{"id":7386,"date":"2020-12-04T16:44:04","date_gmt":"2020-12-04T16:44:04","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/configuring-ssl-in-weblogic-server-12c\/"},"modified":"2026-11-03T19:28:38","modified_gmt":"2026-11-03T19:28:38","slug":"configuring-ssl-in-weblogic-server-12c","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/configuring-ssl-in-weblogic-server-12c\/","title":{"rendered":"Configuring SSL in WebLogic Server 12c"},"content":{"rendered":"

This post describes how to configure SSL on Oracle\u00ae WebLogic\u00ae Server 12c (12.1.2).<\/strong><\/em><\/p>\n

Overview <\/strong><\/p>\n

Security of the data and information is a primary concern in today’s world. A variety of applications use the Secure Socket Layer (SSL) protocol for secure communication over the network. It is one of the most widely used network communication protocols.<\/p>\n

WebLogic Server, configured to use SSL, provides both identity authentication<\/em> and in-transit data encryption<\/em> for connection between two application programs. Thus, any two applications interacting with each other through SSL gain the following secure-connection benefits:<\/p>\n

 <\/p>\n

    \n
  1. They verify each other’s identity by using individual SSL certificates.<\/li>\n
  2. They exchange encrypted (in-transit) data between both application programs.<\/li>\n<\/ol>\n

    The SSL connection request and response mechanism adds computation overhead of processing additional data and information regarding authentication and requires complex cryptographic algorithm processing. Therefore, most people do not usually use it in Weblogic server instances running in development mode<\/em> within a highly secure network infrastructure. However, SSL configuration is highly desirable for Weblogic server instances running in production mode<\/em>. <\/p>\n

    Configuration demonstration<\/strong><\/p>\n

    This post covers the steps to configure SSL on a preinstalled Weblogic Server on the MYPROD\\_AdminServer<\/strong> and Managed Server<\/strong> instances in the MYPROD_DOMAIN <\/strong>domain Node Manager. <\/p>\n

    To do this, create a new identity keystore and a new trusted keystore to store the newly signed certificate. Thus, the WebLogic admin, all managed server instances, and the Node Manager communicate by using the SSL protocol based on custom keystores.<\/p>\n

    Use the following steps to configure SSL on existing WebLogic  server instances:<\/p>\n

    Step 1: Create the identity keystore <\/strong><\/p>\n

    Perform the following steps to create the identity keystore, MYPRODIdentity.jks<\/strong>, on the myprodserver.mydomain.local<\/strong> server:<\/p>\n

    (a) Log into the WebLogic Server Linux\u00ae; server shell as the WebLogic application owner user (such as Oracle<\/em>) and run the following code to create a new folder,
    \n\\<middleware_home\\>\/user_projects\/domains\/\\<domain_home\\>\/keystores<\/strong>:<\/p>\n

      [oracle@myprodserver]$ mkdir -p \/u01\/Middleware\/user_projects\/domains\/MYPROD_DOMAIN\/keystores<\/em><\/p>\n

    (b) Set the`MYPROD_DOMAIN` environment and create the new keystore:<\/p>\n

        [oracle@myprodserver]$ cd \/u01\/Middleware\/user_projects\/domains\/MYPROD_DOMAIN\/bin
    \n    [oracle@myprodserver]$ . .\/setDomainEnv.sh
    \n    [oracle@myprodserver]$ cd keystores
    \n    [oracle@myprodserver]$ keytool -genkeypair -alias mywlsprodcert -keyalg RSA -keysize 1024 -dname “CN=*.mydomain.local,OU=<Organization>,O=<Company>,L=<City>,S=<State>,C=<US>” -keystore MYPRODIdentity.jks
    \n    Enter keystore password: <Type a new keyStorePass>
    \n    Re-enter new password: <Re-type the keyStorePass><\/em><\/p>\n

    Enter key password for <mywlsprodcert> (RETURN if same as keystore password): <ENTER><\/p>\n

    Step 2: Generate a new CSR<\/strong><\/p>\n

    Perform the following steps to generate a new Certificate Signing Request (CSR) using MYPRODIdentity.jks<\/strong><\/p>\n

    (a) <\/strong>Run the following code to use the keytool<\/em> utility to generate the CSR: <\/p>\n

        [oracle@myprodserver]$ keytool -certreq -v -alias prodcert -file MYWLSPRODCert.csr -keystore MYPRODIdentity.jks
    \n    Enter keystore password: <KeyStorePass>
    \n    Certification request stored in file <MYWLSPRODCert.csr><\/em><\/p>\n

    (b) Submit the newly created Certificate Signing Request (CSR) to a Certificate Authority 
    \nCA). After signing the CSR, the CA provides the digital certificate and its private key.<\/p>\n

    NOTE: <\/strong>For this demonstration, we use the WebLogic Demo CA (CertGenCA.der) to sign the certificate. This demo self-signing feature is available with WebLogic Server. In production, you should get server certificates signed by your organization’s designated, trusted CA.<\/p>\n

    Step 3: Self-sign the CSR<\/strong><\/p>\n

    Perform the following steps to self-sign the CSR by using the WebLogic demo CA (CertGenCA.der)
    \nand import it into the newly created identity keystore:<\/p>\n

    (a) Run the following code to self-sign the certificate:<\/p>\n

        [oracle@myprodserver]$ java utils.CertGen -keyfile MYPRODCertPrivateKey -keyfilepass password -certfile mywlsprodcert -cn “*.my.local”
    \n    Generating a certificate with wildcard *.domain.local and key strength 1024
    \n    \/u01\/Middlewaree\/wlserver_12.1\/server\/lib\/CertGenCA.der file and key from \/u01\/Middlewaree\/wlserver_12.1\/server\/lib\/CertGenCAKey.der file
    \n    [oracle@myprodserver]$<\/em><\/p>\n

    \n(b) Import the newly created server certificate and private keys to the previously created
    \nkeystore:<\/p>\n

        [oracle@myprodserver]$ java utils.ImportPrivateKey -keystore MYPRODIdentity.jks -keyfile MYPRODCertPrivateKey.pem -keyfilepass <password> -certfile MYPRODCert.pem -storepass <keyStorePass> -alias mywlsprodcert<\/em><\/p>\n

    Step 4: Create the keystore<\/strong><\/p>\n

    Perform the following steps to create the custom trust keystore on the myprodserver.mydomain.local<\/strong> machine:<\/p>\n

    (a) Create the MYPRODTrust.jks<\/strong> keystore by making a copy from the Standard Java Trust:<\/p>\n

        [oracle@myprodserver]$ cp \/u01\/java\/jre\/lib\/security\/cacerts 
    \n    \/u01\/Middleware\/user_projects\/domains\/MYPROD_DOMAIN\/keystores\/MYPRODTrust.jks<\/em><\/p>\n

    (b) Change the default cacerts<\/strong> password. The default is changeit<\/em>. Update it to a new password of your choice:<\/p>\n

        [oracle@myprodserver]$ keytool -storepasswd -keystore MYPRODTrust.jks
    \n    Enter keystore password: <defaultKeyStorePass>
    \n    New keystore password: <NewKeyStorePass>
    \n    Re-enter new keystore password: <Re-type NewKeyStorePass><\/em><\/p>\n

    (c) Import the newly created self-signed certificate to the recently created trust keystore:<\/p>\n

       [oracle@myprodserver]$ keytool -import -v -trustcacerts -alias rootCA -file \/u01\/Middleware\/wlserver_12.1\/server\/lib\/CertGenCA.der -keystore MYPRODTrust.jks<\/em><\/p>\n

    Step 5: Copy the SSL certificate to all other servers in the domain<\/strong><\/p>\n

    Because you based the SSL certificate on wildcards instead of a specific server name, all servers in MYPROD\\_DOMAIN<\/strong> can use the same certificate. Therefore, copy the previously created keystores directory, \/u01\/Middleware\/user\\_projects\/domains\/MYPROD\\_DOMAIN\/keystores<\/strong>, which contains the
    \nrequired certificates for all WebLogic Servers shared by MYPROD\\_DOMAIN<\/strong> <\/p>\n

    Step 6: Configure the WebLogic Node Manager<\/strong><\/p>\n

    Perform the following steps to configure the WebLogic Node Manager to use the newly created SSL certificate:<\/p>\n

    (a) Update the following variables in the $WL_HOME\/common\/nodemanager\/nodemanager.properties<\/strong> file:<\/p>\n

        KeyStores=CustomIdentityAndCustomTrust    CustomIdentityKeyStoreFileName=\/u01\/Middleware\/user_projects\/domains\/MYPROD_DOMAIN\/keystores\/MYPRODIdentity.jks
    \n    CustomIdentityKeyStorePassPhrase=<NewKeyStorePass>
    \n    CustomIdentityAlias=mywlsprodcert
    \n    CustomIdentityPrivateKeyPassPhrase=<PrivateKeyPassword><\/em><\/p>\n

    (b) Shut down and start the Node Manager.<\/p>\n

    Step 7: Configure the WebLogic Admin Server<\/strong> <\/p>\n

    Perform the following steps to configure the WebLogic Admin Server to use the new custom
    \nkeystore and certificate for SSL connections:<\/p>\n

    (a) Log into the WebLogic Server Console by using your WebLogic administrator credentials. 
    \n 
    \n(b) On the Home<\/strong> page, under Domain Configurations –> Environments<\/strong>, click Servers<\/strong>,
    \nas shown in the following screenshot:<\/p>\n

    \"ssl<\/p>\n

    (c) On the Summary of Servers<\/strong> page, click AdminServer (admin)<\/strong>:<\/p>\n

    \"ssl<\/p>\n

    (d) From the top left-hand side Change Center –> View changes and restarts<\/strong>, click Lock & Edit<\/strong> to update the keystore rule settings. <\/p>\n

    (e) In Settings for AdminServer<\/strong> under Configuration<\/strong>, click the keystores<\/strong> tab and then click change<\/strong>, as shown in the following images to change the WebLogic admin server rule to use the newly created custom keystore for the SSL connection.<\/p>\n

    \"ssl<\/p>\n

    \"ssl<\/p>\n

     (f) Update Keystore rule by selecting Custom Identity and Custom Trust<\/strong> from the Keystores<\/strong> drop-down list and save the updates.<\/p>\n

    \"ssl<\/p>\n

    \n(g) Update .\/keystores\/MYPRODIdentity.jks<\/strong> in the Custom Identity Keystore<\/strong> text box. Update keyStore password<\/strong> and save. <\/p>\n

    (h) Update .\/keystores\/MYPRODTrust.jks<\/strong> in the Custom Trust Keystore<\/strong> text box.
    \nUpdate Trust keyStore Password<\/strong> and save.<\/p>\n

    (i) Open SSL tab under the Configuration<\/strong> parent tab and update following parameters:<\/p>\n

       (i) Update Private Key Alias<\/strong> parameter value to mywlsprodcert<\/strong>. 
    \n  (ii) Update Private Key Passphrase<\/strong> with the private key password.
    \n (iii) Under the Advanced<\/strong> menu, update the Hostname Verification<\/strong> value to  Custom Hostname Verifier<\/strong> from the drop-down list as shown in the following image:  <\/p>\n

    \"ssl<\/p>\n

      (iv) Update the Custom Hostname Verifier<\/strong> value to weblogic.security.utils.SSLWLSWildcardHostnameVerifier<\/strong>. 
    \n  This is required because we are using a single wildcard certificate for all servers (**CN=\\*.mydomain.local**).<\/em>
    \n   (v) Save these updates. <\/p>\n

    (j) Navigate to the Configuration –> General<\/strong> tab and enable the SSL Listen Port Enabled <\/strong>option by checking the checkbox as shown in the following image:<\/p>\n

    \"ssl<\/p>\n

    (k) The WebLogic admin server default SSL port is `7002`<\/em>, but you can configure SSL services on other ports as well. You need to use the default value 7002<\/strong> here for demonstration purposes, so update SSL Listen Port<\/strong> to 7002<\/strong> and save the update, as shown in the following image: <\/p>\n

    \"ssl<\/p>\n

     <\/p>\n

    Step 8: Configure the WebLogic Managed Servers <\/strong><\/p>\n

    To configure all the WebLogic Managed Servers to use the new custom key store and certificate for SSL connections, repeat steps 7a – 7k<\/strong>. You need to use different SSL port values for each WebLogic Managed Server. For example, use `ManagedServer01: SSL port – 9001`, `ManagedServer02: SSL port – 9002`, `ManagedServer03: SSL port – 9003`, and so on.<\/p>\n

    Step 9: Apply updates to the configuration files<\/strong><\/p>\n

    Click Release Configuration<\/strong> from the top left-hand menu to apply all updates to the WebLogic configuration files.<\/p>\n

    Step 10: Restart WebLogic<\/strong><\/p>\n

    Restart the WebLogic admin and all managed servers together with Node Manager.<\/p>\n

    Conclusion<\/strong><\/p>\n

    This post provides the steps to configure a WebLogic server to use SSL security protocol to enable websites to pass sensitive information securely in an encrypted format. With the use of SSL certificates and RSA Data Security’s cryptography mechanism, users can exchange and process data and information securely.<\/p>\n

    Because you enabled SSL on both the admin server and managed server by using this document, both data and the WebLogic server are secure from any cyber-attacks and data leaks.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Configuring SSL in WebLogic Server 12c<\/p>\n","protected":false},"author":2,"featured_media":7388,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26406","content_type":"blog","created_by":"10130","authored_on":"2023-12-19T16:44:04+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Configure SSL on Oracle WebLogic Server 12c for secure network communication. Protect data with identity authentication and encryption.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26406-insights_image-security-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Oracle","product":"","publisheddate":"2020-12-04T16:44:04","rxt_solutions":"Databases","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Secure Communication SSL 12c WebLogic Server | Rackspace","field_topics":"","field_slug":"configuring-ssl-in-weblogic-server-12c","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7386","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7386"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7386\/revisions"}],"predecessor-version":[{"id":9434,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7386\/revisions\/9434"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7388"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}