{"id":7167,"date":"2021-12-03T18:30:43","date_gmt":"2021-12-03T18:30:43","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/implement-workflow-java-mailer-ssl-configuration\/"},"modified":"2026-11-03T19:28:09","modified_gmt":"2026-11-03T19:28:09","slug":"implement-workflow-java-mailer-ssl-configuration","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/implement-workflow-java-mailer-ssl-configuration\/","title":{"rendered":"Implement Workflow Java Mailer SSL configuration"},"content":{"rendered":"

Introduction <\/strong><\/p>\n

To secure workflow communications, you can configure an Oracle application server to use Secure Sockets Layer (SSL).<\/p>\n

This post describes an example of the commands and tools for setting up a test case of Workflow Java Mailer connecting to an SMTP\/IMAP server with SSL enabled. <\/p>\n

Perform the following detailed steps to configure Workflow Java Mailer:<\/p>\n

Step 1: Open ports<\/strong><\/p>\n

Work with your network team and open the following ports from Concurrent Manager Tire:
\nSMTP\/SSL Port: 465<\/em> and IMAP\/SSL Port: 993.<\/em><\/p>\n

\nProtocol: SMTP\/SSL Port: 465
\nProtocol: IMAP\/SSL Port: 993<\/em><\/p>\n

PROD [<user>@servername ~]$ telnet <SMTP Server Name> 465
\nTrying XXXXXX…
\nConnected to SMTP Server Name.
\nEscape character is ‘^]’<\/em><\/p>\n

PROD [<user>@servername ~]$ telnet <IMAP Server Name> 993
\nTrying XXXXXX…
\nConnected to IMAP Server Name.
\nEscape character is ‘^]’<\/em>
\n <\/p>\n

Step 2: Export the certificate from the email server.<\/strong><\/p>\n

Goraknath Rathod, a DBA and blogger, explains this step in his 2018 post<\/a> “To establish a secure communication channel, the certificate from the Email Server (issued by a Certification Authority) needs to be imported on the Concurrent Manager Tire.<\/p>\n

“The email server certificate issued by a trusted Certification Authority (i.e. Verisign), can be obtained from the System Administrator or downloaded by [completing the following steps]:”<\/p>\n

Following are the steps Rathod describes:<\/p>\n

A. Access your main web page https:\/\/<host.domain:port>.     
\nB. Double-click on the padlock at the bottom of the page to view the Certificates. If there is no padlock, then on the top toolbar: select File->Properties->Certificates<\/strong>.      
\nC. Select the Certification Path tab and:       
\n   a. Click on the first line and then view certificate. This will be the certificate for the root Certifying Authority (CA).         
\n   b. On the Details<\/strong> tab, click Copy to File<\/strong>. This will start the export wizard.         
\n   c. Click Next to continue.         
\n   d. Select Base-64 encoded X.509 (.CER)<\/strong> and click next<\/strong>.         
\n   e. Enter `ca1` as the name and click ok<\/strong> to export the certificate.         
\n   f. Repeat all the preceding steps for each line on the certification-path tab
\n   incrementing the file name each time by 1 (i.e., ca2, ca3)<\/p>\n

Step 3: Create a keystore <\/strong><\/p>\n

Rathod continues: “Create a keystore on the Concurrent Manager Tire. Import the certificate to keystore.”<\/p>\n

Following are the steps Rathod describes with some sample code I provided: 
\nA. Create a keystore that holds the certificate, using the default location (i.e., \/home\/applmgr<\/strong>).
\nB. Upload the Certificate to the Concurrent Manager Tire using an FTP tool.<\/p>\n

[<user>@servername ~]$ ls -lrt ca1.cer ca2.cer ca3.cer ca4.cer
\n-rw-rw-r– 1 applmgr applmgr 1472 Jul 17 00:40 ca1.cer
\n-rw-rw-r– 1 applmgr applmgr 1646 Jul 17 00:41 ca2.cer
\n-rw-rw-r– 1 applmgr applmgr 1756 Jul 17 00:41 ca3.cer
\n-rw-rw-r– 1 applmgr applmgr 2800 Jul 17 00:41 ca4.cer
\n[<user>@servername ~]$ pwd
\n\/home\/applmgr<\/em><\/p>\n

[<user>@servername ~]$ keytool -genkey -alias -keystore -storetype JKS
\nEnter keystore password:
\nRe-enter new password:
\nWhat is your first and last name?
\nWhat is the name of your organizational unit?
\nWhat is the name of your organization?
\nWhat is the name of your city or locality?
\nWhat is the name of your state or province?
\nWhat is the two-letter country code for this unit?
\nIs CN=XXX, OU=XXX, O=XXX, L=XXX, ST=XXX, C=XXX correct?
\n [no]: yes<\/em><\/p>\n

Enter key password for <-keystore>
\n    (RETURN if same as keystore password):
\nRe-enter new password: changeit<\/em><\/p>\n

C. Import the certificate into the created keystore.<\/p>\n

\n[<user>@servername ~]$ ls -la .keystore
\n-rw-rw-r– 1 applmgr applmgr 1332 Jul 17 01:04 .keystore<\/em><\/p>\n

keytool -import -alias my_cert1 -file ca1.cer -keystore .keystore -storepass <keystore password> 
\nkeytool -import -alias my_cert2 -file ca2.cer -keystore .keystore -storepass <keystore password> 
\nkeytool -import -alias my_cert3 -file ca3.cer -keystore .keystore -storepass <keystore password>
\nkeytool -import -alias my_cert4 -file ca4.cer -keystore .keystore -storepass <keystore password><\/em><\/p>\n

\nD. Verify the certificates.<\/p>\n

\n[<user>@servername~]$ keytool -list -keystore .keystore
\nEnter keystore password:<\/em><\/p>\n

Keystore type: JKS
\nKeystore provider: SUN<\/em><\/p>\n

Your keystore contains 5 entries<\/em><\/p>\n

my_cert4, Jul 17, 2020, trustedCertEntry,
\nCertificate fingerprint (SHA1): 1E:5D:EA:8C:79:E1:89:85:1B:31:62:16:1F:D9:27:6A:56:FD:AB:37
\nmy_cert3, Jul 17, 2020, trustedCertEntry,
\nCertificate fingerprint (SHA1): 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8
\nmy_cert2, Jul 17, 2020, trustedCertEntry,
\nCertificate fingerprint (SHA1): 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64
\nmy_cert1, Jul 17, 2020, trustedCertEntry,
\nCertificate fingerprint (SHA1): 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4
\n-keystore, Jul 17, 2020, PrivateKeyEntry,
\nCertificate fingerprint (SHA1): E0:DA:C8:95:4F:FB:A2:82:40:9E:6A:02:A0:82:0F:35:5E:B1:FE:08<\/em><\/p>\n

E. Set MAILER\\_SSL\\_TRUSTSTORE (i.e., \/home\/applmgr\/.keystore<\/strong>).<\/p>\n

From SQL \\*Plus:<\/p>\n

\n[<user>@servername~]$ sqlplus apps\/XXXXX @$FND_TOP\/sql\/afsvcpup.sql<\/em><\/p>\n

  10006    Workflow Notification Mailer  DEACTIVATED_SYST  WF_MAILER   
\nGSM<\/em><\/p>\n

Enter Component Id: 10006<\/em><\/p>\n

10243 SSL Trust store                NONE              NONE              N 
\nN
\nEnter the Comp Param Id to update: 10243
\nYou have selected parameter: SSL Trust store
\nCurrent value of parameter: NONE<\/em><\/p>\n

Enter a value for the parameter: \/home\/applmgr\/.keystore<\/em><\/p>\n

Step 4: Configure the Mailer to work with IMAPSSL \/ SMTPSSL<\/strong><\/p>\n

Following are the steps Rathod describes:<\/p>\n

Navigation: Log on to OAM >System Administrator > Workflow Manager > Notification Mailer Link<\/strong>.
\n 
\nA. Enter Outbound Server Name and validate check-box Outbound SSL Enable.
\nB. Enter Inbound Server name, Username, Password, Reply-to Address and validate check-box
\n    Inbound SSL Enable<\/strong>.<\/p>\n

\"java<\/p>\n

Step 5: Debugging steps for an R12 instance <\/strong><\/p>\n

Following are the steps Rathod describes:<\/p>\n

\nA. SMTP<\/p>\n

\n$AFJVAPRG -classpath $AF_CLASSPATH -Dprotocol=smtp \\
\n -Ddbcfile=$FND_SECURE\/TEST.dbc \\
\n -Dport=465 -Dssl=Y \\
\n -Dtruststore=\/home\/applmgr\/.keystore \\
\n -Dserver=email.yourdomain.com \\
\n -Daccount=youremail@yourdomain.com -Dpassword=xxxxx \\
\n -Dconnect_timeout=120 -Ddebug=Y \\
\n -DdebugMailSession=Y oracle.apps.fnd.wf.mailer.Mailer<\/em><\/p>\n

B. IMAP<\/p>\n

\n$AFJVAPRG -classpath $AF_CLASSPATH -Dprotocol=imap \\
\n -Ddbcfile=$FND_SECURE\/TEST.dbc \\
\n -Dport=993 -Dssl=Y \\
\n -Dtruststore=\/home\/applmgr\/.keystore \\
\n -Dserver=email.yourdomain.com \\
\n -Daccount=youremail@yourdomain.com -Dpassword=xxxxx\\
\n -Dconnect_timeout=120 -Ddebug=Y \\
\n -DdebugMailSession=Y oracle.apps.fnd.wf.mailer.Mailer<\/em><\/p>\n

Step 6: Authenticate Mailer<\/strong><\/p>\n

In R12.1.3, the Oracle Workflow Notification Mailer supports SMTP authentication, enabling you to use the Notification Mailer with an enterprise SMTP server configured for SMTP authentication.
\n 
\nAccording to a 2014 presentation on Oracle R12.1.3 features<\/a> “SMTP authentication requires the sender to authenticate by identifying itself to the mail server. After successful authentication, the mail server grants transmission of the sender’s emails. SMTP authentication can be used to allow legitimate users to relay mail while denying relay service to unauthorized users, such as spammers.<\/p>\n

“Oracle Workflow currently supports the PLAIN, LOGIN, and DIGST-MD5 authentication mechanisms.”<\/p>\n

Step 7: Cycle the services<\/strong><\/p>\n

To complete the configuration, stop and start all services as needed.<\/p>\n

Conclusion<\/strong><\/p>\n

SSL secures communication by providing message encryption, integrity, and authentication. By following and implementing the preceding steps, you can easily secure workflow communications.<\/p>\n","protected":false},"excerpt":{"rendered":"

Implement Workflow Java Mailer SSL configuration<\/p>\n","protected":false},"author":2,"featured_media":7169,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26289","content_type":"blog","created_by":"10130","authored_on":"2023-11-23T18:30:43+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Suryakant Sharma, Oracle Applications Database Administrator, Rackspace Technology","seo_description":"This post is an example of the commands and tools for setting up a test case of Workflow Java Mailer connecting to an SMTP\/IMAP server with SSL enabled.\u00a0","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26289-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Oracle","product":"","publisheddate":"2021-12-03T18:30:43","rxt_solutions":"Data Strategy & Governance","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Java Mailer SSL Configuration | Rackspace Technology","field_topics":"","field_slug":"implement-workflow-java-mailer-ssl-configuration","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7167","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=7167"}],"version-history":[{"count":2,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7167\/revisions"}],"predecessor-version":[{"id":9086,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7167\/revisions\/9086"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/7169"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=7167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=7167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=7167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}