Applying TLS 1.2 Patches and SSL Configuration for Oracle E-Business Suite Release 12.2

Overview

This article provides a comprehensive guide for applying necessary TLS 1.2 patches and configuring SSL/TLS for Oracle E-Business Suite Release 12.2. The process involves installing required patches, creating wallets, configuring cipher suites, and synchronizing between run and patch file systems.

1. Apply Required Updates and Patches

SSL/TLS Patches

Apply the following patches using the ADOP utility:

adop phase=apply patches=27014303,22326911,22522877

ECC Patches

Apply the following ECC-related patches:

adop phase=apply patches=35302518,36539557,35921578,36527716,35921500,35921608,35921575,33377862,35921498,34617743,36279972,35045912,32379321,33282888,33828966,36245474,35059202,35680702,35625136,36167205,35573606,36440950,31054002,35211868,31604775,36214549,35088899,35135853,36032743,36553308,36032764,36032714,36032737,36032663

Stop Application Services

cd $ADMIN_SCRIPTS_HOME
sh adstpall.sh apps/apps

2. Create Wallet and Generate CSR

Set Environment and Path

. /u01/app/FBS/EBSapps.env run
cd /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache
export PATH=$FMW_HOME/webtier/bin:$FMW_HOME/oracle_common/bin:$PATH
alias orapki=$FMW_HOME/oracle_common/bin/orapki

Create Wallet

orapki wallet create -wallet . -auto_login -pwd K0Junga#

Add Self-Signed Certificate

orapki wallet add -wallet . -dn "CN=ebstest.finsys.co.ke, OU=IT, O=Finsys,L=Nairobi,ST=Nairobi,C=KE" -keysize 2048 -sign_alg sha256 -self_signed -validity 3650 -pwd K0Junga#

3. Create Keystore for ECC Managed Server

Generate Key Pair

keytool -genkeypair -alias wlskey -keyalg "RSA" -sigalg SHA256withRSA -keysize 2048 -keystore weblogic.jks -validity 3650 -dname "CN=ebstest.finsys.co.ke, OU=IT, O=Finsys,L=Nairobi,ST=Nairobi,C=KE"

Convert Keystore to PKCS12 Format

keytool -importkeystore -srckeystore weblogic.jks -destkeystore ecc_ca_interim.p12 -srcstoretype jks -deststoretype pkcs12

Export Certificate

openssl pkcs12 -in ecc_ca_interim.p12 -nokeys -clcerts -out ecc_ca_interim.pem

4. Submit Certificate Request to Certificate Authority

Export CSR

cd /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache
orapki wallet export -wallet ./ -dn "$DN" -request server.csr

Submit the generated CSR to your Certificate Authority to obtain digital certificates.

5. Import Server Certificate to Wallet

Rename Certificate Files

cd /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache
mv TrustedRoot.crt ca.crt
mv DigiCertCA.crt intca.crt
mv devdb_nci_com_sa.crt server.crt

Import Root and Intermediate Certificates

orapki wallet add -wallet ./ -trusted_cert -cert ca.crt -auto_login_only
orapki wallet add -wallet ./ -trusted_cert -cert intca.crt -auto_login_only
orapki wallet add -wallet ./ -user_cert -cert server.crt -auto_login_only

6. Modify Oracle HTTP Server Wallet

cd /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web/keystores/default

mkdir bak_sso_14_Apr_2025
mv cwallet.sso cwallet.sso.lck bak_sso_14_Apr_2025/

cp /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache/cwallet.sso* /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web/keystores/default

7. Modify OPMN Wallet

cd /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OPMN/opmn/wallet

mkdir bak_sso_14_Apr_2025
mv cwallet.sso cwallet.sso.lck bak_sso_14_Apr_2025/

cp /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache/cwallet.sso* /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OPMN/opmn/wallet

8. Modify Oracle Fusion Middleware Wallets

cd /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web/proxy-wallet

mkdir bak_sso_14_Apr_2025
mv cwallet.sso cwallet.sso.lck bak_sso_14_Apr_2025/

cp /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache/cwallet.sso* /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web/proxy-wallet

9. Add CA to Internet Certificates

. /u01/app/FBS/EBSapps.env run
echo $ORACLE_HOME/sysman/config
cd /u01/app/FBS/fs1/EBSapps/10.1.2/sysman/config

cp b64InternetCertificate.txt b64InternetCertificate.txt_bk
cd /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache
cat ca.crt >> $ORACLE_HOME/sysman/config/b64InternetCertificate.txt

10. Configure OPMN Cipher Suites

cd /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OPMN/opmn
cp opmn.xml opmn.xml_bk
vi opmn.xml

Update SSL Configuration

Locate the ssl enabled section and change:

FROM:
<ssl enabled="true" wallet-file="/u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OPMN/opmn/wallet" ssl-versions="TLSv1.2" ssl-ciphers="SSL_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_128_GCM_SHA256"/>

TO:
<ssl enabled="true" wallet-file="/u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OPMN/opmn/wallet" ssl-versions="TLSv1.0,TLSv1.1,TLSv1.2" ssl-ciphers="SSL_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_AES_128_CBC_SHA"/>

11. Edit admin.conf File

cd /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web
cp admin.conf admin.conf_bk
vi admin.conf

Update SSL Configuration

Find SSLCipherSuite and modify:

FROM:
SSLCipherSuite HIGH:MEDIUM
SSLProtocol TLSv1.2

TO:
SSLCipherSuite HIGH:MEDIUM
SSLProtocol TLSv1 TLSv1.1 TLSv1.2

12. Edit SSL Configuration File

cd /u01/app/FBS/fs1/FMW_Home/webtier/instances/EBS_web_OHS1/config/OHS/EBS_web
cp ssl.conf ssl.conf_bk
vi ssl.conf

Update SSL Protocol

FROM:
SSLProtocol TLSv1.2

TO:
SSLProtocol TLSv1 TLSv1.1 TLSv1.2

13. Start WebLogic Admin Server

. /u01/app/FBS/EBSapps.env run
cd $ADMIN_SCRIPTS_HOME
sh adadminsrvctl.sh start

14. Configure WebLogic Console

Click on Lock & Edit
Navigate to Domain Structure > your Oracle E-Business Suite domain > Environment and Servers, select one of the managed servers
Under the Server Start tab, in the Arguments section, add:

-DUseSunHttpHandler=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

Repeat for all managed servers in your environment

15. Redeploy NonJ2EEManagement Application

Important Notes:

Patch 20429551 provides the updated orapki utility needed to support SHA2 certificate requests
It is safe to roll back Patch 25072950 in case of a conflict

Steps to Redeploy:

Navigate to WebLogic Server Admin Console:
http://<s_wls_admin_host>.<s_wls_admin_domain>:<s_wls_admin port>/console
From Domain Structure, navigate to Deployments
Locate NonJ2EEManagement (11.1.1)
Stop the application
In Change Center, click Lock & Edit
Select the checkbox beside NonJ2EEManagement (11.1.1)
Delete the application
Click Activate Changes
Navigate to $FMW_HOME and source the SetWebtier.env file
Redeploy using:

$ORACLE_HOME/opmn/bin/opmnctl redeploy -adminHost <ADMINSERVER_HOST> -adminPort <ADMINSERVER_PORT>

Execute Deployment:

cd $FMW_HOME
. SetWebtier.env
$ORACLE_HOME/opmn/bin/opmnctl redeploy -adminHost ebstest.finsys.co.ke -adminPort 7011

Synchronize Context:

perl $AD_TOP/bin/adSyncContext.pl contextfile=$CONTEXT_FILE

Stop WebLogic Services:

sh adadminsrvctl.sh stop

16. Import Certificates into CACERTS Files

JDK 64-bit

cd /u01/app/FBS/fs1/EBSapps/comn/util/jdk64/jre/lib/security
chmod u+w cacerts

Import Certificates

keytool -import -alias OHSRootCA -file ca.crt -trustcacerts -v -keystore cacerts
keytool -import -alias OHSIntCA -file intca.crt -trustcacerts -v -keystore cacerts
keytool -import -alias OHSServer -file /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache/ecc_ca_interim.pem -trustcacerts -v -keystore ./cacerts -storepass changeit
chmod u-w cacerts

JDK 32-bit

cd /u01/app/FBS/fs1/EBSapps/comn/util/jdk32/jre/lib/security/cacerts

chmod u+w cacerts
keytool -import -alias OHSRootCA -file ca.crt -trustcacerts -v -keystore cacerts
keytool -import -alias OHSIntCA -file intca.crt -trustcacerts -v -keystore cacerts
keytool -import -alias OHSServer -file /u01/app/FBS/fs_ne/inst/FBS_ebstest/certs/Apache/ecc_ca_interim.pem -trustcacerts -v -keystore ./cacerts -storepass changeit
chmod u-w cacerts

17. Modify Context File Variables

. /u01/app/FBS/EBSapps.env run
echo $CONTEXT_FILE
cd /u01/app/FBS/fs1/inst/apps/FBS_ebstes/appl/admin
cp DEVDB_devdb.xml DEVDB_devdb.xml_bk
vi DEVDB_devdb.xml

Update Context Variables

s_url_protocol           https
s_local_url_protocol     https
s_webentryurlprotocol    https
s_active_webport         4453
s_webssl_port            4453
s_https_listen_parameter 4453
s_login_page             https://ebstest.finsys.co.ke.sa:4453/OA_HTML/AppsLogin
s_external_url           https://ebstest.finsys.co.ke:4453

18. Run Autoconfig

cd $ADMIN_SCRIPTS_HOME
adautocfg.sh

Modify Connection Filter

vi /u01/app/FBS/fs1/FMW_Home/user_projects/domains/EBS_domain/config/config.xml

Change:

<connection-filter-rule>0.0.0.0/0 * * deny</connection-filter-rule>

To:

<connection-filter-rule>0.0.0.0/0 * * allow</connection-filter-rule>

19. Synchronization Between Run and Patch File Systems

vi $APPL_TOP_NE/ad/custom/adop_sync.drv

Add the following SSL section:

#SSL SECTION - START
# Required for SSL setup migration from RUN to PATCH file-system

#10.1.2 b64InternetCertificate.txt
rsync -zr %s_current_base%/EBSapps/10.1.2/sysman/config/b64InternetCertificate.txt %s_other_base%/EBSapps/10.1.2/sysman/config/b64InternetCertificate.txt

#Oracle HTTP Server Wallet - cwallet.sso
rsync -zr %s_current_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/keystores/default/cwallet.sso %s_other_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/keystores/default/cwallet.sso

#OPMN Wallet - cwallet.sso
rsync -zr %s_current_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OPMN/opmn/wallet/cwallet.sso %s_other_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OPMN/opmn/wallet/cwallet.sso

#Fusion Middleware Control Wallets - cwallet.sso
rsync -zr %s_current_base%/FMW_Home/user_projects/domains/EBS_domain_%s_dbSid%/opmn/%s_ohs_instance%/%s_ohs_component%/wallet/cwallet.sso %s_other_base%/FMW_Home/user_projects/domains/EBS_domain_%s_dbSid%/opmn/%s_ohs_instance%/%s_ohs_component%/wallet/cwallet.sso

rsync -zr %s_current_base%/FMW_Home/user_projects/domains/EBS_domain_%s_dbSid%/opmn/%s_ohs_instance%/wallet/cwallet.sso %s_other_base%/FMW_Home/user_projects/domains/EBS_domain_%s_dbSid%/opmn/%s_ohs_instance%/wallet/cwallet.sso

rsync -zr %s_current_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/proxy-wallet/cwallet.sso %s_other_base%/FMW_Home/webtier/instances/%s_ohs_instance%/config/OHS/%s_ohs_component%/proxy-wallet/cwallet.sso

#JDK keystore
rsync -zr --include=jdk* --include=jdk*/jre --include=jdk*/jre/lib --include=jdk*/jre/lib/security --include=cacerts --exclude=* %s_current_base%/EBSapps/comn/util/ %s_other_base%/EBSapps/comn/util/
#SSL SECTION - END

20. Start Application Services and Run FS_CLONE

Start Application Services

cd $ADMIN_SCRIPTS_HOME
sh adstrtall.sh apps/apps

Run FS_CLONE

adop phase=fs_clone

Reference

Enabling TLS in Oracle E-Business Suite Release 12.2 (Doc ID 1367293.1)

Important Notes

Ensure all paths are correctly set according to your environment
Replace placeholder values (hostnames, passwords, ports) with your actual configuration
Test SSL/TLS configuration in a non-production environment first
Verify all patches are applied successfully before proceeding
The synchronization between run and patch filesystems is crucial for maintaining SSL configuration across patching cycles

Pages

13 Enabling SSL or TLS or ECC in Oracle Apps R12.2

Applying TLS 1.2 Patches and SSL Configuration for Oracle E-Business Suite Release 12.2

Overview

1. Apply Required Updates and Patches

SSL/TLS Patches

ECC Patches

Stop Application Services

2. Create Wallet and Generate CSR

Set Environment and Path

Create Wallet

Add Self-Signed Certificate

3. Create Keystore for ECC Managed Server

Generate Key Pair

Convert Keystore to PKCS12 Format

Export Certificate

4. Submit Certificate Request to Certificate Authority

Export CSR

5. Import Server Certificate to Wallet

Rename Certificate Files

Import Root and Intermediate Certificates

6. Modify Oracle HTTP Server Wallet

7. Modify OPMN Wallet

8. Modify Oracle Fusion Middleware Wallets

9. Add CA to Internet Certificates

10. Configure OPMN Cipher Suites

Update SSL Configuration

11. Edit admin.conf File

Update SSL Configuration

12. Edit SSL Configuration File

Update SSL Protocol

13. Start WebLogic Admin Server

14. Configure WebLogic Console

15. Redeploy NonJ2EEManagement Application

Steps to Redeploy:

Execute Deployment:

Synchronize Context:

Stop WebLogic Services:

16. Import Certificates into CACERTS Files

JDK 64-bit

Import Certificates

JDK 32-bit

17. Modify Context File Variables

Update Context Variables

18. Run Autoconfig

Modify Connection Filter

19. Synchronization Between Run and Patch File Systems

20. Start Application Services and Run FS_CLONE

Start Application Services

Run FS_CLONE

Reference

Important Notes

No comments:

Post a Comment