X509 Certificate Revocation Checking using OCSP (Online Certificate Status Protocol) in Weblogic Server

Original Publish Date : 8/31/2015

In this post we will see how to configure OCSP based certificate revocation check in Weblogic Server :

– First we need to create a self-signed certificate and get it signed from an internal CA (created using openssl)

– Then create another self-signed certificate and get it signed from the same CA. Now lets revoke this certificate.

– Establish a two-way SSL communication between browser and WLS.

– Configure WLS to enable OCSP (Online Certificate Status Protocol) check.

– Connect to WLS using valid and revoked certificate and see the difference.

Step 1 :

– Install OpenSSL and modify the openssl.cfg file as follows :

 authorityInfoAccess = OCSP;URI: http://host:port

Download sample openssl.cfg file HERE..!!

NOTE : Right Click on the above hyperlink and click on “Save Link As” – Now download the file and rename its extension to .zip. 

Setup your shell/cmd prompt to use the openssl.cfg file :

Command :

Step 2 :

Create an Internal CA

Command : 

./openssl req -nodes -new -x509 -keyout cakey.pem -out cacert.pem -days 3650

Step 3 :

Create a certificate and get it signed by internal CA. (say Valid certificate)

Command : 

./openssl req -nodes -newkey rsa:2048 -keyout newkey.pem -out newreq.pem -days 3650

./openssl ca -policy policy_anything -out validcert.pem -infiles newreq.pem

Step 4 :

Create a certificate and get it signed by internal CA (say Revoked certificate).

Command :

./openssl req -nodes -newkey rsa:2048 -keyout newkeyFake.pem -out newreqFake.pem -days 3650

./openssl ca -policy policy_anything -out revokecert.pem -infiles newreqFake.pem

Lets revoke this certificate now :

Command :

./openssl ca -revoke revokecert.pem 

Create two .p12 keystore (valid keystore and revoked keystore) using the following command, this file will be used to configure certificates/keystore on the browser : 

Command :

./openssl pkcs12 -export -in validcert.pem -inkey newkey.pem -out valid.p12 -name “valid”  

./openssl pkcs12 -export -in revokecert.pem -inkey newkeyFake.pem -out revoked.p12 -name “revoked” 

Step 5:

Start your OCSP server.

Command :

./openssl ocsp -index index.txt -CA cacert.pem -rsigner cacert.pem -rkey cakey.pem -port 8888 

Step 6:

Configure Weblogic to enable OCSP based certificate Revocation Check.

Step 7 :

– Enable SSL (Demo Identity and Demo Trust will be configured by default) on Weblogic and enable Two-WAY SSL (client-cert requested and enforced)

Login to console -> +Environment -> Servers -> AdminServer -> General -> SSL Listen port Enabled (check)

Login to console -> +Environment -> Servers -> AdminServer -> SSL -> +Advanced -> Two Way Client Cert Behavior -> select “Client Certs Requested and Enforced ” from the drop down menu.

– Enable Certificate Revocation Debugs :

Login to console -> +Environment -> Servers -> AdminServer ->Debug -> +weblogic -> +security -> certrevocationchecking (enable)

– Make sure you increase the logging severity to DEBUG :

Login to console -> +Environment -> Servers -> AdminServer ->Logging  -> +Advanced ->

Log file : Severity level : Debug  

Standard out : Severity level : Debug

Step 8 :

Configure a certificate signed by internal CA on your browser and access Weblogic console.

1) First configure the valid .p12 keystore –> access the console over SSL and check the Weblogic logs

2) Now delete the valid certificate.keystore from IE and configure Revoked .p12 keystore –> access the console over SSL and check the Weblogic logs 

NOTE :

 – After successfully configuring Two-Way SSL on Weblogic Admin Server and browser (IE) –> Access WLS console over https. You should see the following :

NOTE :

– Configure a valid .p12 keystore on IE and access the Weblogic console on Https, you will see the following logging in out file :

NOTE :

– Configure a revoked .p12 keystore on IE and access the Weblogic console on Https, you will see the following logging in out file :

NOTE :

When your ocsp server is down you will see the following in Weblogic Server logs and both valid and revoked keystore will be accepted by Weblogic.