Configure SSL for OUD 4444 port Admin port-> replace the self signed certificates used

Hi Experts,

When installing OUD choose Certification self-signed for ports 1636 and 4444.

Later I change the certificates used by the port of 1636 to a new key file containing the CA certificates. (Track the steps of: https://docs.oracle.com/cd/E52734_01/oud/OUDAG/security_clients_severs.htm#OUDAG00050)

But same procedure does not have to replace the self signed certificates used by ports 4444!  Everyone is configured SSL (with Cert CA) on the Administration port?

I couldn't even start the servers, you see an error:

"""

category = gravity CORE = NOTICE msgID = 458891 msg = the directory server sent a notification to alert generated by the class org.opends.server.core.DirectoryServer (org.opends.server.DirectoryServerShutdown alert type, alert ID 458893): the directory server started the shutdown process.  Stop was launched by an instance of the org.opends.server.core.DirectoryServer class and the reason for the closure was an error occurred trying to start the directory server: NullPointerException (File.java:277 AdministrationConnector.java:843 AdministrationConnector.java:675 AdministrationConnector.java:182 ConnectionHandlerConfigManager.java:356 DirectoryServer.java:2932 DirectoryServer.java:1584 DirectoryServer.java:10108)

«[27/sep / 2015:06:22:53-0400] category = gravity = NOTICE msgID = 458955 msg = the directory server CORE is now stopped "«»

Post edited by: 1976902

Sorry, I cannot help here - here are a few possibilities.

Change connector Administration certificate

https://docs.Oracle.com/CD/E52668_01/E54669/HTML/ol7-genssc-auth.html

The failure of the handshake could occur for various reasons:

  • Incompatible encryption suites in use by the client and the server. This would require the customer to use (or allow) a suite of encryption supported by the server.
  • Incompatible versions of SSL in use (the server can only accept TLS v1, while the client is capable of using SSL v3 only).
  • Incomplete trust for the certificate of the server path
  • The certificate is issued to another area.
  • incomplete certificate trust path between the certificate for the server, and a certification authority root.
  • In most cases, this is because the certificate is not present in the trust store

Tags: Fusion Middleware

Similar Questions

  • Configuring SSL for the server SOA

    Hi all

    I am wrkin on SOA suite 11 g. I'm tryin to implement transport-level security. All first authentication 1-way and 2-way mutual authentication. For this I have to activate the SSL for the SOA server that is managed by the administration WLS server. According to my knowledge the WLS comes with demoidentity and demotrust keystore. If I need configure SSL for server SOA do I need to create a new keystore and CA, s, or I can use keystore demo.

    Now, in case I need to create a new keystore that can I do the same thing using keytool utility. Also, is it possible to do this using keytool utility? If Yes, please provide me with some links on how to do the same.

    Thanks in advance.

    Hi Shlomit,

    If I need configure SSL for server SOA do I need to create a new keystore and CA, s, or I can use keystore demo.

    You can use the keystore Demo dev purposes, but it is NOT recommended to use demo keystore for use in production.

    in case I need to create a new keystore that can I do the same thing using keytool utility

    Yes, you can do this using the Keytool utility.

    is it possible to do this using keytool utility?

    In fact, you can generate a self-signed certificate and use it as a certification for CSR signing authority.

    Please provide me with some links on how to do the same thing

    You should get everything here-

    http://download.Oracle.com/docs/CD/E14571_01/Web.1111/e13707/SSL.htm#i1200848

    Kind regards
    Anuj

  • When I try to scan with my CanoScan N640P ex scanner I receive a message indicating the Port to the printer that is used by another device. How can I work around this problem?

    When I try to scan with my CanoScan N640P ex scanner I receive a message indicating the Port to the printer that is used by another device.  How can I work around this problem?

    Hi ejp70,

    1. did you of recent changes on the computer?

    2. to when was the last time the scanner was working fine?

    3. you have any other printer\scanner connected to the computer?

    If you have any other printer\scanner connected to the computer, disconnect them and check if it works.

    I suggest that you uninstall and reinstall the scanner to the computer, also make sure that you install the latest drivers for scanner on Canon website.

  • Can I generate self-signed certificates free for Nexus 9 K?

    Hi, I have 22 9Ks Nexus that I just upgraded to 3,0000 I4 so I can use the REST API.

    I use vRealize Orchestrator for automation, and I can't access the REST API on the Orchestrator help link, as certificates are at expiration.

    I can't find much information on this subject for the 9 K, unless the 9Ks are mode of the AIT, in this case I think that TACS are the only people who can generate a certificate.

    Does anyone know otherwise work around this? Otherwise, I'll have to approach a TAC case for 22 certificates generated :-/

    Cheers, Dom

    I'm not familiar with the technology with what you're trying to integrate, but here's a guide on how generate a custom SSC (self-signed Cert) on a device:
    #conf t
    #hostname DEVICE01-NOTE: must not be changed
    #ip - domain test.local

    generate a General key label SSC_KEY module 2048 rsa key #crypto

    #crypto pki trustpoint SSC_LOCAL
    #subject - name, CN = DEVICE, DC = test, DC = local
    #enrollment selfsigned
    # crl revocation checking
    #rsakeypair SSC_KEY 2048

    #crypto ca enroll COMMAND SSC_LOCAL HIDDEN: initiate the creation of SSC

    % Include the serial number of the router in the name of the topic? [Yes/No]: no
    % Include an IP address in the name of the topic? [None]:
    % Generate self signed certificate router? [Yes/No]: Yes

    Router self-signed certificate created successfully

    After this make sure that you do NOT change the host name of the device :)

  • Is it possible to configure iOS (iPad) to allow a gesture "tap" replace the "swipe" gesture  We have a disabled person who can "type", but cannot "drag."

    IOS (iPad) can be configured so that a "tap" gesture can replace the gesture of "swipe"?

    We have a disabled person who can make the move "tap" but can't make a gesture of 'swipe' successfully.

    We know there are lots of things blow that imagine us that a tap on the right side of the screen would replace the kick from the right to the left, and so on for the other sliding directions.

    It should be possible to use AssistiveTouch for this. I have not explored fully, but it seems that you can create a menu of actions that you may need, and use the AssistiveTouch menu button to control what gesture is used for the next take. Creating click options, by scanning left and forehand would suit your username.

    See using AssistiveTouch on your iPhone, iPad or iPod touch - Apple Support for more details.

    TT2

  • Safari no longer works with SSL self-signed certificates?

    With the last Safari (9.0.3) on OS X (running 10.11.3) and iOS (9.2.1) operating system, I can no longer connect to sites that use self-signed SSL certificates. Previously, I was warned that the site certificate was not "valid", but given the opportunity to continue anyway. This is the behavior I want to come back. It still works fine in Chrome, Firefox. but now just Safari gives me an error "Safari can't open the Page" as it would if it could not reach the server. Specifically, it says "Safari can't open the page https://myselfsignedhost.com because Safari is unable to establish a connection to the server myselfsignedhost.com.

    It does not give me the opportunity to inspect the certificate, add the certificate to my keychain, trust the cert, ignore the warning once or anything else that would be useful... He's just pretending like it can't connect. Am I missing something? How to restore old functionality? This 'bug' makes safari completely useless for me.

    OK, some info... This seems to apply only to SOME sites with self signed SSL CERT... The only obvious thing I can think is that maybe it applies to sites where the SSL certificate when the page was first loaded?

    If I open a new window private, I can access the page without problem. If I open a new standard, I can also open the page, until I quit safari. Once I left, it stops loading with the same error...

    If I manually add the SSL certificate to my keychain as being approved, the page also works... There may be a cache of certificate somewhere that is out of date?

  • Is it possible to configure Firefox for some cookies are stored even when the Tools/Options/Privacy is confirgured delete all cookies when Firefox is closed? In other words, an 'exception' list so that certain specified cookies would not be remo

    For some sites that I visit on a daily basis, it's a pain to have to sign in each time. (e.g., Zap2it, which provides TV listings in your area). However, I like defining the Tools/Options/life private to keep all cookies until I close Firefox. I wish I could set up Firefox so that all witnesses would be removed EXCEPT those to which I have. If I could do this, I don't have to log in each time.

    You cannot use Delete browsing, search and download history on Firefox if you want to keep specific cookies by setting an exception.
    "Clear recent history" is all or nothing.

    You can leave the cookies expire if you close Firefox if you need to keep specific cookies.
    Tools > Options > privacy > Cookies: "Keep until the": "closing of Firefox".

    See also Cookies - Information that Web sites store on your computer

  • Replace with clip > source monitor works not properly. Work for a while, then starts to replace the bad clip?

    So I have to use this feature pretty well all day of editing and I'm having to restart first cc pro 2014 more to solve the problem. He works a lot is the best way to keep my changes and edit the clips but then suddenly she starts replaceing bad clip that is NOT in the monitor source... then I have to restart and it works for a while longer until I have to restart all over again... I edit images of car used cars, and time is money. wish really paying for software im worked properly... theres also audio issues that do similar things but I'll start a new thread when I have the time for that one.

    Hi kebmedia,

    Please provide us with more information on the graphics card, the version of the driver and the OS you use. This problem usually occurs due to cache media files. So, please go ahead and manually remove the media cache files and let Premiere Pro regenerate their. The location of the media cache is mentioned below. Make sure you only close Premiere Pro before following these steps.

    For MAC: User > user library > Application Support > Adobe > commune > Cache of media and media Cache files

    For Windows: C:\Users\dwivedi\AppData\Roaming\Adobe\Common/Media Cache and Cache media files

    Folders can be hidden so please see the Documents below to view folders.

    How to view folders in Windows 7: 8 steps (with pictures)

    Access the hidden user library files. Mac OS 10.7 and later versions

    Kind regards

    Vinay

  • Cannot rename my PXI-4071 for something else that "PXI-4071" have the self-assessment work, and I can use the new name in the ivi drivers

    I tried to change the name of the PXI-4071 "DMM" that worked, but when I try to launch the "self-test" or open the app it Panel always fails.   This is also true if I pass the new name of the ivi driver.   Return to the name "PXI-4071" makes everything works again.   Note I managed to change the name of our PXI-2530 b 'SWITCH' and the name of our SMU-6363 to "MIO" and I could pass these names to their IVI drivers and they would work.

    I messed with alias VISA, IVI logical names, but nothing works unless it is called "PXI-4071.


  • How to export the public key / certificate of OUD?

    Hi all

    Maybe it's to export the public key of a unified directory of Oracle?

    I.e. I have Setup SSL on port 636.

    I had created a new certificate self-signed and added to the LDAP server following the guide of SSL to get up and running fast - Oracle Fusion Middleware Oracle Administration Guide unified directory.

    But the certificate for the LDAP server sends when the connection to this is some other certificate and not my certificate.

    CN = computer name, O = Oracle unified the self-signed certificate directory

    Instead of

    CN = Company.com, o = company, c is AU

    that I had created. Because when I created this certificate I exported public key in a text file as per step 4.

    Any guidance would be great.

    Hello

    You want to assign a new SSL certificate to the OUD instance or you just want to export the existing one so that you can import it into a truststore customer?

    To export the cert public key OUD, follow these steps:

    JAVA_HOME/bin/keytool - export - keystore /OUD/config/keystore-alias server-cert-file mycert.cer

    You will be asked the password store which is located in OUD_INSTANCE_DIR>/OUD/config/keystore.pin

    -Sylvain

    ------

    When closing a thread as answered don't forget to mark the messages correct and useful to make it easier for others to find their

  • Flex iOS app refuses to connect to a self-signed SSL server: error 2032

    Hello everyone, thank you for reading this and I hope you could help me with this problem.

    I'll cut to the Chase. I am currently working on a mobile app in Flex for Android and iOS and the app has to get a few HTTP requests and retrieve information from a server, which is currently developing a teammate.

    Everything had to be working very well until we decided a few days before when we have integrated a SSL self-signed certificate in order to make connections more secure, etc.

    On the side of the app, this change, lying just to replace the http with https url and it seems to work perfectly, or that's what we thought.

    Tests on the Simulator or on an Android device worked well, he just showed the warning provided access to a server that had a rogue certificate that could be ignored without any problem. But when we tried to test a Release on a camera of the iPhone version, it would not just work more. A connection every time trying to be established with the server, error 2032 flash is triggered and it fails miserably does not display not warning about certificates not approved at all. For me, it's really confusing that it works on Android devices, but not on the iPhone device.

    I searched on the Web for people having the same problem but I couldn't find an answer to this specific issue of Flex-iOS-Self-signature-SSL. I found this post unanswered questions: http://forums.adobe.com/message/3359072#3359072 but nothing much.

    I tried to create a crossdomain.xml file on the server with guaranteed set to false, and some other stuff to avoid crossdomain policies, but it changed nothing and the problem persists.

    I'm really out of clues, sort of desperate and have no idea how fix it. If anyone knows something related to this problem, please, help me, I'll be less grateful.

    Thank you!

    We decided to buy a verified SSL certificate, and it worked. We can say that the problem is solved, but it wasn't actually because the connection must be established and that the invited user to accept or decline the self-signed certificate, not only do not make the connection.

  • Flex [mobile] iOS app refuses to connect to a self-signed SSL server: error 2032. Ring the bells?

    Hello everyone, thank you for reading this and I hope you could help me with this problem.

    I'll cut to the Chase. I am currently working on a mobile app in Flex for Android and iOS and the app has to get a few HTTP requests and retrieve information from a server, which is currently developing a teammate.

    Everything had to be working very well until we decided a few days before when we have integrated a SSL self-signed certificate in order to make connections more secure, etc.

    On the side of the app, this change, lying just to replace the http with https url and it seems to work perfectly, or that's what we thought.

    Tests on the Simulator or on an Android device worked well, he just showed the warning provided access to a server that had a rogue certificate that could be ignored without any problem. But when we tried to test a Release on a camera of the iPhone version, it would not just work more. A connection every time trying to be established with the server, error 2032 flash is triggered and it fails miserably does not display not warning about certificates not approved at all. For me, it's really confusing that it works on Android devices, but not on the iPhone device.

    I searched on the Web for people having the same problem but I couldn't find an answer to this specific issue of Flex-iOS-Self-signature-SSL. I found this post unanswered questions: http://forums.adobe.com/message/3359072#3359072 but nothing much.

    I tried to create a crossdomain.xml file on the server with guaranteed set to false, and some other stuff to avoid crossdomain policies, but it changed nothing and the problem persists.

    I'm really out of clues, sort of desperate and have no idea how fix it. If anyone knows something related to this problem, please, help me, I'll be less grateful.

    Thank you!

    We decided to buy a verified SSL certificate, and it worked. We can say that the problem is solved, but it wasn't actually because the connection must be established and that the invited user to accept or decline the self-signed certificate, not only do not make the connection.

  • HPDM: HPDM replace self signed SSL certificates for server HDPM and master repository

    I am trying to replace the automatically generated self-signed certificates (issued to DM) issued by DM server HDPM and master repository.  I'm NOT arbitration FTPS, HTTPS embedded HPDM or CERT Thin Client Agent server.

    I already have CERT for the installation of our own internal domain CA for FTPS in IIS and the built-in Apache HTTPS server.  These work properly and pass tests of repository for both protocols.  I also have questions for Thin Clients of our internal CA very well.

    I am interested in the HPDM real server cert and cert master repository. These are generated automatically when the two services start.  They use a very weak MD5 hash and key RSA 1024.  I can't find any documentation around that, with the exception of troubleshooting, in which you can remove these certificates restart services and they will be regenerated.

    Here are the paths certs\key
    HPDM % install Path%\MasterRepositoryController\Controller.crt (Cert repository)

    HPDM % install Path%\MasterRepositoryController\Controller.key (repository key)

    HPDM % install Path%\MasterRepositoryController\Client.crt (HPDM Server Cert)

    HPDM % install Path%\Server\Bin\hpdmskey.keystore (Both HPDM server and repository Certs and keys) (not sure what format it is in.  It is not PEM and P12 ok I can say)

    There are also some HPDM % install Path%\Server\bin\hpdmcert.key.  Don't know what it is.  It's the key to the server HPDM but deleting it does nothing and it is never re auto generated in one of my tests.

    I am able to replace the Controller.crt and keys with my own files CA internal those emitted very well.  The service started and no errors occur.  However if I replace the Client.cert (HPDM Server Cert) with my own service will start but there are Socket SSL errors in repository logs and the HPDM server could not connect to the master repository. I have no idea where the key file is supposed to be for HPDM Server Cert.

    Can anyone help with this?  I can't find the configuration files for the service to generate their own certificates.  If I did I would try at least to change the config to do not use MD5.

    Hello

    These certiricates between HPDM server and MRC are not designed for customizable. Please submite one scenario if you have concerns of security on it.

    Just for info:

    hpdmcert. Key is for communication between the server HPDM and gateway HPDM

    hpdmskey.keystore is for communication between the server HPDM and MRC

    server_keystore is for the commhucation between HPDM server and the Console HPDM

  • stop the ethernet uplink port will cause the port of the unit down

    Dear all,

    I want to make sure that this kind of network traffic will communicate internal fi.

    I've disabled the uplink port and found the path of material has also declined.

    Port of the device must road toward uplink port and then back to UCS server?

    Thank you for the clarification.

    Best regards

    Dennis Dai

    Expected behavior.  By default, if there is no uplinks online & fwd, then all links South (Server binds and the ports of the device) will be used also to the bottom.

    See the explanation of Abi here for more information how to change this behavior.

    https://supportforums.Cisco.com/thread/2187144?TSTART=0

    In short, we must change policy control of the network of the way of the material in the Hardware tab.

    Kind regards

    Robert

  • Create new keys SSL for Weblogic

    I want to activate SSL for servers of IOM - which means that I must be able to access the URL sysadmin and identity via https. I activated SSL in the console of the managed server, but it does not work.

    While I was looking at the doc Doc-ID 1218695.1 and in the doc under Doc ID 1230333.1 they took the measures. I follow the similar steps for my application server, but for the IOM weblogic servers, I need to use the keystore DemoTrust.jks as I have other certificates imported into them. So I can generate a new key using the following command with an existing key file?

    keytool - genkey-alias alias aliases1 - keyalg RSA - keysize 2048 -keystore < I want to use the existing DemoTrust.jks here > - dname "CN = xxx, OU = xx, O = C = xx, xxx, L = xx, S = xx" - storepass xxxx - xxxx keypass.

    I would send the key generated for approval, then import the root and certificates approved in DemoTrust.jks. Is there anything else I need to do?

    Thank you.

    genkey generates a self-signed certificate. If you want to send to a CA for signature, then you will need to use certreq option instead. You can use an existing key file if you wish.

Maybe you are looking for