WebLogic: The Definitive Guide

Chapter 16. SSL

The Secure Sockets Layer (SSL) is an important component of WebLogic’s security framework. J2EE applications deployed to WebLogic can rely on SSL to maintain data integrity and confidentiality of communications at the socket level. SSL-enabled clients also can rely on SSL to verify the identity of the server. In fact, if the server is configured for two-way SSL, it also may verify the client’s identity. SSL can be used to secure communications between the Administration Server and the various Managed Servers in a WebLogic domain. Node Managers that monitor the health of all Managed Servers running on a single machine must communicate over the SSL port.

Let’s consider some typical scenarios in which SSL can protect network communication between two parties:

• A web browser could connect to a WebLogic instance over an HTTP over SSL (HTTPS) port. This would then secure all communication between the web browser and the server, and at the very least require the server to present a digital certificate to the browser as proof of its identity. The SSL mode typically would be used to protect transmission of sensitive data such as login credentials, credit card information, details of bank transactions, etc.

• A Java client could establish a JNDI context with a server using the T3S protocol. All subsequent actions — for instance, looking up an EJB object and invoking one of its methods — occur in SSL mode. If the server is configured for two-way SSL, the client also needs to submit ...