RRC UOB China

SETUP SSL
EPM & OBIEE
A. Preparation before SSL Setup
1. Stop All EPM Services (APP, WEB , DB & EPMA)
1) Open Directory:

[APP] /app/RRCCN/EPM/Middleware/user_projects/epmsystem1/bin

[DB] /app/RRCCN/Middleware/user_projects/epmsystem2/bin

[WEB] /app/RRCCN/Middleware/user_projects/epmsystem4/bin

Then :

$ ./stop.sh
Stop EPMA Services with Stop EPM System
2. Stop OBIEE Service

1) Open Directory:

/
app/RRCCN/OBIEE/MiddlewareBI/user_projects/domains/bifoundation_doma
in/bin

Then :

$ ./stopManagedWebLogic.sh bi_server1
3. Stop All Web Logic (EPM & OBIEE)

1) For EPM (7001)

Open Directory:

/app/RRCCN/EPM/Middleware/user_projects/domains/EPMSystem/bin

Then :

$ ./stopWebLogic.sh

2) For OBIEE (7002)

Open Directory:

/
app/RRCCN/OBIEE/MiddlewareBI/user_projects/domains/bifoundation_doma
in/bin

Then :

$ ./stopWebLogic.sh

B. Set Java Home Variable

JAVA_HOME=C:\Oracle\Middleware\jdk160_35
C. Create Wallet and Self Signed RootCert
1) Create Folder serverkey inside directory C:\Oracle\Middleware

2) Navigate to directory C:\Oracle\Middleware\oracle_common\bin

 3) Create Wallet for RootCert Repo,
orapki wallet create -wallet C:\Oracle\Middleware\serverkey\rootca -pwd
P@ssw0rd

[Refer to Credential Doc.xlsx]

4) Create and Add Sign-in The RootCert into Wallet

orapki wallet add -wallet C:\Oracle\Middleware\serverkey\rootca -dn
CN=PACN,OU=ITD,O=PA,L=Singapore,S=Singapore,C=Singapore -keysize
2048 -self_signed -validity 3650 pwd P@ssw0rd

[Refer to Credential Doc.xlsx]

D.Create KeyStore
1) Create folder ssl_webserver for save the keystore under directory
C:\Oracle\Middleware\serverkey
 2) Move to directory: C:\Oracle\Middleware\jdk160_35\bin

3) Then Generate the keystore:

keytool -genkey -alias HYP11124 -keyalg RSA -keystore

C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.jks -keysize
2048

Enter keystore password as : [Refer to Credential Doc.xlsx] P@ssw0rd

Re-enter : [Refer to Credential Doc.xlsx], P@ssw0rd

Use as below details:

First and Last Name : HYP11124

Name of Organizational Unit : ITD

Name of Organization : PA

City or Locality : Singapore

State or Province : Singapore

Two-Letter Country Code : SG

Correct? Yes

, then Enter to proceed

 E. Generate Cert Request (CSR) from the KeyStore
1) Generate CSR from KeyStore :
keytool -certreq -alias HYP11124 -keystore
C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.jks -file
C:\Oracle\Middleware\serverkey\ssl_webserver\csr.HYP11124.txt

Enter Password KeyStore : [Refer to Credential Doc.xlsx] P@ssw0rd

F. Generate Completing Cert from CSR
1) Move to directory: C:\Oracle\Middleware\oracle_common\bin

orapki cert create -wallet C:\Oracle\Middleware\serverkey\rootca -request

C:\Oracle\Middleware\serverkey\ssl_webserver\csr.HYP11124.txt -cert
C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.txt -validity 3650

Enter Wallet Password : [Refer to Credential Doc.xlsx] P@ssw0rd

G.Generate RootCert into Text File
1) Generate RootCert into Txt
orapki wallet export -wallet C:\Oracle\Middleware\serverkey\rootca -dn
CN=PACN,OU=ITD,O=PA,L=Singapore,S=Singapore,C=Singapore -cert
C:\Oracle\Middleware\serverkey\rootca.HYP11124.txt

password : P@ssw0rd
 H.Import RootCert to KeyStore

1) Move to directory: C:\Oracle\Middleware\jdk160_35\bin

Import the RootCert Txt into KeyStore

keytool -import -trustcacerts -alias PACN -file

C:\Oracle\Middleware\serverkey\rootca.HYP11124.txt -keystore
C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.jks

password : P@ssw0rd

Enter KeyStore : [Refer to Credential Doc.xlsx]

Trust Certificate : Yes

 I. Import Cert into KeyStore
1) Import the Cert into KeyStore :
keytool -import -trustcacerts -alias HYP11124 -file
C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.txt -keystore
C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.jks

Enter KeyStore Password : [Refer to Credential Doc.xlsx] P@ssw0rd

 J. Convert KeyStore to The Wallet
1) Create another Wallet (wallet.HYP11124)
2) Go to C:\Oracle\Middleware\oracle_common\bin

orapki wallet create -wallet

C:\Oracle\Middleware\serverkey\ssl_webserver\wallet.HYP11124

Enter Wallet Password : [Refer to Credential Doc.xlsx] P@ssw0rd

Re-Enter Password : [Refer to Credential Doc.xlsx] P@ssw0rd

 3) Convert KeyStore to Wallet
orapki wallet jks_to_pkcs12 -wallet
C:\Oracle\Middleware\serverkey\ssl_webserver\wallet.HYP11124 -keystore
C:\Oracle\Middleware\serverkey\ssl_webserver\HYP11124.jks

Enter Wallet Password : [Refer to Credential Doc.xlsx] P@ssw0rd

Enter KeyStore (JKS) Password : [Refer to Credential Doc.xlsx] P@ssw0rd

K. Configure Wallet Manager
1) Open the wallet manager from start menu :

2) Choose Wallet and Open.

 3) Choose Yes.

4) Choose the Wallet that have been converted from KeyStore(JKS) before as
below.

C:\Oracle\Middleware\serverkey\ssl_webserver\wallet.HYP11124.sg.uobnet
.com

5) Enter Wallet Password : [Refer to Credential Doc.xlsx] P@ssw0rd

6) All RootCert and Cert already inputted.

7) Choose Wallet and Check Box the Auto Login

8) Then Click SAVE
 L. Backup OHS Files Setup (Original After EPMA)
Backup the existing files of SSL.CONF , MOD_WL_OHS.CONF , HTTPD.CONF
C:\Oracle\Middleware\user_projects\epmsystem1\httpConfig\ohs\config\OHS\ohs_
component
1) Backup SSL.CONF , MOD_WL_OHS.CONF , HTTPD.CONF as below

M. OHS Files Setup

Open Directory
C:\Oracle\Middleware\user_projects\epmsystem1\httpConfig\ohs\config\OHS\ohs_
component

1. SSL.CONF
1) Open the ssl.conf on editor text

Make Sure the OHS Listen Port:

Listen 19443
 2) Make Sure the script is added :

---------------------------------------------------------------------

NameVirtualHost HYP11124:19443

<VirtualHost HYP11124:19443>

<IfModule ossl_module>

---------------------------------------------------------------------

-------------------------------------------------------------------

#Path to the wallet

SSLWallet SSLWallet "

C:\Oracle\Middleware\serverkey\ssl_webserver\wallet.HYP11124"

SSLProxyWallet SSLProxyWallet
"C:\Oracle\Middleware\serverkey\ssl_webserver\wallet.HYP11124"

--------------------------------------------------------------------

File attached
 ssl.conf

2. MOD_WL_OHS.CONF
1) Open the mod_wl_ohs.conf.
2) Make Sure the below is added :

WLSSLWallet C:\Oracle\Middleware\serverkey\ssl_webserver\wallet.HYP11124

SecureProxy ON

------------------------------------------------------------------------
3) Change The Port and also add some WLProxySSL ON and pathTrim /,
as below (Follow the red boxes).
Note: Some locationMatch is not visible here. I have added /analytics in
mod_wl_ohs.conf file above also

File attached :

mod_wl_ohs.conf
 3. HTTPD.CONF
$ vi httpd.conf

Change the Port Listen (Red Box):

Listen 8080
1) Un-Comment (Erase #) the below Line:
 2) Comment (Add #) in below line

File attached :

httpd.conf