Expired SSL Certificates!!!My initial reaction: You don’t have Monitoring? Hmm well, that led me to think, realistically how many environments have cert expiry monitoring? I haven’t seen any environments that have automated monitors that check the WebLogic Certificates. One of the reason why this may not have affected you is one, you are not using SSL and two, the certs you obtained have a life span of more than 10 years.

In our WebLogic environments we do not have monitoring specifically on the Cert’s, but we do have some monitoring that does warn us in-case  our Certs are about to expire. The way it works is, during boot time WebLogic Server logs a message if the certs configured are about to expire in the next 30 days. This message is logged with severity “Notice”. Our monitoring application listens on the Log BroadCaster (I will leave the details for another blog post), this listener will send an alert/EMail whenever a message is logged with severity “Notice”. The alert will contain the details of what is logged, in case of a Certificate that is about to expire it will contain the Date when it is going to expire and other Certificate details.

Please note, there is one problem to the above approach, i.e. we are relying on WebLogic Server to be started or restarted atleast once within this 30 days timeframe that your Certificate may expire. If not, you will never recieve the notification.

In one of my subsequent post I will write about an alternate simple approach to monitor your WebLogic Certificates.

• WebLogic Server 10.3 MP1 is part of Fusion Middleware 11g.
• WebLogic Portal is NOT part of the Oracle Fusion Middleware 11g. The portal product that is part of Fusion Middleware is Oracle WebCentre.
• Oracle will continue to develop and innovate on WebLogic Portal and planning to release 11g version by the end of the year.
• JRockit is the recommended JVM for Oracle Fusion Middleware 11g.
• Oracle does not have any plans to merge Sun’s JVM and JRockit into one, both these JVM’s will be independent of each other.
• JDeveloper is the recommeded IDE for all products in the Fusion Middleware suite.
• Oh lastly, Enterprise Manager is the mother of all Managers and will be able to control the Universe.. .

Checked with Oracle and offcially WebLogic 10.3 is NOT supported on either JDK 1.4 nor JDK 1.5.

But once SSL is configured and you have dis-abled the non-ssl port, you should make sure that the DefaultProtocol your WebLogic Server uses is SSL (either t3s, https or iiops). If you haven’t done this, your WebLogic Server will try to use “t3″ (default) for any outbound connections and since the ListenPort is disabled it will fail.

Here’s a simple wlst script to change the default protocol to t3s for all the servers in the domain.

# After connecting to the Admin Server

edit()

startEdit()

servers = cmo.getServers()

for i in servers:

i.setDefaultProtocol(“t3s”)

save()

activate()