# PRE-CHANGE VERIFICATION
\n# There are two environment variables set to allow this to work:
\n#\u00a0WLSTOREPASS=Wh@t3v3rY0uU53d # WLSTOREPASS is set to whatever is used for the keystore and truststore password
\n# OUDINST=\/path\/to\/OUD\/installation (root into which both java and OUD were installed — if you are using an OS package
\n# for java, your paths will be different)
\n# Log into OUD web management GUI (https:\/\/hostname.domain.gTLD:7002\/odsm) and verify for each server:
\n# Configuration=>General Configuration=>Connection Handlers=>LDAPS Connection handler: “Secure access properties” section, Key Manager Provider & Trust Manager Provider are JKS. Certificate name is short hostname
\n# Configuration=>General Configuration=>Kery Managers=>JKS: Path is \/$OUDINST\/Oracle\/Middleware\/<short hostname>.jks<\/p>\n
# During Change, server can be online
\n# Use the web GUI to issue certificates from WIN-WEB-CA. Export each cert as a PFX with keystore password $WLSTOREPASS
\n# On each server, place the approprate PFX file named with the hostname (i.e. the cert for LDAPFrontEndAlias.domain.gTLD will be stored to HOST1 as host1.pfx but stored on HOST2 as host2.pfx) in \/tmp\/ssl
\n# Alternatively, issue one certificate with each hostname and the front end alias as SAN values and use a static filename for the PFX file
\n# Put the root & web CA base-64 public key in \/tmp\/ssl\/ as well (named Win-Root-CA.b64.cer and Win-Web-CA.b64.cer)<\/p>\n
### Import the chain for the private key certificate
\n$OUDINST\/java\/jdk\/bin\/keytool -import -v -trustcacerts -alias WIN-ROOT -file \/tmp\/ssl\/Win-Root-CA.b64.cer -keystore \/tmp\/ssl\/${HOSTNAME%%.*}.jks -keypass $WLSTOREPASS -storepass $WLSTOREPASS
\n$OUDINST\/java\/jdk\/bin\/keytool -import -v -trustcacerts -alias WIN-WEB -file \/tmp\/ssl\/Win-Web-CA.b64.cer -keystore \/tmp\/ssl\/${HOSTNAME%%.*}.jks -keypass $WLSTOREPASS -storepass $WLSTOREPASS<\/p>\n
# get GUID for the private key in the PFX file
\nHOSTCERTALIAS=”$($OUDINST\/java\/jdk\/bin\/keytool -v -list -storetype pkcs12 -keystore \/tmp\/ssl\/${HOSTNAME%%.*}.pfx –storepass $WLSTOREPASS | grep Alias | cut -d: -f2-)”<\/p>\n
# Change the cert alias to be the short hostname
\n$OUDINST\/java\/jdk\/bin\/keytool -importkeystore -srckeystore \/tmp\/ssl\/${HOSTNAME%%.*}.pfx -destkeystore \/tmp\/ssl\/${HOSTNAME%%.*}.jks -srcstoretype pkcs12 -deststoretype JKS -alias $HOSTCERTALIAS -storepass $WLSTOREPASS -srcstorepass $WLSTOREPASS
\n$OUDINST\/java\/jdk\/bin\/keytool -changealias -alias $HOSTCERTALIAS -destalias ${HOSTNAME%%.*} -keypass $WLSTOREPASS -keystore \/tmp\/ssl\/${HOSTNAME%%.*}.jks -storepass $WLSTOREPASS<\/p>\n
# Verify you have a WIN-ROOT, WIN-WEB, and hostname record
\n$OUDINST\/java\/jdk\/bin\/keytool -v -list -keystore \/tmp\/ssl\/${HOSTNAME%%.*}.jks –storepass $WLSTOREPASS | grep Alias<\/p>\n
# STOP THE LDAP SERVER AT THIS POINT
\n# Back up the current Java keystore file and move the new one into place
\nCURRENTDATE=”$(date +%Y%m%d)”
\nmv $OUDINST\/Oracle\/Middleware\/${HOSTNAME%%.*}.jks $OUDINST\/Oracle\/Middleware\/$CURRENTDATE.jks<\/p>\n
cp $OUDINST\/Oracle\/Middleware\/asinst_1\/OUD\/config\/truststore $OUDINST\/Oracle\/Middleware\/asinst_1\/OUD\/config\/truststore-$CURRENTDATE
\n$OUDINST\/java\/jdk\/bin\/keytool -import -v -trustcacerts -alias WIN-ROOT -file \/tmp\/ssl\/Win-Root-CA.b64.cer -keystore $OUDINST\/Oracle\/Middleware\/asinst_1\/OUD\/config\/truststore -keypass $WLSTOREPASS -storepass $WLSTOREPASS
\n$OUDINST\/java\/jdk\/bin\/keytool -import -v -trustcacerts -alias WIN-WEB -file \/tmp\/ssl\/Win-Web-CA.b64.cer -keystore $OUDINST\/Oracle\/Middleware\/asinst_1\/OUD\/config\/truststore -keypass $WLSTOREPASS -storepass $WLSTOREPASS<\/p>\n
mv \/tmp\/ssl\/${HOSTNAME%%.*}.jks $OUDINST\/Oracle\/Middleware\/${HOSTNAME%%.*}.jks<\/p>\n
# START THE LDAP SERVER AND check for errors \/ test<\/p>\n
# Backout:
\n# Stop the LDAP server
\n# mv $OUDINST\/Oracle\/Middleware\/$CURRENTDATE.jks $OUDINST\/Oracle\/Middleware\/${HOSTNAME%%.*}.jks
\n# mv $OUDINST\/Oracle\/Middleware\/${HOSTNAME%%.*}.jks \/tmp\/ssl\/${HOSTNAME%%.*}.jks
\n# Start the LDAP server<\/p>\n","protected":false},"excerpt":{"rendered":"
# PRE-CHANGE VERIFICATION # There are two environment variables set to allow this to work: #\u00a0WLSTOREPASS=Wh@t3v3rY0uU53d # WLSTOREPASS is set to whatever is used for the keystore and truststore password # OUDINST=\/path\/to\/OUD\/installation (root into which both java and OUD were installed — if you are using an OS package # for java, your paths will …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[550,591,236],"class_list":["post-3237","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-oracle-unified-directory","tag-oud","tag-ssl"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/3237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3237"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/3237\/revisions"}],"predecessor-version":[{"id":3239,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/3237\/revisions\/3239"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}