Saturday, June 5, 2010

Changing hostname/IP for Weblogic 11g


Recently I had to migrate two VMs hosting SOA/WebCenter 11g respectively from our US centers to India centers. This involved change in the hostname/IP of the two servers. Now the process is already documented @http://download.oracle.com/docs/cd/E12839_01/core.1111/e10105/host.htm#CHDGEDCF.
But as is with all documents, not everything is documented!

The startManagedServer.sh script has the URL of the AdminServer hard-coded. So you have to change that too. Having done this, start the nodemanager.
When you start your nodemanager, you might encounter the below error (in the AdminServer logfile):

BEA-090504 - Certificate chain received from localhost - 127.0.0.1 failed hostname verification check. Certificate contained xyz.abc.com but check expected localhost
OR
BEA-090482 - BAD_CERTIFICATE alert was received from localhost.localdomain - 127.0.0.1. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.

There are two ways to solve it.

1. Disable Flags - Jugaad way ;)
Put the following flags at the right places.
Node Manager: -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false
Admin Server: -Dweblogic.security.SSL.ignoreHostnameVerification=true

2. Recreate the Certificates - The recommended way.
Node manager by default uses the WebLogic demo identity keystore. The keystore is generated at install time using the CertGen utility. The generated private key uses the common name (cn) resolved by Java.

2.1 Set the PATH
. $WL_HOME/server/bin/setWLSEnv.sh

2.2 Backup DemoIdentity.jks under $WL_HOME/server/lib

2.3 Generate the private key.
java utils.CertGen -cn -keyfilepass DemoIdentityPassPhrase -certfile newcert -keyfile newkey

2.4 Import the key generated above to the keystore.
java utils.ImportPrivateKey -keystore DemoIdentity.jks -storepass DemoIdentityKeyStorePassPhrase -keyfile newkey.pem -keyfilepass DemoIdentityPassPhrase -certfile newcert.pem -alias demoidentity

2.5 Copy DemoIdentity.jks to $WL_HOME/server/lib

2.6 Restart your nodemanager.

That's it !
Posted by at
Labels: , , , ,

15 comments:

  1. UnknownJanuary 13, 2011 at 1:39 PM

    Nice, clear, instructions! Recommends the host name change with WebLogic the right way!

    ReplyDelete
  2. TuanNAJuly 2, 2011 at 12:23 PM

    Hi Rb,
    I cloned my old WL server to a new server using Mono.
    After that i got the same certificate problem when starting the new WL, so i tried your 2nd option to re-generate CA. However I stucked at step 3 with this error:

    Exception in thread "Main Thread" java.lang.NoClassDefFoundError: utils/CertGen
    Could not find the main class: utils.CertGen. Program will exit.

    Could you please advise me how to fix this problem. Thank you
    Could not find the main class: utils.CertGen

    ReplyDelete
  3. UnknownJuly 29, 2011 at 3:44 PM

    TuanNA,

    if setWLSEnv.sh isn't setting the environment variables, export them with the script's output.

    In Linux:

    export CLASSPATH=...............
    export PATH=....................

    ReplyDelete
  4. SudheshpnairAugust 24, 2011 at 10:00 PM

    You should add java utils.CertGen -cn other wise it will throw the below error.
    Unknown option: DemoIdentityPassPhrase

    Usage: java utils.CertGen
    -certfile -keyfile
    -keyfilepass
    [-cacert ][-cakey ]
    [-cakeypass ]
    [-selfsigned][-strength ]
    [-e ][-cn ]
    [-ou ][-o ]
    [-l ][-s ][-c ]
    [-keyusage [digitalSignature,nonRepudiation,keyEncipherment
    dataEncipherment,keyAgreement,keyCertSign,
    cRLSign,encipherOnly,decipherOnly]]
    [-keyusagecritical true|false]
    [-subjectkeyid ]
    [-subjectkeyidformat UTF-8|BASE64]
    [-help]

    ReplyDelete
  5. SudheshpnairAugust 24, 2011 at 10:17 PM

    java utils.CertGen -cn hostname

    ReplyDelete
  6. StalkerAugust 16, 2012 at 8:13 AM

    very usefull ! thanks a lot

    ReplyDelete
  7. Eric CloutierSeptember 26, 2012 at 3:23 AM

    Thanks! This solved my issue.

    ReplyDelete
  8. tinzMarch 13, 2013 at 3:12 PM

    This comment has been removed by the author.

    ReplyDelete
  9. tinzMarch 13, 2013 at 3:13 PM

    Thank You.

    ReplyDelete
  10. Rakesh DApril 24, 2013 at 7:07 AM

    Hi Thanks for providing the steps in detail.

    I have performed the same steps for changing the hostname in DemoIdentity.jks

    Using command I got - newcert.der, newcert.pem,newkey.der,newkey.per and DemoIdentity.jks. I have replaced the DemoIdentity.jks with new one. And it is working fine.
    Query:
    Is there any harm for removing key files - newcert.der, newcert.pem,newkey.der,newkey.per

    ReplyDelete
  11. Stalin GinoMay 31, 2013 at 4:19 PM

    Thanks for the post.

    ReplyDelete
  12. C to the JNovember 5, 2013 at 6:58 AM

    Perfect! Solved my problem.

    ReplyDelete
  13. MihirMay 30, 2014 at 11:52 PM

    This comment has been removed by the author.

    ReplyDelete
    Replies
    1. MihirMay 31, 2014 at 12:28 AM

      I am sorry, I didn't observe the dates on the webpages.
      But thanks so much for the help.

      Delete
  14. Manisha PrakashFebruary 22, 2016 at 9:32 PM

    Thanks bro it worked for me.

    ReplyDelete

Subscribe to: Post Comments (Atom)