器 步骤: 1.在B上创建一个用户[uploaduser](并设置密码) 2.给B上的 ...
- Android2017进阶知识点、面试题及答案(精选版)
前言 没啥好说的,撸起袖子就是干吧! 1 2 JAVA 相关 1.静态内部类.内部类.匿名内部类,为什么内部类会持有外部类的引用?持有的引用是this?还是其它? 静态内部类:使用static修饰的内 ...
- Kubernetes DNS的配置
Kubernetes集群机制通过DNS进行服务名和ip的映射,如果没有配置dns,你可以通过下面命令查询到集群ip kubectl get svc --namespace=kube-system 得到 ...
- redis push/pop(List)的17条命令
一.Blpop 命令移出并获取列表的第一个元素, 如果列表没有元素会阻塞列表直到等待超时或发现可弹出元素为止.redis 127.0.0.1:6379> BLPOP LIST1 LIST2 .. ...
- Laravel 5系列教程四：数据库和Eloquent
免费视频教程地址https://laravist.com/series/laravel-5-basic 上一篇写了一些Laravel Blade的基本用法和给视图传递变量的几种方式, 这一节我们来说说 ...
- nmap小技巧[1] 探测大网络空间中的存活主机
url: nmap是所有安全爱好者应该熟练掌握的扫描工具,本篇介绍其在扫描大网络空间时的用法. 为什么要扫描大网络空间呢? 有这样的情形: 内网渗透 攻击者单点突破,进入内网后,需进一步扩大成果, ...