X

Migrating SSL Certificates to OUD

Guest Author

By default, self-signed certificates are automatically asssigned to OUD instances.


In some cases, you might want to reuse a DSEE server certificate for
the new OUD instance, so that the migration is transparent for SSL
clients. Note that this might require installation of the OUD instance on the same box as the DSEE depending on SSL certificate options used.


If you want to have your OUD instance reuse the SSL servert certificate,  perform the following steps


1. export the DSEE server certificate to a PKCS12 file (e.g dsee.p12) as described in the ODSEE admin guide

    The exact procedure may depend on the DSEE release. On DSEE 6.x, DSEE 7.x and ODSEE, run the command below:


    dsadm export-cert -o dsee.p12  <instance_path> defaultCert


Note: By default, the alias of the DSEE server cert is defaultCert. Use
the appropriate alias in case you choosed to use another value.


2. copy the PKCS12 file to <OUD_INSTANCE>/config


3. create a pin file containing the pkcs12 file password e.g. dsee.p12.pin in the <OUD_INSTANCE>/config directory


At that stage, the DSEE server certificate can be imported in the OUD instance in 2 different ways:

- either configure a PKCS12 OUD keystore pointing to the file exported from DSEE

or

- import the DSEE certificate to the default JKS OUD keystore


To configure a OUD PKCS12 keystore, perform the following steps:


4.1 Configure the PKCS12 keystore

dsconfig set-key-manager-provider-prop \


         --provider-name PKCS12 \


         --set key-store-file:config/dsee.p12 \


         --set key-store-pin-file:config/dsee.p12.pin \


         --set enabled:true \


         ...



4.2 Configure the LDAPS connection handler to use the pkcs#12 keystore

dsconfig set-connection-handler-prop \


         --handler-name LDAPS\ Connection\ Handler \


         --set key-manager-provider:PKCS12 \


         ...



To import the DSEE certificate key pair to the existing OUD JKS keystore, perform the following steps:


5.1 Locate the JAVA_HOME of the jvm used by OUD


    The version of the JVM used is displayed at startup in the OUD error log


5.2 Run the following command to import the DSEE certificate

JAVA_HOME/bin/keytool
-v -importkeystore -srckeystore <Path to PKCS12 cert file exported
from DSEE>  -srcstoretype PKCS12 -destkeystore
<OUD_INSTANCE_DIR>/OUD/config/keystore  -deststoretype JKS



    When prompted, specify the JKS pin (available in
<OUD_INSTANCE_DIR>/OUD/config/keystore.pin  and the PKCS12 pin you
used to export the DSEE server cert


5.3 Check import


    To list the content of the OUD JKS keystore, use the following:


    JAVA_HOME/bin/keytool -list -keystore <OUD_INSTANCE_DIR>/OUD/config/keystore

Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 2 entries
defaultcert, Aug 29, 2013, PrivateKeyEntry,
Certificate fingerprint (MD5): 10:63:DC:B5:6B:C8:F3:A0:6B:A7:23:9E:0B:EA:9C:30
server-cert, Aug 29, 2013, PrivateKeyEntry,
Certificate fingerprint (MD5): BE:C9:F3:8A:49:98:96:15:EF:AC:B4:08:6F:76:FB:05



By default, the DSEE server cert alias is defaultcert.

By default, the OUD server cert alias is server-cert.

By default, OUD let java  automatically choose the best server-cert
amongst those present in the keystore. If you want to force the use of 
one certificate, do the following:

dsconfig set-connection-handler-prop \


         --handler-name LDAPS\ Connection\ Handler \


         --set ssl-cert-nickname:defaultcert \

         ...

Join the discussion

Comments ( 3 )
  • dik pater Wednesday, September 4, 2013

    Sylvain,

    We installed oud 11121, we can resolve tns entries but we cannot use EUs.

    We get ora 28030.

    Do you have a solution or test that i can try.

    Regards.

    Dik .


  • dik pater Wednesday, September 4, 2013

    Sylvain,

    We installed oud 11121, we can resolve tns entries but we cannot use EUs.

    We get ora 28030.

    Do you have a solution or test that i can try.

    Regards.

    Dik .


  • Sylvain Duloutre Wednesday, September 4, 2013

    Hello,

    ora 28030 usually corresponds to a connectivity problem with the LDAP directory server.

    It might be easier to start a discussion about that on a forum (e.g https://forums.oracle.com/community/developer/english/fusion_middleware/identity_management/oracle_directory_server_enterprise_edition_sun_dsee instead of using comments in a blog.


Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.