In WebLogic Server, Certificate Revocation (CR) checking can be used for several purposes including, validating client certificates (inbound SSL) and server certificates (outbound SSL).

WebLogic Server's CR checking mechanism includes the following features:

• Support for the following certificate revocation methods:

  • Online Certificate Status Protocol (OCSP)

  • Certificate revocation lists (CRLs)

• You can configure CR checking on a domain-wide basis for all certificate authorities (CAs). And optionally, you can also configure certificate authority overrides for specific CAs.

  A certificate authority override contains changes to the domain-wide CR checking configuration that you want to have in effect for certificates that have been issued by a specific CA. For example, you can configure a particular OCSP responder URL to be used, or require SSL certificate path validation to fail if certificate revocation status cannot be determined. Each certificate authority override you create applies to only one specific CA.

CR checking is disabled by default in WebLogic Server. But using either WebLogic Remote Console or WLST, you can enable CR checking and configure the properties described in the sections that follow.

In WebLogic Server, CR checking is disabled by default. When you enable CR checking, WebLogic Server provides, on a domain-wide basis, a comprehensive set of mechanisms to obtain current revocation status of each certificates it validates.

This topic describes the default behavior WebLogic Server provides when you enable CR checking. The subsequent sections explain customizations you can make that can be applied domain-wide or, selectively, to specific certificate authorities.

When the default CR checking configuration is enabled, WebLogic Server automatically does the following when performing SSL certificate path validation:

1. Checks the OCSP response local cache to obtain certificate revocation status. The OCSP response local cache is an in-memory cache that holds the latest certificate status that is provided by OCSP responders.

   Certificate status in OCSP has a specific validity period. If the certificate status has expired, WebLogic Server does the following:

   1. Obtains the OCSP responder URI from the certificate. This URI is included in the Authority Information Access (AIA) value in the certificate, which indicates how to access information and services from the issuer of the certificate.

   2. Submits an OCSP request to the OCSP responder.

      The OCSP responder returns an OCSP response, which includes a certificate status of good, revoked, or unknown.

   3. Updates the OCSP response local cache with the OCSP response.

   For certificates that have a valid, non-expired entry in the OCSP response local cache, WebLogic Server can obtain its revocation status from the cache instead of requesting a fresh OCSP response. This provides improved performance and reduced use of network bandwidth.

   Note:

   Note the following:

   • Cached entries expire based on the OCSP validity period, but the cache behavior can be customized.

   • The local OCSP response cache is never used when OCSP nonce is enabled. This ensures the freshest response.

2. If the certificate has an OCSP status of unknown, WebLogic Server checks the CRL local cache for valid CRLs to determine whether the certificate has been revoked. (If either a revoked or not revoked status is determined by OCSP, CRL is not used for the certificate.)

   By default, the CRL local cache is a file-based store that is maintained on each server instance in a WebLogic domain and that is updated on demand from CRL distribution points. A CRL distribution point is a network-accessible server that provides CRLs for download.

   If no valid CRLs are available in the CRL local cache, WebLogic Server does the following:

   1. Obtains the CRL distribution point URL, which is included in the CRLDistributionPoints extension in the certificate.

   2. Using the CRL distribution point URL, downloads a fresh CRL and adds it to the cache.

   3. Searches the CRL for an entry that corresponds to the certificate.

   If the certificate serial number is not found in the CRL from the issuer, the certificate status is set to not revoked.

Note the following:

• If the certificate has an OCSP status of revoked, or is included in a valid CRL, WebLogic Server automatically fails SSL certificate path validation.

• If the revocation status is unknown or cannot be determined after using OCSP and checking the available CRLs, certificate path validation by default is not failed.

The following topics explain how to configure and customize default CR checking:

• Configuring Default CR Checking

• Customizing the CR Checking Configuration

By default, when checking a certificate's revocation status, WebLogic Server first uses Online Certificate Status Protocol (OCSP). If OCSP returns the certificate's status as "unknown," WebLogic Server then uses CRLs. However, you can change the CR checking method and order in a WebLogic domain by using the CertRevocMBean.MethodOrder MBean attribute.

You can change the CR checking method used, or the sequence in which the methods are used, to one of the following:

• OCSP only

• CRLs only

• OCSP then CRLs — If the OCSP status for a certificate is returned as unknown, CRLs are checked for certificate status.

• CRLs then OCSP — If a certificate's revocation status cannot be determined by checking available CRLs, its OCSP status is checked.

Configuring the CR checking method and order in a WebLogic domain is available through the following MBean attribute:

You can configure a CA override for this MBean attribute, as explained in Configuring Certificate Authority Overrides.

For information about how to use WebLogic Remote Console to configure the CR checking method and order for a WebLogic domain, see Enable Certificate Revocation Checking in Oracle WebLogic Remote Console Online Help.

By default, if an X.509 certificate's revocation status cannot be determined by any of the selected checking methods, the certificate can still be accepted if the SSL certificate path validation is otherwise successful. However, for certificates whose revocation status cannot be determined, you can optionally configure WebLogic Server to fail certificate path validation.

Configuring a WebLogic domain to fail SSL certificate path validation when the revocation status cannot be determined is available through the following MBean attribute:

You can configure a CA override for this MBean attribute, as explained in Configuring Certificate Authority Overrides.

For information about how to configure this MBean attribute using WebLogic Remote Console, see Enable Certificate Revocation Checking in Oracle WebLogic Remote Console Online Help.

The Online Certificate Status Protocol (OCSP) is an automated certificate checking network protocol that is defined in RFC 2560.

As part of certificate validation, WebLogic Server queries the revocation status of a certificate by issuing an OCSP request to an OCSP responder. Certificate status is maintained by the OCSP responder. Acceptance of the certificate is suspended until the responder returns an OCSP response, indicating whether the certificate is still trusted by the CA that issued it.

OCSP may be used to satisfy some of the operational requirements of providing more timely revocation information than is possible with CRLs and may also be used to obtain additional status information. For more information about OCSP, see the description of RFC 2560 at http://www.ietf.org/rfc/rfc2560.txt.

The following sections describe how to configure OCSP in WebLogic Server:

• Using Nonces in OCSP Requests

• Setting the Response Timeout Interval

• Enabling and Configuring the OCSP Response Local Cache

A certificate revocation list (CRL) is a time-stamped list of digital certificates that have been revoked by the certificate authority (CA) that issued them. Each CRL is signed by a CA and is made available in a public repository. The WebLogic Server CRL implementation provides a CRL local cache for more efficient CR checking, automatic import of user CRL files, and distribution points from which the cache can be populated and refreshed.

The CRL implementation in WebLogic Server includes support for the following:

• CRL local cache, which enables efficient access for CR checking.

• Automatic import of user supplied CRL files into the CRL cache.

• Use of distribution points from which the CRL cache can optionally be populated and refreshed.

The following sections explain how to configure CRL usage in WebLogic Server:

• Enabling Updates from Distribution Points

• Configuring the CRL Local Cache

Configuring certificate authority overrides allows you to specify CR checking behavior that is enforced for certificates issued by a particular CA. A certificate authority override always supersedes the domain-wide CR checking configuration that is enabled.

The following sections explain how to configure CR checking CA overrides:

• General Certificate Authority Overrides

• Configuring OCSP Properties in a Certificate Authority Override

• Configuring CRL Properties in a Certificate Authority Override