Enable SSL, but avoid using Demonstration Certificates

4.3.4.1 Enable SSL, but avoid using Demonstration Certificates

Enable the use of SSL so that the servers can be accessed via the SSL listen ports for all supported protocols (including HTTPS).

Oracle WebLogic Server includes demonstration private keys, certificates and trusted certificate authorities that are not intended for use in production. Usage of these keys in production is a security risk due to the free availability of private keys; anyone who has a copy of the WebLogic Server has knowledge of the private keys and can compromise SSL/TLS traffic.

Therefore,

Use a local CA to issue certificates, or
Use a root or intermediate CA like VeriSign, Thawte etc. to issue certificates

Oracle Financial Services does not recommend the use of self-signed certificates in production.

Consider avoiding the use of certificates with a MD5 signature; usage of certificates with SHA-1 signatures is recommended. Most root and intermediate CAs have begun phasing out the use of MD5 for signing certificates.

Parent topic: Secure the WebLogic Security Service