How to setup SSL certificate for apache

 Step:1 Generate key for Apache in linux.

[root@hostname test]# openssl genrsa -out postrga.key 2048

Generating RSA private key, 2048 bit long modulus

.............................+++

..............................................................+++

e is 65537 (0x10001)

[root@hostname test]# ls

postrga.key

Step:2 Generate csr from postrga key.

[root@hostname test]# openssl req -new -key postrga.key -out postrga.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:QA

State or Province Name (full name) []:DOHA

Locality Name (eg, city) [Default City]:Doha

Organization Name (eg, company) [Default Company Ltd]:B bank

Organizational Unit Name (eg, section) []:IT

Common Name (eg, your name or your server's hostname) []:hostname

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:welcome123

An optional company name []:NA

[root@hostname test]# ls -lrt

total 8

-rw-r-----. 1 root root 1679 Oct  5 09:22 postrga.key

-rw-r-----. 1 root root 1058 Oct  5 09:25 postrga.csr

Step:3 Validate key.

[root@hostname test]# openssl rsa -in postrga.key -check

RSA key ok

writing RSA key

-----BEGIN RSA PRIVATE KEY-----

MIIEpAIBAAKCAQEAzIXG3I02jOPsGdlqMj1h2U3/vCZoXfEdPY/0uZpM5FHjuo38

0UggfO88ZtMECgsPwEy2mmJ9w55S+/aJoojwdDyZgT2VOPIwRsheTh0zD9s374Y8

ZSTbmCSVIPeunw6N5iUW7qYH99VgLPo87hwbJauetDRxDF9A1OT0lTCxI/dO3dHb

/mYGdc1tbmpifENrgYZJmHKRHiKWVNDrzI9FyyjIUF2ziCFXQf0c+ZaIT0zj7L5H

Uv0rvJkFKfc6QQdbfryOtqhTVIpE81TQ9ygw3M0pARReo4pj4VyYWvw5/orCpmQ0

kE5w2j2aAkLbieWpMut4MwtEo0MzaePiDsZ7qwIDAQABAoIBABdEoPs2lZ4x0Aqg

0ZQlp5wxY4bkV7tYUxtN5Wm4REc1idMPlFO7APc1wIlyOGNsHr6h+6RU0DoRKR/B

TKdRLQoMWup5NyDjbNqgsRnx+H01U4fMndJj/xewEcdOZm9yGHK2hYVhHkbz350+

WvA8Alqmy8d0r+fYbmfKJIlUoNKWfC7lVTndg6WWCVqhJ/Dtgd8zHf9c1eH2XcOM

NNTTlLhpOc/TKyCeQChpbUeqLm71eJuMOzKHo71ZhuSUBWmQvnTZ3XgvRpJ/2nt9

ut5TTzz0XBS/x/UMoTOVBeCuAp3IiXfTWHQZ2tEeKHVOb/HIGf5To7XHydyT++PI

kgoLmgECgYEA6a2yQErTjLn//jkXpilC0EuDJPp1o92fstLPDokRqJJKLrf06Q5A

Adp5oEImjfqIxu0JiB6q5duHL0NxYF5Zi0XCdjYL4+NZq2GQMwz02VX61A9jQ6dj

oe2Y/GQp6HNFPJRsEH7PHDrJ7r7pIiazS2yCYsDaNWY/d3KbdibvrfMCgYEA4A8c

K6kKUhLRUPiIe/pecziWd3wa9hU9reFAwKlh0YxxM6dYe8nDpEhrq1/VZj2PHYNi

qUXNqbDR9u1KLXhxG9d0hcD/XLP9nQZ/up3nEKaPjKpq5qFZohUPpRt+tAXxxch3

CFhI+0Aa5NOYK6VkgLaPeAG6aS7OJ+wkg3ApEWkCgYEAq/nRfc+T8bXR2N9bsEYd

jf6E/en2OisZJRpQmHn4LP+86LUp4XtDUBnh+Te1+DeyAfThVvR7Ab+WtgoEns/R

RtaIT0dnaMghbifXYDrg2DKW7wqEG35NrRaXyOhOj2yGQBdbkKhC9Juvka2fFis1

OQUa0GLuNO6TNu15zHLLYlECgYEA0/r3uAbyELxk9Kpu1n0FpxU+pkTwbSmjdULL

tHuMZGjvIOOOv28gfelWlIjSqSxMnquTSHsWHRmBTJErwOFWgfTR9UmnT9mqdEmV

xsVlu0caQQdqpFC7MLGkX50nvsJw/6Ktm2OLiMoZp6zZJ1IPSAdwrSVVa/YwbWzp

DsGq2SECgYA3Q6U0ZQAyUZyYUVXXr1a6O1rtdLcZFQ2GhHTOEMnS10LsHULH20Oz

6iUsqs7Pq/cp24QJPix/9TJUGILJUDRKF9MLIHEwa8QgI1nZPCHUGfbvd6GM3bPi

Ox1ESgJahisOE+6uE2Y6kHbr3C7X/UF8sSZ3SGYy/VRybDT5DiQjCw==

-----END RSA PRIVATE KEY-----

Step: 4 Validate generate CSR.

[root@hostname test]# openssl req -text -noout -verify -in postrga.csr

verify OK

Certificate Request:

    Data:

        Version: 0 (0x0)

        Subject: C=QA, ST=DOHA, L=Doha, O=B bank, OU=IT, CN=hostname

        Subject Public Key Info:

            Public Key Algorithm: rsaEncryption

                Public-Key: (2048 bit)

                Modulus:

                    00:cc:85:c6:dc:8d:36:8c:e3:ec:19:d9:6a:32:3d:

                    61:d9:4d:ff:bc:26:68:5d:f1:1d:3d:8f:f4:b9:9a:

                    4c:e4:51:e3:ba:8d:fc:d1:48:20:7c:ef:3c:66:d3:

                    04:0a:0b:0f:c0:4c:b6:9a:62:7d:c3:9e:52:fb:f6:

                    89:a2:88:f0:74:3c:99:81:3d:95:38:f2:30:46:c8:

                    5e:4e:1d:33:0f:db:37:ef:86:3c:65:24:db:98:24:

                    95:20:f7:ae:9f:0e:8d:e6:25:16:ee:a6:07:f7:d5:

                    60:2c:fa:3c:ee:1c:1b:25:ab:9e:b4:34:71:0c:5f:

                    40:d4:e4:f4:95:30:b1:23:f7:4e:dd:d1:db:fe:66:

                    06:75:cd:6d:6e:6a:62:7c:43:6b:81:86:49:98:72:

                    91:1e:22:96:54:d0:eb:cc:8f:45:cb:28:c8:50:5d:

                    b3:88:21:57:41:fd:1c:f9:96:88:4f:4c:e3:ec:be:

                    47:52:fd:2b:bc:99:05:29:f7:3a:41:07:5b:7e:bc:

                    8e:b6:a8:53:54:8a:44:f3:54:d0:f7:28:30:dc:cd:

                    29:01:14:5e:a3:8a:63:e1:5c:98:5a:fc:39:fe:8a:

                    c2:a6:64:34:90:4e:70:da:3d:9a:02:42:db:89:e5:

                    a9:32:eb:78:33:0b:44:a3:43:33:69:e3:e2:0e:c6:

                    7b:ab

                Exponent: 65537 (0x10001)

        Attributes:

            unstructuredName         :NA

            challengePassword        :welcome123

    Signature Algorithm: sha256WithRSAEncryption

         0a:65:b6:45:ee:16:2d:f7:c4:8a:9c:22:56:a8:f9:dd:01:34:

         dc:dd:25:ba:91:7d:21:b1:d9:40:02:a7:9d:53:17:30:c6:06:

         36:0e:6f:ea:ab:04:47:69:ac:9e:a3:4f:0a:38:59:75:2f:95:

         62:a1:b2:eb:85:73:94:c2:55:c8:47:ea:c8:97:a7:a0:28:69:

         ff:e3:7e:e8:36:0b:01:f4:b7:46:97:76:b1:2a:14:8e:46:16:

         66:2b:f1:2e:53:a2:5a:11:c5:3c:25:03:dc:aa:fd:d3:a7:96:

         b8:97:b9:6d:36:ff:ef:72:83:58:24:e4:05:97:8c:fa:87:22:

         12:ca:e1:c6:f4:7d:40:dc:c3:1b:59:0e:60:7f:cd:87:af:4b:

         38:59:a6:50:5b:7d:bf:d6:65:97:d3:e2:30:6c:ab:d8:ee:cf:

         b8:c2:ca:9a:8d:2f:68:fa:05:92:17:6d:8e:67:7b:c3:d0:8b:

         57:f9:7f:c6:44:5d:12:4a:27:a2:c7:4f:b0:2e:43:df:f1:d4:

         c9:94:87:e9:5e:21:82:ed:d7:56:1d:5d:bb:70:81:72:f8:b6:

         f5:ad:8b:d1:2d:f5:38:68:33:b6:2e:0c:2c:33:f1:80:44:46:

         0c:8b:f0:5b:52:91:53:81:9d:74:f5:5c:7d:d6:14:af:3c:18:

         8d:55:18:a9

[root@hostname test]# ls

postrga.csr  postrga.key

Step: 5 Send csr file to Digicert authority to get the cert file.

Step: 6 Copy all the files in below path which is given by Digicert authority.

[root@hostname test]# ls /root/test/

postrga.csr  postrga.key

Step:6 Now you can configure this path /root/test/ in ssl.

NodeManager is not coming up after SSL Setup

ERROR:

 After SSL implementation NodeManager is not startup.

java.lang.RuntimeException: Cannot convert identity certificate

  at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(Unknown Source)

  at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source)

  at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source)

  at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContextWrapper.java:144)

  at weblogic.nodemanager.server.SSLListener.init(SSLListener.java:53)

  at weblogic.nodemanager.server.NMServer.start(NMServer.java:206)

  at weblogic.nodemanager.server.NMServer.main(NMServer.java:377)

  at weblogic.NodeManager.main(NodeManager.java:31)

 weblogic.nodemanager.server.NMServer main

SEVERE: Fatal error in node manager server

java.lang.RuntimeException: Cannot convert identity certificate

  at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(Unknown Source)

  at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source)

  at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source)

  at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContextWrapper.java:144)

  at weblogic.nodemanager.server.SSLListener.init(SSLListener.java:53)

  at weblogic.nodemanager.server.NMServer.start(NMServer.java:206)

  at weblogic.nodemanager.server.NMServer.main(NMServer.java:377)

  at weblogic.NodeManager.main(NodeManager.java:31)

+ set +x

SOLUTIONS:

Configure Custom keystore in nodemanager.properties and enable JSSE for nodemanager.

1. Navigate to WL_HOME\server\bin

2. Take back-up of nodemanager.properties

3. Append below lines in nodemanager.properites.

----------------------------------------

KeyStores=CustomIdentityAndCustomTrust

CustomIdentityKeyStoreFileName=Identity_Keystore EX:/ofm/Oracle/Middleware/keystores/keystore.jks

CustomIdentityKeyStorePassPhrase=Identity_Keystore_Password

CustomIdentityAlias=Identity_Keystore_Alias EX: server_cert

CustomIdentityPrivateKeyPassPhrase=Private_Key_Used_When_Creating_Certificate EX: /ofm/Oracle/Middleware/keystores/keystore.jks

-------------------------------------------

4. Take back-up of startNodeManager.sh and edit the startNodeManager.sh with below JAVA_OPTIONS to enable JSSE.

-----------------------------

JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.security.SSL.enableJSSE=true"

export JAVA_OPTIONS

----------------------------------

5. Restart the Nodemanager and Admin server.

6. Once the nodemanager become Reachable in Admin console, start the Forms and Reports server.

SSL (HTTPS) Implementation in WebLogic and Managed servers.

 All the commands below reference $MIDDLEWARE_HOME for FMW 11g. If using FMW 12c, replace $MIDDLEWARE_HOME with $ORACLE_HOME.

1. Create a directory, for example: $MIDDLEWARE_HOME/keystores

cd /oracle/ofm/Oracle/Middleware ---> (MW_HOME)

$mkdir keystores

2. Run the following to set the environment on UNIX:

ofm11g@host:/ofm/Oracle/Middleware$ cd /ofm/Oracle/Middleware/user_projects/domains/PWCUAT/bin

$./setDomainEnv.sh

3. Create a keystore and private key, by executing the following command:

Syntax: CN=host.DOMAIN.com (Common Name), OU=organization  (Organization Unit), O=Organization (Organization), L=organization  Street (Locality Unit), ST=Doha, (State Province) C=QA (Country)"

ofm11g@host:/ofm/Oracle/Middleware/keystores$ keytool -genkey -alias server_cert -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -dname "CN=host.DOMAIN.com, OU=organization , O=Organization, L=organization  Street, ST=Doha, C=QA" -keypass password -keystore keystore.jks -storepass password

ofm11g@host:/ofm/Oracle/Middleware/keystores$ ls

keystore.jks

4. At this point take a backup of the keystore e.g: keystore.jks

ofm11g@host:/ofm/Oracle/Middleware/keystores$ cp -pr keystore.jks keystore.jks-org

5. To view the contents of the keystore created, execute the following command:

ofm11g@host:/ofm/Oracle/Middleware/keystores$ keytool -list -v -keystore keystore.jks -storepass password

6. Create a Certificate Signing Request (CSR) using the following command:

keytool -certreq -v -alias server_cert -file hpsuaterver.csr -sigalg SHA256withRSA -keypass password -storepass password -keystore keystore.jks

ofm11g@host:/ofm/Oracle/Middleware/keystores$ keytool -certreq -v -alias server_cert -file hpsuaterver.csr -sigalg SHA256withRSA -keypass password -storepass password -keystore keystore.jks

Certification request stored in file <hpsuaterver.csr>

Submit this to your CA

ofm11g@host:/ofm/Oracle/Middleware/keystores$ ls

hpsuaterver.csr   keystore.jks      keystore.jks-org

Make sure you use the same -alias, -storepass and -keypass passwords from Step 3.

The CSR (server.csr) created looks like this:

-----BEGIN NEW CERTIFICATE REQUEST-----

MIIxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-----END NEW CERTIFICATE REQUEST-----

7. Send this CSR to a Certificate Authority (CA) of your choice. They will provide two certificate server certificate and root certificate.

8. Once you have received the Certificate back you will need to import this along with the Trusted Root CA certificate(s) that signed it, into your keystore.

Take the server certificate and save it a file called server.cer. Take the Certificate Authority's root certificate and save to a file called rootCA.cer in your keystore directory e.g $MIDDLEWARE_HOME/keystores. Repeat this step for any more Root CA certificates in the chain e.g rootCA2.cer etc..

ofm11g@host:/ofm/Oracle/Middleware/keystores$ mv certnew.cer server.cer

ofm11g@host:/ofm/Oracle/Middleware/keystores$ mv UATroot.cer rootCA.cer

ofm11g@host:/ofm/Oracle/Middleware/keystores$ ls -lrt

total 26

-rw-r--r--   1 ofm11g   hps         2240 Jul 26 14:28 keystore.jks-org

-rw-r--r--   1 ofm11g   hps         2240 Jul 26 14:28 keystore.jks

-rw-r--r--   1 ofm11g   hps         1035 Jul 26 14:39 hpsuaterver.csr

-rw-r--r--   1 ofm11g   hps         2090 Jul 27 13:40 server.cer

-rw-r--r--   1 ofm11g   hps         1328 Jul 27 13:40 rootCA.cer

ofm11g@host:/ofm/Oracle/Middleware/keystores$

9. Import the CA's root certificate into your keystore using the following command:

Syntax: keytool -import -v -noprompt -trustcacerts -alias <alias> -file <rootca_file> -keystore <keystore> -storepass <password>

ofm11g@host:/ofm/Oracle/Middleware/keystores$ keytool -import -v -noprompt -trustcacerts -alias rootcacert -file rootCA.cer -keystore keystore.jks -storepass password

Certificate was added to keystore

[Storing keystore.jks]

If there are other intermediate trust certificates, repeat this for each trust certificate using a different alias each time.

10. Import the Server Certificate into your keystore using the following command:

Syntax: keytool -import -v -noprompt -trustcacerts -alias <alias> -file <rootca_file> -keystore <keystore> -storepass <password>

ofm11g@host:/ofm/Oracle/Middleware/keystores$ keytool -import -v -alias server_cert -file server.cer -keystore keystore.jks -keypass password -storepass password

Certificate reply was installed in keystore

[Storing keystore.jks]

Make sure you use the same -alias from Step 3.

11. To view the contents of the keystore, execute the following command:

Syntax: keytool -list -v -keystore keystore.jks -storepass <PASSWORD>

ofm11g@host:/ofm/Oracle/Middleware/keystores$ keytool -list -v -keystore keystore.jks -storepass password

12. At this point the keystore is now ready for use. To use this Keystore with WLS please refer back to the Master Note for your version:

Configuring Oracle WebLogic Server (10.3.x - 12.1.x) to Use SSL in Fusion Middleware 11g/12c (Doc ID 1235653.1)

Step II: Configure WebLogic Server for SSL

The steps below take you through configuring SSL for a Managed Server.

The steps assumes the reader understands how to start the Admin Server and Managed Server.

1. Start the Admin Server in the Domain

2. Login to the WLS console e.g: http://10.0.00.11:7001/console

3. Select 'Environment' -> 'Servers' and click on the server you want to configure

4. Select the 'Keystores' tab

5. Select 'Keystore -> 'Change'

6.Select 'Custom Identity and Custome Trust'from the drop down list and click 'Save'

7. Enter the relevant information in the Keystores page:

'Custom Identity Keystore' : /ofm/Oracle/Middleware/keystores/keystore.jks

'Custom Identity Keystore' : JKS

'Custom Identity Keystore Passphrase' : password

'Confirm Custom Identity Keystore Passphrase' : password

'Custom Trust Keystore' : /ofm/Oracle/Middleware/keystores/keystore.jks

'Custom Trust Keystore Type' : JKS 

'Custom Trust Keystore Passphrase' : password

'Confirm Custom Trust Keystore Passphrase' : password

Click 'Save'

13. Select the 'SSL' tab and enter the relevant information:

'Private Key Alias' : server_cert

'Private Key Password' : password

'Confirm Private Key Password': password

Click 'Save'

14. Select 'Environment' -> 'Servers' and click on the Managed Server configured

 In the 'General' tab:

Check 'SSL Listen Port Enabled'

'SSL Listen Port' : <port> e.g 7012 (make sure this is not used by another process)

Click Save

And Click on adnvace and check the Use JSSE SSL and save the changes.

15. Implement the SSL for managed servers. Follow the steps from 12 to 15 for remaining servers.

16 . Click on Environment->Servers-> AdminServer or Managed Server-> Click on SSL -> Click on Advance --> HostnameVerification "Node" --> Click on save -> Activate the changes.

17. Add SSL parameter in nodemanager.

# Added following parameters in nodemanager.properties

KeyStores=CustomIdentityAndCustomTrust

CustomIdentityKeyStoreFileName=/ofm/Oracle/Middleware/keystores/keystore.jks

CustomIdentityKeyStorePassPhrase=password

CustomIdentityAlias=server_cert

CustomIdentityPrivateKeyPassPhrase=password

# added this parameter in startNodeManager.sh

JAVA_OPTIONS="-Dweblogic.security.SSL.enableJSSE=true ${JAVA_OPTIONS}"

export JAVA_OPTIONS

# Validate your certificate.

cd $DOMAIN_HOME/bin

-bash-3.2$ . ./setDomainEnv.sh

-bash-3.2$ java  utils.ValidateCertChain -jks server_cert /ofm/Oracle/Middleware/keystores/keystore.jks

Cert[0]: CN=host.DOMAIN.com,OU=organization ,O=Organization,L=organization  Street,ST=Doha,C=QA

Cert[1]: CN=Organization-BBSFADS001-CA,dc=Organization,dc=local

Certificate chain appears valid

17. Ask your network/security team to allow new SSL ports (7012/9011/9012) between your machine and server.

18. Restart all the weblogic server services.

19. Test the below new SSL URL should be open.

https://10.0.00.11:7012/console

20. Disable http port and restart the services.

1. In WebLogic Administration Console:

2. Click Lock and Edit.

3. Select Environment, Clusters, and select cluster_forms.

4. Select Configuration, and the Replication tab.

5. Select secure replication enabled.

6. Click Save.

7. Click Activate Changes.

Please do the above steps for cluster_reports also.

Note: Please take config.xml back-up before doing any changes in weblogic console.

++++++++++++++Start the Application  services. +++++++++++++====

echo "Starting up the AdminServer ..."

nohup $DOMAIN_HOME/bin/startWebLogic.sh  &

sleep 60

echo "Starting Node Manager ..."

nohup $WL_HOME/server/bin/startNodeManager.sh &

sleep 5

echo "Starting Forms Server 11G................."

nohup $DOMAIN_HOME/bin/startManagedWebLogic.sh WLS_FORMS https://10.0.00.12:7012 &

sleep 60

echo "Starting Reports Server 11G................."

nohup sh $DOMAIN_HOME/bin/startManagedWebLogic.sh WLS_REPORTS https://10.0.00.12:7012 &

sleep 90

echo "Starting OPMN ALL ............................"

opmnctl startall

=====================

Oracle Reference Documents:

=====================

Configuring Oracle WebLogic Server (10.3.x - 12.1.x) to Use SSL in Fusion Middleware 11g/12c (Doc ID 1235653.1)

How To Create a Java Keystore via Keytool in FMW 11g/12c (Doc ID 1230333.1)

After SSL Implementation in WebLogic Not listening for SSL, java.io.IOException: Cannot convert identity certificate

 ERROR:

<Jul 28, 2020 10:06:39 AM GMT+03:00> <Notice> <Security> <BEA-090171> <Loading the identity certificate and private key stored under the alias server_cert from the JKS keystore file /ofm/Oracle/Middleware/keystores/keystore.jks.>

<Jul 28, 2020 10:06:39 AM GMT+03:00> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate>

<Jul 28, 2020 10:06:39 AM GMT+03:00> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Cannot convert identity certificate.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Cannot convert identity certificate.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Cannot convert identity certificate.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Cannot convert identity certificate.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Cannot convert identity certificate.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Emergency> <Security> <BEA-090034> <Not listening for SSL, java.io.IOException: Cannot convert identity certificate.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <Server> <BEA-002613> <Channel "Default[3]" is now listening on 172.30.0.130:7001 for protocols iiop, t3, ldap, snmp, http.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <Server> <BEA-002613> <Channel "Default[1]" is now listening on 10.0.11.146:7001 for protocols iiop, t3, ldap, snmp, http.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <Server> <BEA-002613> <Channel "Default[2]" is now listening on 172.30.0.66:7001 for protocols iiop, t3, ldap, snmp, http.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <Server> <BEA-002613> <Channel "Default" is now listening on 10.0.11.144:7001 for protocols iiop, t3, ldap, snmp, http.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <Server> <BEA-002613> <Channel "Default[5]" is now listening on 127.0.0.1:7001 for protocols iiop, t3, ldap, snmp, http.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <Server> <BEA-002613> <Channel "Default[4]" is now listening on 172.30.2.2:7001 for protocols iiop, t3, ldap, snmp, http.>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <WebLogicServer> <BEA-000329> <Started WebLogic Admin Server "AdminServer" for domain "PWCUAT" running in Production Mode>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RUNNING>

<Jul 28, 2020 10:06:40 AM GMT+03:00> <Notice> <WebLogicServer> <BEA-000360> <Server started in RUNNING mode>

https port is not coming up after SSL implementation in WebLogic.

SOLUTIONS:

1. Navigate to [managed server or Admin server ] > Configuration > SSL > Advanced.

2. Check "Use JSSE SSL".

3. Save and Activate changes.

No replication server channel for WLS_FORMS java.lang.AssertionError: No replication server channel for WLS_FORMS

 ERROR:

<Aug 23, 2020 11:56:43 AM GMT+03:00> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: java.lang.AssertionError: No replication server channel for WLS_FORMS

java.lang.AssertionError: No replication server channel for WLS_FORMS

at weblogic.cluster.replication.ReplicationManagerServerRef.initialize(ReplicationManagerServerRef.java:128)

at weblogic.cluster.replication.ReplicationManagerServerRef.<clinit>(ReplicationManagerServerRef.java:84)

at java.lang.Class.forName0(Native Method)

at java.lang.Class.forName(Class.java:170)

at weblogic.rmi.internal.BasicRuntimeDescriptor.getServerReferenceClass(BasicRuntimeDescriptor.java:469)

Truncated. see log file for complete stacktrace

SOLUTIONS:

1. In WebLogic Administration Console:

2. Click Lock and Edit.

3. Select Environment, Clusters, and select cluster_forms.

4. Select Configuration, and the Replication tab.

5. Select secure replication enabled.

6. Click Save.

7. Click Activate Changes.

Please do the above steps for cluster_reports also.

Note: Please take config.xml back-up before doing any changes in weblogic console.