Digital certificates can be stored in a registry from which authenticating users can look up the public keys of other users.

Depending on the public key infrastructure, the digital certificate establishes credentials for Web-based transactions based on:

• Certificate owner's name

• Certificate serial number

• Certificate expiration date

• A copy of the certificate holder's public key, which is used to encrypt messages and digital signatures

• The digital signature of the certificate-issuing authority is provided so that a recipient can verify that the certificate is real

In cryptography, a public key is a value provided by a designated authority to be used as an encryption key. The system for using public keys is called a public key infrastructure (PKI). As part of a public key infrastructure, a certificate authority checks with a registration authority (RA) to verify information provided by the requestor of a digital certificate. When the RA verifies the requestor's information, the CA can issue a certificate.

Private keys can be derived from a public key. Combining public and private keys is known as asymmetric cryptography, which can be used to effectively encrypt messages and digital signatures.

With the X509 authentication scheme (X509Scheme), the OAM Server SSL Port must differ from the Server Port, and must be configured to require Client Certificates. When X509Scheme is used, the X509 module is called after credential collection. X509Scheme requires the X509 challenge method and the X509 authentication module. The fully-qualified URL to the credential collector must be specified as the Challenge URL within X509Scheme. For example: https://managed_server_host:managed_server_ssl_port/oam/CredCollectServlet/X509

Administrators use the Oracle-provided importcert tool for several different procedures related to keystores, keys, and certificates.

/scratch/.oamkeystore 
or
/scratch/clientKey.jks

/scratch/aaa_key.der 

/scratch/aaa_cert.der 

alias 

JCEKS 

JKS 

Yes or No 

- java -cp importcert.jar
oracle.security.am.common.tools.importcerts.CertificateImport -keystore <path to .oamkeystore> -privatekeyfile <path to aaa_key.der> -signedcertfile  <path to aaa_cert.der> -alias oam.certmode -aliaspassword <password> -storetype <JCEKS> genkeystore <yes>

- java -cp importcert.jar
oracle.security.am.common.tools.importcerts.CertificateImport -keystore <path to clientkey.JKS> -privatekeyfile <path to aaa_key.der> -signedcertfile  <path to aaa_cert.der> -storetype <JKS> genkeystore <yes> 

Generate JKS keystores to be used with OAM Tester that is in Cert mode only, else skip this topic.

1. Use ImportCert tool to create JKS keystores (file name specified by -privatekeyfile and -signedcertfile). For example:

   - java -cp importcert.jar
   oracle.security.am.common.tools.importcerts.CertificateImport -keystore <Keystore path> -privatekeyfile <Private key file> -signedcertfile  <Signed certificate file> path -storetype <JKS> genkeystore <yes> 
   

   Enter the keystore password when prompted.

2. Proceed as needed for your environment:

   • Configuring Cert Mode Communication for Access Manager

   • Configuring Simple Mode Communication with Access Manager

3. Remove a Keystore: Use the following command to remove the JKS keystore. For example:

   keytool -delete -alias <alias> -keystore  <path to clientkey.JKS> -storetype <JKS> 
    

   Enter the keystore password when prompted.

You must create a Cert request and send that to the CA. When the certificate is returned you must import it to the OAM Server (or copy it to the WebGate).

The certificate request for WebGate generates the request file aaa_req.pem, which you must send to a root CA that is trusted by the OAM Sever. The root CA returns the certificates, which must be copied to the Webgate instance area manually after OAM Webgate installation and configuration.

• aaa_key.pem (reserved name for WebGate key file, which cannot be changed)

• aaa_cert.pem (reserved name for WebGate certificate file, which cannot be changed)

• aaa_chain.pem (reserved name for CA Cert for WebGate side)

During component installation in Cert mode, you are asked to present a certificate obtained from an external CA. If you do not yet have a certificate you can request one. Until you receive the certificate, you can configure the WebGate in Simple mode. However, you cannot complete OAM deployment until the certificates are issued and installed.

If you choose Cert mode when registering WebGate as an OAM Agent, a field appears where you can enter the Agent Key Password. When editing an OAM WebGate registration, password.xml is updated only when the mode is changed from Open to Cert or Simple to Cert. In cert mode, once generated, password.xml cannot be updated. Editing the agent Key Password does not result in creation of a new password.xml.

Retrieve the private key, certificate, and CA certificate for the OAM Server.

1. Generate both the certificate request (aaa_req.pem) and Private Key (aaa_key.pem) as follows:

   openssl req -new -keyout aaa_key.pem -out aaa_req.pem -utf8 -sha256

2. Create CA that generates rootCA.key and aaa_chain.pem files.

   penssl genrsa -aes256 -out rootCA.key 4096
   openssl req -x509 -new -nodes -key rootCA.key -days 7300 -sha256 -out aaa_chain.pem

3. Submit the certificate request (aaa_req.pem) to a trusted CA to get a signed (aaa_cert.pem) certificate.

   openssl x509 -req -in aaa_req.pem -CA aaa_chain.pem -CAkey rootCA.key -CAcreateserial -sha256 -out aaa_cert.pem -days 500

4. Convert aaa_cert.pem into DER format.

   openssl x509 -in aaa_cert.pem -inform PEM -out aaa_cert.der -outform DER

5. Convert aaa_key.pem into DER format.

   openssl pkcs8 -topk8 -nocrypt -in aaa_key.pem -inform PEM -out aaa_key.der -outform DER

   Tip:

   The common name for generating a certificate request for OAM server could be the host name of the OAM cluster's load balancer for clustered environments and the name of the host where OAM server is deployed for the non-clustered environments.

The Oracle-provided importcert tool is used to import existing private key, signed certificate (public key) files into the specified keystore format: JKS (client keystore format) or JCEKS (OAM Server keystore format; .oamkeystore for instance.).

After importing the certificates into the keystore, add the alias and password that you specified earlier into Access Manager settings configuration in Oracle Access Management Console.

1. In the Oracle Access Management Console, click Configuration at the top of the window.
2. In the Launch Pad tab, select Access Manager from the View drop-down menu in the Settings section.
3. In the Access Protocol section, fill in the alias and alias password details acquired in the previous procedure. For example:

   Cert Mode Configuration

   PEM keystore Alias: my_keystore_alias

   PEM keystore Alias Password: my_keystore_alias_pw

4. Click Apply to save the configuration.
5. Close the page.
6. Open the OAM Server registration page, click the Proxy tab, change the Proxy mode to Cert, and click Apply.
7. Restart the OAM Server.
8. Proceed to the following topic:

   See Generating a Private Key and Certificate Request for WebGates.

Retrieve the private key, certificate, and CA certificate for the WebGate using openSSL.

1. Generate both the certificate request (aaa_req.pem) and Private Key (aaa_key.pem) as follows:

   openssl req -new -keyout aaa_key.pem -out aaa_req.pem -utf8 -nodes -sha256

2. Submit the certificate request (aaa_req.pem) to a trusted CA.
3. Download the CA Certificate in base64 as aaa_chain.pem.
4. Download the Certificate in base64 format as aaa_cert.pem.
5. Encrypt the private key (aaa_key.pem) using a password as follows:

   openssl rsa -in aaa_key.pem -passin pass: -out aaa_key.pem -passout pass: 
   ******** -des

   Tip:

   The common name for generating a certificate request for WebGates could be the host name of the Web Server where the agent is deployed.

6. Proceed to Updating WebGate to Use Certificates.

In two-way SSL support for CERT mode communication, the user certificate is shared with server while performing the SSL handshake. Therefore, the user certificate must be added to cwallet.sso.

1. Check if the trusted certificate exists in cwallet.sso.

   $MW_HOME/oracle_common/bin/orapki wallet display -wallet ./

   If the command displays the trusted certificate in the wallet content, proceed to next step. If the trusted certificate is not displayed, add it to the wallet:

   $MW_HOME/oracle_common/bin/orapki wallet add -wallet ./ -trusted_cert -cert aaa_chain.pem -auto_login_only

2. Add user certificate request.

   For example,

   $MW_HOME/oracle_common/bin/orapki wallet add -wallet ./ -dn 'CN=oamserver,OU=OAM,O=Oracle,L=Canada,ST=Canada,C=US' -keysize 2048 -auto_login_only

3. Export the user certificate request

   For example,

   $MW_HOME/oracle_common/bin/orapki wallet export -wallet ./ -dn 'CN=oamserver,OU=OAM,O=Oracle,L=Canada,ST=Canada,C=US' -request certreq.pem

4. Submit the user certificate request (certreq.pem) to a trusted CA to get a signed (aaa_cert_file.pem) certificate.

   openssl x509 -req -days 1825 -in certreq.pem -CA aaa_chain.pem -CAkey aaa_key.pem -set_serial 01 -out aaa_cert_file.pem

   Add -sha256 flag if required.

5. Add the user certificate to the wallet

   For example,

   $MW_HOME/oracle_common/bin/orapki wallet add -wallet ./ -cert aaa_cert_file.pem -user_cert -auto_login_only

6. Verify the user certificate in the wallet

   $MW_HOME/oracle_common/bin/orapki wallet display -wallet ./

For all communication modes (Open, Simple, or Cert), the Agent registration should be updated from the Oracle Access Management Console.

1. In the Oracle Access Management Console, click Application Security at the top of the window.
2. In the Launch Pad tab, click Agents.
3. On the Search page, define your criteria and open the desired agent registration, as described in "WebGate Search Controls".
4. On the agent's registration page, locate the Security options and click Cert (or Simple).
5. Cert Mode: Enter the Agent key Password as specified in Step 5 of "Generating a Private Key and Certificate Request for WebGates".
6. Click Apply to submit the changes.
7. Copy your updated WebGate files as follows:

   OAM WebGate:

   • ObAccessClient.xml
   • cwallet.sso (OAM WebGate only)
   • password.xml

   • From: $IDM_DOMAIN_HOME/output/AGENT_NAME

   • To: $OHS_INSTANCE_HOME/config/OHS/ohs2/webgate/config

8. The following files that were created when Generating a Private Key and Certificate Request for WebGates are not required to be copied to the WebGate Server, as they were added to the cwallet.sso file using the orapki command:
   • aaa_key.pem: WebGate11g_home/webgate/ohs/tools/openssl
   • aaa_cert.pem: The location where this was saved after receiving from CA
   • aaa_chain.pem: The location where this was saved after receiving from CA
9. Restart the OAM Server and the Oracle HTTP Server instance.

For Simple mode encryption, Access Manager includes a certificate authority with its own private key, which is installed across all WebGates and OAM Servers.

During installation, the OAM Server generates and saves the private-public keypair for the server. Similarly, for the OAM agent, an Oracle certificate authority is installed with the agent installation.

The installer generates a random global passphrase initially, which can be edited or viewed as needed. When an agent is registered in SIMPLE mode, the following client certificates are generated to be consumed by clients:

• aaa_key.pem: Contains private key

• aaa_cert.pem: Signed certificate

• password.xml: Contains the random global passphrase in obfuscated format

Retrieve the random global passphrase generated by Access Manager for Simple mode communication during installation.

1. Ensure that the Oracle Access Management Console is running.
2. On the computer hosting the Oracle Access Management Console, locate the WebLogic Scripting Tool in the following path. For example:

   $ORACLE_IDM_HOME/common/bin
   

   Where $ORACLE_IDM_HOME represents the base installation directory path; /common/bin is the path wherein the scripting tool is located.

3. Start the WebLogic scripting tool. For example, on a Unix system:

   ./ wlst.sh
   

4. In the WLST shell, enter the command to connect and then enter the requested information. For example:

   wls:/offline> connect()
   Please enter your username [weblogic] :
   Please enter your password [weblogic] :
   Please enter your server URL [t3://localhost:7001] :
   wls:/base_domain/serverConfig>
   

5. Enter the following command to change the location to the read-only domainRuntime tree (for help, use help(domainRuntime)). For example:

   wls:/OAM_AC>domainRuntime()
   

6. View the global passphrase by entering the following command. For example:

   wls:/OAM_AC> displaySimpleModeGlobalPassphrase()
   

7. Proceed to "Updating WebGate Registration for Simple Mode".

Artifacts generated for Simple Security mode use the Global Pass phrase and any change must be propagated to WebGates.

1. In the Oracle Access Management Console, click Application Security at the top of the window.
2. In the Launch Pad tab, click Agents.
3. On the Search page, define your criteria and open the desired agent registration, as described in "WebGate Search Controls".
4. In the registration page, locate the Security options and click Simple.
5. Click Apply to submit the changes.
6. Copy the updated WebGate files as follows:

   OAM WebGate:

   • ObAccessClient.xml
   • cwallet.sso (OAM WebGate only)
   • password.xml

   • From: $WLS_DOMAIN_HOME/output/AGENT_NAME (the WebLogic domain home where the OAM AdminServer is installed)

   • To: $OHS_INSTANCE_HOME/config/OHS/ohs2/webgate/config

7. Copy the following files, as directed for your WebGate release:
   • aaa_key.pem
   • aaa_cert.pem

   OAM WebGate:

   For 11g Webgate:

   • From: $IDM_DOMAIN_HOME/output/AGENT_NAME

   • To: $OHS_INSTANCE_HOME/config/OHS/ohs2/webgate/config/simple

   For 12c Webgate:

   • From: $IDM_DOMAIN_HOME/output/AGENT_NAME

   • To: ${Oracle_Home}/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1/webgate/config/simple

8. Restart the OAM Server and the Oracle HTTP Server instance.

Restart the Web server to instantiate the change to SIMPLE mode to validate the results

1. From a command-line window, restart the Web server as shown in the following example:
   For 11g Webgate:

   d:\middleware\ohs_home\instances\ohs_webgate11g\bin
   opmnctl stopall
   opmnctl startall

   For 12c Webgate:

   $(Oracle_Home)/user_projects/domains/base_domain/bin/stopComponent.sh ohs1
   ( stopComponent.sh ohs1 ) $(Oracle_Home)/user_projects/domains/base_domain/bin/startComponent.sh ohs1

2. In a browser window, enter the URL to a resource protected by the WebGate using Simple mode.
3. Enter your login credentials, when asked.
4. Confirm that the resource is served.