0

I have configured our managed servers (on WebLogic 10.3.5) to use SSL with custom identity/trust keystores and all that has been working fine. However, after completing the SSL configuration, we started getting some warning messages saying "Invalid/unknown SSL header was received from peer". After looking through some articles online, the solution seemed to be setting the SecureListener property in nodemanager.properties to "false" and setting the listener type of the Node Manager in the Administration Console to "Plain". This did stop the warning messages from showing up in the log file...however I was wondering if there are any security implications to using a plain vs. SSL listener for the Node Manager. FYI, this is a development environment that's closed off from public access but will eventually be moved to a production environment.

2 Answers 2

0

If SSL is a requirement, then you should enable it for node manager listener too. You should use the same key pair for the node manager and the managed servers for the same user/machine pair.

When you debug, make sure that you enable debugging for both Certicom an Sun SSL libraries. In WebLogic older than 12 both SSL stacks can be used. In WebLogic 12 thay have changed the default to use only the Sun implementation of SSL.

To enable SSL you will need to edit nodemanager.properties and add/configure the following directives:

CustomIdentityAlias
CustomIdentityKeyStoreFileName
CustomIdentityKeyStorePassPhrase
CustomIdentityPrivateKeyPassPhrase
KeyStores=CustomIdentityAndJavaStandardTrust

See also: * http://docs.oracle.com/cd/E17904_01/core.1111/e12036/node_manager.htm#CCHEBIHI * http://docs.oracle.com/cd/E13222_01/wls/docs81/adminguide/confignodemgr.html#1143202

3
  • I have updated the nodemanager.properties file with the appropriate values. Does the admin server need to be configured to use SSL in addition to the managed servers?
    – Brian
    Dec 4, 2012 at 16:38
  • You need to configure the Machine section in the WebLogic console. Make sure that the certificates used by the node managers are trusted by the Admin Console. Restart everything (node managers, admin console)... If you do mistakes, you can roll back the config.xml and nodemanager.properties files. Dec 4, 2012 at 16:47
  • Test the nodemanager listener with openssl s_client -connect node.manager.IP.address:NodeManagerPort . If you see a DER encoded certificate, then the listener is configured properly. You can take a look to see if this is the expected certificate. Also make sure that the hostname is set properly in the DNS. The DNS and the reverse should point to the same FQDN. If you are using hosts, make sure that the first entry for that IP is the FQDN. Make sure that in the Subject field of the certificate you have CN=FQDN, where FQDN is the complete hostname. Dec 4, 2012 at 16:52
0

It turned out that one of the managed servers was still using the Java standard trust. Once I changed that to my custom trust file and then updated the SecureListener to "true" and then restarted everything, the warning messages went away.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .