Create Certificate and Configuring SSL in Oracle Apps 11i

Create Certificate and Configuring SSL in Oracle Apps 11i


OS : Redhat Linux 4.5
Apps : 11i(11.5.10.2)
Webserver : Apache

Set ths following environment varibles
export SCRIPT_TOP=$COMMON_TOP/admin/scripts/sar_sys45
export APACHE_TOP=/oracle/app/apps/sarora/iAS/Apache
export OPENSSL_TOP=/oracle/app/apps/sarora/iAS/Apache/open_ssl
export OPENSSL_CONF=$OPENSSL_TOP/bin

Edit in XML file ===> APPL_TOP/admin
set the %s_url_protocol variable to https
set the %s_local_url_protocol variable to https
set the %s_webentryurlprotocol variable to https
set the %s_frmConnectMode variable to https
set the %s_webssl_port variable to the Apache SSL port required
set the %s_active_webport variable to the same value as that for the %s_webssl_port variable
set the %s_webport variable to the same value as that for the %s_webssl_port variable
set the %s_web_ssl_directory variable to point to the full directory path of the directory that is to contain the .crt and .key files that you are using for Apache
eg <$COMMON_TOP>/admin/certs/apache
set %s_apps_portal_url variable to https

Stop Apps services

Run AutoConfig

mkdir sslcert
chmod 0700 sslcert
cd sslcert
mkdir certs private
echo '100001' >serial
touch certindex.txt


openssl req -x509 -newkey rsa:1024 -keyout private/cakey.pem -out cacert.pem -days 10000 -config openssl.cnf

ls -lrt
-rw-r--r-- 1 applmgr dba 963 Apr 17 20:24 cakey.pem
-rw-r--r-- 1 applmgr dba 1273 Apr 17 20:24 cacert.pem
openssl req -nodes -new -x509 -keyout apache.key -out apache_request.pem -days 3650 -config openssl.cnf
# Note : give common name your url name (for example sys43.doyen.in)
-rw-r--r-- 1 applmgr dba 1273 Apr 17 20:26 apache_request.pem
-rw-r--r-- 1 applmgr dba 891 Apr 17 20:26 apache.key
openssl x509 -x509toreq -in apache_request.pem -signkey apache.key -out apache.csr
-rw-r--r-- 1 applmgr dba 2180 Apr 17 20:26 apache.csr
openssl ca -config openssl.cnf -policy policy_anything -out apache.crt -infiles apache.csr
-rw-r--r-- 1 applmgr dba 920 Apr 18 14:36 apache.crt


cp -f apache.crt /oracle/app/apps/testora/iAS/Apache/Apache/conf/ssl.crt/server.crt
cp -f apache.key /oracle/app/apps/testora/iAS/Apache/Apache/conf/ssl.key/server.key
cp -f cacert.pem /oracle/app/apps/testora/iAS/Apache/Apache/conf/ca.crt

Start apps services

Run root user for appache start for https

sh $COMMON_TOP/admin/scripts/_/adapcctl.sh start

ex : sh /oracle/app/apps/testcomn/admin/scripts/TEST_sys43/adapcctl.sh start

----------------------------------------------------------------------------------------
openssl x509 -subject -in apache.crt
openssl x509 -noout -text -in apache.crt
openssl s_client -connect host.domain:sslport

Refer Metalink Doc
123718.1 ==> 11i: A Guide to Understanding and Implementing SSL for Oracle Applications
300969.1 ==> Troubleshooting SSL with Oracle Applications 11i

Create Certificate and Configuring SSL in Linux

Create Certificate and Configuring SSL in Redhat Linux 4.5

mkdir /sslcert
chmod 0700 sslcert
cd /sslcert
mkdir certs private
echo '100001' >serial
touch certindex.txt
touch openssl.conf
Edit openssl.cnf
Copy the bellow content of "###End openssl"
=====================================================================
#
# OpenSSL configuration file.
#

# Establish working directory.

dir = /sslcert

[ ca ]
default_ca = CA_default

[ CA_default ]
serial = $dir/serial
database = $dir/certindex.txt
new_certs_dir = $dir/certs
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
default_days = 365
default_md = md5
preserve = no
email_in_dn = no
nameopt = default_ca
certopt = default_ca
policy = policy_match

[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[ req ]
default_bits = 1024 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = md5 # message digest algorithm
string_mask = nombstr # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req

[ req_distinguished_name ]
# Variable name Prompt string
#------------------------- ----------------------------------
0.organizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
commonName = Common Name (hostname, IP, or your name)
commonName_max = 64

# Default values for the above, for consistency and less typing.
# Variable name Value
#------------------------ ------------------------------
0.organizationName_default = My Company
localityName_default = My Town
stateOrProvinceName_default = State or Providence
countryName_default = US

[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always

[ v3_req ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash

#
###End openssl
#
=====================================================================

openssl req -x509 -newkey rsa:1024 -keyout private/cakey.pem -out cacert.pem -days 10000 -config openssl.cnf
openssl req -nodes -new -x509 -keyout apache.key -out apache_request.pem -days 3650 -config openssl.cnf
# Note : give common name your url name (for example sys43.doyen.in)
openssl x509 -x509toreq -in apache_request.pem -signkey apache.key -out apache.csr
openssl x509 -req -days 10 -in apache.csr -signkey apache.key -out apache.crt

/etc/httpd/conf

cp -f apache.crt /etc/httpd/conf/ssl.crt/server.crt
cp -f apache.key /etc/httpd/conf/ssl.key/server.key
cp -f cacert.pem /etc/httpd/conf/ca.crt

Restart Your Apache ....
==================================================
Check
openssl x509 -subject -in apache.crt
openssl x509 -noout -text -in apache.crt
openssl s_client -connect host.domain:sslport

Kernel Parameters for RHEL4 update 5 for AS10g

kernel.shmall = 2097152
kernel.shmmax=4294967295
kernel.shmmni = 4096
kernel.sem = 256 32000 100 142
fs.file-max = 206173
kernel.msgmnb=65535
kernel.msgmni=2878
net.ipv4.ip_local_port_range = 10000 65000
net.core.rmem_default=262144
net.core.wmem_default=262144
net.core.rmem_max=262144
net.core.wmem_max=262144

Oracle Database Auto startup on Linux

Edit the "/etc/oratab" file instance to 'Y'.

orcl:/u01/app/oracle/product/9.2.0:Y


Next, create a file called "/etc/init.d/dbora" as the root user, containing the following.



ORA_HOME=/u01/app/oracle/product/9.2.0
ORA_OWNER=oracle
if [ ! -f $ORA_HOME/bin/dbstart ]then
echo "Oracle startup: cannot start"
exit
fi
case "$1" in 'start')
# Start the Oracle databases:
# The following command assumes that the oracle login
# will not prompt the user for any values
su - $ORA_OWNER -c "$ORA_HOME/bin/lsnrctl start"
su - $ORA_OWNER -c $ORA_HOME/bin/dbstart
;; 'stop')
# Stop the Oracle databases:
# The following command assumes that the oracle login
# will not prompt the user for any values
su - $ORA_OWNER -c $ORA_HOME/bin/dbshut
su - $ORA_OWNER -c "$ORA_HOME/bin/lsnrctl stop" ;;
esac

chmod 750 /etc/init.d/dbora

chkconfig --level 345 dbora on

Firewire Hard Disk Configure in Redhat Linux

[root@localhost ~]# uname -r
2.6.9-5.EL

[root@localhost ~]# rpm -q kernel
kernel-2.6.9-5.EL


Download kernel

http://rpm.pbone.net/index.php3?stat=26&dist=0&size=10179509&name=kernel-2.6.9-22.EL.i686.rpm

rpm –Uvh kernel-2.6.9-22.EL.i686.rpm

init 6

uname –r
2.6.9-22.0.1.EL

Download Firewire Modules

http://oss.oracle.com/projects/firewire/dist/files/RedHat/RHEL4/i386/oracle-firewire-modules-2.6.9-22.EL-1286-1.i686.rpm (for single processor)

rpm –ivh oracle-firewire-modules-2.6.9-22.EL-1286-1.i686

Add the following entry in /etc/modprobe.conf file:

options sbp2 exclusive_login=0

modprobe -r sbp2
modprobe -r sd_mod
modprobe -r ohci1394
modprobe ohci1394
modprobe sd_mod
modprobe sbp2
/usr/sbin/kudzu
init 6


[root@linux1 ~]# lspci
00:00.0 Host bridge: Intel Corp.: Unknown device 2770 (rev 02)
00:02.0 VGA compatible controller: Intel Corp.: Unknown device 2772 (rev 02)
00:1b.0 Class 0403: Intel Corp.: Unknown device 27d8 (rev 01)
00:1c.0 PCI bridge: Intel Corp.: Unknown device 27d0 (rev 01)
00:1c.2 PCI bridge: Intel Corp.: Unknown device 27d4 (rev 01)
00:1c.3 PCI bridge: Intel Corp.: Unknown device 27d6 (rev 01)
00:1d.0 USB Controller: Intel Corp.: Unknown device 27c8 (rev 01)
00:1d.1 USB Controller: Intel Corp.: Unknown device 27c9 (rev 01)
00:1d.2 USB Controller: Intel Corp.: Unknown device 27ca (rev 01)
00:1d.3 USB Controller: Intel Corp.: Unknown device 27cb (rev 01)
00:1d.7 USB Controller: Intel Corp.: Unknown device 27cc (rev 01)
00:1e.0 PCI bridge: Intel Corp. 82801 PCI Bridge (rev e1)
00:1f.0 ISA bridge: Intel Corp.: Unknown device 27b8 (rev 01)
00:1f.2 IDE interface: Intel Corp.: Unknown device 27c0 (rev 01)
00:1f.3 SMBus: Intel Corp.: Unknown device 27da (rev 01)
04:00.0 FireWire (IEEE 1394): VIA Technologies, Inc. IEEE 1394 Host Controller (rev 46)
04:01.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
04:08.0 Ethernet controller: Intel Corp.: Unknown device 1094 (rev 01)

[root@linux1 ~]# lsmod egrep "ohci1394sbp2ieee1394sd_modscsi_mod"
sd_mod 17217 5
sbp2 23948 4
ohci1394 35784 0
ieee1394 298228 2 sbp2,ohci1394
scsi_mod 121293 4 usb_storage,sd_mod,sbp2,libata

[root@linux1 ~]# cat /proc/scsi/scsi
Attached devices:
Host: scsi1 Channel: 00 Id: 00 Lun: 00
Vendor: Seagate Model: FreeAgentPro FW4 Rev: 120R
Type: Direct-Access ANSI SCSI revision: 06

[root@linux1 ~]# fdisk -l

Disk /dev/hdc: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdc1 * 1 261 2096451 83 Linux
/dev/hdc2 262 6635 51199155 83 Linux
/dev/hdc3 6636 7081 3582495 82 Linux swap
/dev/hdc4 7082 19457 99410220 5 Extended
/dev/hdc5 7082 7212 1052226 83 Linux
/dev/hdc6 7213 19457 98357931 83 Linux

Disk /dev/sda: 320.0 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System

Installing Oracle on Redhat AS 4 Part -I

Installing Oracle on Redhat AS Part -I

Test
----
Hostname - sys1
IP - 192.168.1.10



1. Check host file

/etc/hosts
-add following entry
192.168.1.10 sys1.dbserver.com sys1

2. Add the following lines to the /etc/sysctl.conf

kernel.shmall = 2097152
kernel.shmmax = 2147483648
kernel.shmmni = 4096
# semaphores: semmsl, semmns, semopm, semmni
kernel.sem = 250 32000 100 128
fs.file-max = 65536
net.ipv4.ip_local_port_range = 1024 65000
net.core.rmem_default=4194304
net.core.rmem_max=4194304
net.core.wmem_default=262144
net.core.wmem_max=262144

3. Add the following lines to the /etc/limits.conf

* soft nproc 2047
* hard nproc 16384
* soft nofile 1024
* hard nofile 65536

4. Create a OS Oracle Group

/usr/bin/groupadd oinstall
/usr/bin/groupadd dba

5. Create a OS Oracle User

Useradd –g oinstall –G dba oracle
Passwd oracle

6. Check OS Oracle User

id oracle

7. Check Disk Space

df –h

8. Set oracle Environment

/home/oracle/db1.env
Add the following entry
export ORACLE_BASE=/oracle/app/oracle
export ORACLE_SID=orcl

9. Display setting

export DISPLAY=SYS1:0.0
xhost +

10. Create Oracle folder

mkdir –p /oracle/app/oracle


11. Change Permission

chown oracle:oinstall /oracle/app/oracle
chmod 775 /oracle/app/oracle

12. Installing Oracle 10g

cd /media/[cd drive]/Disk1/

./runInstaller