{"id":2824,"date":"2012-10-08T10:27:50","date_gmt":"2012-10-08T14:27:50","guid":{"rendered":"https:\/\/pitss.org\/us\/2012\/10\/08\/icon-jar-administration-for-forms-11g\/"},"modified":"2017-09-05T15:40:04","modified_gmt":"2017-09-05T19:40:04","slug":"icon-jar-administration-for-forms-11g","status":"publish","type":"post","link":"https:\/\/pitss.org\/us\/2012\/10\/08\/icon-jar-administration-for-forms-11g\/","title":{"rendered":"Oracle Icon Jar Administration for Forms 11g"},"content":{"rendered":"

[et_pb_section bb_built=”1″ admin_label=”section” custom_padding=”0px||50px|” _builder_version=”3.0.51″][et_pb_row custom_padding=”0px|||” _builder_version=”3.0.51″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″][et_pb_text _builder_version=”3.0.64″ custom_margin=”||30px|” background_layout=”light” text_orientation=”left” border_style=”solid”]<\/p>\n

Oracle Icon Jar Administration for Forms 11g<\/h1>\n

A Walkthrough guide for common Jar File Administration and Deployment tasks for Forms<\/h4>\n

The following will provide you step-by-step documentation on basic jar file administration and Configuration and how it relates to Forms 11g Deployment. This document will also go into Java Key Store Configuration, which will enable you to enable your WebLogic servers for SSL support.<\/p>\n<\/h4>\n

[\/et_pb_text][et_pb_divider color=”#e2e2e2″ show_divider=”on” divider_position=”center” _builder_version=”3.0.51″ custom_css_main_element=”margin-bottom:30px !important;” \/][et_pb_text _builder_version=”3.0.64″ custom_margin=”||30px|” background_layout=”light” text_orientation=”left” border_style=”solid”]<\/p>\n

What you’ll learn in this article:<\/strong><\/h3>\n

\u2713<\/strong> How to create and update a jar file
\u2713<\/strong> Icon Deployment Rules for Forms 11g
\u2713<\/strong> How to deploy an icon jar file on Forms 11g Environment
\u2713<\/strong> How to create and configure a Java Key Store for jar signing
\u2713<\/strong> How to sign a jar file with a Java Key Store<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row custom_padding=”40px|40px|30px|40px” background_color=”#006bb3″ background_position_1=”top_left” background_repeat_1=”no-repeat” _builder_version=”3.0.51″][et_pb_column type=”4_4″][et_pb_text background_layout=”dark” _builder_version=”3.0.64″ background_color=”#006bb3″]<\/p>\n

Fill out this form to get immediate access to the article.
\n<\/strong><\/h2>\n

[\/et_pb_text][et_pb_code module_class=”white-text” _builder_version=”3.0.64″][ninja_form id=11][\/et_pb_code][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

Oracle Icon Jar Administration for Forms 11g A Walkthrough guide for common Jar File Administration and Deployment tasks for Forms The following will provide you step-by-step documentation on basic jar file administration and Configuration and how it relates to Forms 11g Deployment. This document will also go into Java Key Store Configuration, which will enable […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"

Oracle Icon Jar Administration for Forms 11g<\/h2>\r\nA Walkthrough guide for common Jar File Administration and Deployment tasks for Forms\r\n

Table of Contents<\/strong><\/span><\/span><\/p>\r\n

1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Introduction<\/span>.<\/span><\/p>\r\n

2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Create and Update Jar File(s)<\/span>.<\/span><\/p>\r\n

2.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Create a Jar file<\/span>.<\/span><\/p>\r\n

2.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Update a Jar File<\/span>.<\/span><\/p>\r\n

3<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Deploying Icon Jar files on Forms 11g<\/span>.<\/span><\/p>\r\n

3.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Deployment Rules and Recommendations<\/span>.<\/span><\/p>\r\n

3.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>How to Deploy Icon Jar Files<\/span>.<\/span><\/p>\r\n

4<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Java Key Store Configuration<\/span>.<\/span><\/p>\r\n

4.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Check your PATH Environment Settings<\/span>.<\/span><\/p>\r\n

4.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Create Identity Key Store<\/span>.<\/span><\/p>\r\n

4.3<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Create CSR<\/span>.<\/span><\/p>\r\n

4.4<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Send the CSR to Your Certificate Authority<\/span>.<\/span><\/p>\r\n

4.5<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Optional: Extract Certificates From Bundled Certificate File<\/span>.<\/span><\/p>\r\n

4.6<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Create Full Certificate Chain<\/span>.<\/span><\/p>\r\n

4.7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Conditional: Create Trusted Certificate Chain<\/span>.<\/span><\/p>\r\n

4.8<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Import Certificates into Identity Keystore<\/span>.<\/span><\/p>\r\n

4.9<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Optional: Trust Keystore Configuration for SSL Implementation<\/span>.<\/span><\/p>\r\n

5<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Jar File Jar Signing<\/span>.<\/span><\/p>\r\n

5.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Sign your jar file(s) with a self-signed certificate<\/span>.<\/span><\/p>\r\n

5.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Sign your jar file(s) with an X.509 Certificate<\/span>.<\/span><\/p>\r\n

5.3<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Verify your signed jar files<\/span>.<\/span><\/p>\r\n\r\n

<\/a>1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Introduction<\/span><\/span><\/h2>\r\n

The following will provide you step-by-step documentation on basic jar file administration and Configuration and how it relates to Forms 11g Deployment. This document will also go into Java Key Store Configuration, which will enable you to enable your WebLogic servers for SSL support.<\/p>\r\n

After reading through and practicing this document, you should be familiar with the following topics:<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>How to create and update a jar file<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Icon Deployment Rules for Forms 11g<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>How to deploy an icon jar file on Forms 11g Environment<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>How to create and configure a Java Key Store for jar signing<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>How to sign a jar file with a Java Key Store<\/p>\r\n\r\n

<\/a>2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Create and Update Jar File(s)<\/span><\/span><\/h3>\r\n

There will be many instances where you will have to create and update jar files. When either of these situations occurs and your security policies require all java objects (or icon jars) to be signed with a validated certificate, the respective jars must be re-signed with your validated certificate.<\/p>\r\n

Important Note: Please make sure your a JDK 6 \u201cbin\u201d directory path exists in your command line\u2019s PATH environment variable. Otherwise all of procedures described below will not function properly.<\/p>\r\n\r\n

<\/a><\/a>2.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Create a Jar file<\/span><\/span><\/h2>\r\n

Refer to the example commands below:<\/b><\/p>\r\n

jar cf jar_file.jar input-file(s)<\/p>\r\n

\r\nExample: <\/b>\u00a0say you have two images (image1.gif and image2.gif) that need to be in app_img.jar file. You could run the following command:<\/p>\r\n

jar cf app_img.jar image1.gif image2.gif<\/p>\r\n

Example:<\/b> Say you want to add all gifs in a directory to a jar file, you could run the following command:\r\njar cf app_img.jar *.gif<\/p>\r\n\r\n

<\/a><\/a>2.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Update a Jar File<\/span><\/span><\/h2>\r\n

Refer to the example commands below:<\/b><\/p>\r\n

jar uf jar_file.jar input-file(s)<\/p>\r\n

Example:<\/b> Say you need update one image (image3.gif) to an existing jar file. You could run the following command:<\/p>\r\n

jar uf app_img.jar image3.gif<\/p>\r\n

Example:<\/b> Say you want to update all gifs in a directory. You could run the following command:<\/p>\r\n

jar uf app_img.jar *.gif<\/p>\r\n\r\n

<\/a>3<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Deploying Icon Jar files on Forms 11g<\/span><\/span><\/h3>\r\n

Before deploying your icon jar files, a system administrator should understand how Forms 11g renders icons for a Forms application \u2013 noted in \u201cDeployment Rules & Guidelines\u201d. There is a logical hierarchy of rules to how Forms will use icons used by an Oracle Form.<\/p>\r\n\r\n

<\/a>3.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Deployment Rules and Recommendations<\/span><\/span><\/h2>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Recommendation: Image Dimensions: 16x16 Pixels or 17x17 Pixels.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Recommendation: \u00a0to deploy icons in a jar file (located in $ORACLE_HOME\/forms\/java<\/b>) vs. copying gif files into the \u201c$ORACLE_HOME\/forms\/java\u201d directory.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Rule: Icon file types should be \u201cgif<\/b>\u201d. \u201cico\u201d file type is no longer supported in Forms 11g.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Rule: Default deployment directory for jar and gif files in 11g Forms is: \u201c$ORACLE_HOME\/forms\/java\u201d.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Rule: Order of operations of Icon Usage for 11g Forms Servlet. The following example will be a Forms Application requesting an icon named \u201cmyicon\u201d.<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>Look in \u201c$ORACLE_HOME\/forms\/java\u201d directory for\u00a0 the file \u201cmyicon.gif\u201d<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>If \u201cmyicon.gif\u201d exists<\/b> in \u201c$ORACLE_HOME\/forms\/java\u201d, Forms Servlet will display this icon file.<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>If \u201cmyicon.gif\u201d does not exist<\/b>, continue onto the following steps:<\/p>\r\n

\u00a7<\/span>\u00a0 <\/span><\/span>Loop through each jar file listed in \u201carchive\u201d of \u201cformsweb.cfg\u201d (starting with filenames listed from left to right). Look for \u201cmyicon.gif\u201d within each jar file.<\/p>\r\n

\u00a7<\/span>\u00a0 <\/span><\/span>Once the first<\/b> instance<\/b> of \u201cmyicon.gif\u201d is found in a jar file, use that instance.<\/p>\r\n

\u00a7<\/span>\u00a0 <\/span><\/span>If no gifs are found in the jar files, no gif will be used.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Rule: If deploying icons via jar file, the icon jar file must be listed in the \u201carchive\u201d setting in formsweb.cfg.<\/p>\r\n

Example:<\/b> Say you are deploying your icons with $ORACLE_HOME\/forms\/java\/myicons.jar.<\/p>\r\n

Your formsweb.cfg\u2019s \u201carchive\u201d setting could look like the following example:\r\narchive=share.jar, frmall.jar, myicons.jar<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Rule: Icons deployed as gif file types (gifs not contained in a jar) into the \u201c$ORACLE_HOME\/forms\/java\u201d will be used instead of gifs with the same filename deployed by jar file.<\/p>\r\n

Example:<\/b> if you deploy \u201cmyicon.gif\u201d to the \u201c$ORACLE_HOME\/forms\/java\u201d and myicon.gif is also deployed within a jar file (myicons.jar):<\/p>\r\nmyicon.gif will be<\/b> used from \u201c$ORACLE_HOME\/forms\/java\/myicon.gif\u201d,\r\nmyicon.gif will not<\/b> be used from \u201c$ORACLE_HOME\/forms\/java\/myicons.jar\u201d\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Rule: \u201cArchive<\/b>\u201d\u00a0 setting in \u201cformsweb.cfg<\/b>\u201d works similar to the way PATH environment variables operate on UNIX-Based and Windows operating systems when an executable is called: when an icon filename is requested by\u00a0 a Forms application, the forms servlet will search the jar files from left to right, as soon as the servlet finds the filename in one of the jar files, that respective file will be used for the icon.<\/p>\r\n

Example:<\/b> if you deploy myicon.gif to \u201c$ORACLE_HOME\/forms\/java\/myicons.jar\u201d and \u201c$ORACLE_HOME\/forms\/java\/icons.jar\u201d and your archive setting looks like the following, frmall.jar, myicons.jar, icons.jar.<\/p>\r\n\r\n

<\/a>3.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>How to Deploy Icon Jar Files<\/span><\/span><\/h2>\r\n

1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Create a jar file with all of your required icon gifs<\/b><\/p>\r\n

2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Deploy the jar file to your $ORACLE_HOME\/forms\/java directory on your 11g Forms server.<\/p>\r\n

3.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Optional: Sign your jar file with any necessary security certificates<\/p>\r\n

Self-Signed Certificate: <\/b>See section \u201c5.1\u201d<\/p>\r\n

OR<\/b><\/p>\r\n

X.509 Certificate: <\/b>See section \u201c5.2\u201d<\/p>\r\n

4.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Go to the directory:\r\n$MIDDLEWARE_HOME\/user_projects\/domains\/$DOMAIN_HOME\/config\/fmwconfig\/servers\/WLS_FORMS\/applications\/formsapp_11.1.1\/config<\/p>\r\n

5.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Open formsweb.cfg in an editor<\/p>\r\n

6.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Go to your application\u2019s configuration section in formsweb.cfg<\/p>\r\n

7.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Update your \u201carchive=\u201d value, and append your jar filename to the end of the value:\r\nFor example:<\/b> archive=frmall.jar, myicons.jar<\/p>\r\n

8.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Save formsweb.cfg<\/p>\r\n

9.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Reboot your WLS_FORMS server<\/p>\r\n\r\n

<\/a>4<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Java Key Store Configuration<\/span><\/span><\/h3>\r\n

The following will guide you through the process of creating and configuring a Java key store for X.509 certificates. This is an optional configuration.<\/p>\r\n

X.509 Certificates are used if you have a requirement to configure SSL on your WebLogic Servers or if you have a security requirement to have all java jar objects signed by a validated certificate authority.<\/p>\r\n

The most common use for signing a jar file with a X.509 certificates is if you get the famous java security errors when opening your forms applications. These errors are thrown by the Java Runtime on the end-user\u2019s browser, where it is prompting the end-user if they want to run\/access java objects that are unsigned.<\/p>\r\n\r\n

<\/a><\/a>4.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Check your PATH Environment Settings<\/span><\/span><\/h2>\r\n

Before the JDK key store and jar signing utilities can be used, the JDK\u2019s bin path must be included into your PATH variable and be listed before any other JDKs. The JDK that is used to run your WebLogic servers, should be used for this process.<\/p>\r\n\r\n

<\/a><\/a>4.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Create Identity <\/span><\/span>Key Store<\/span><\/span><\/h2>\r\n

An identity key store must be created. Please refer to the example command below along with descriptions of the respective arguments.**<\/p>\r\n

Please see the following example command:<\/b><\/p>\r\n

keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore example.jks -validity 1095 -dname \"CN=*.example.com,OU=System Admin, O=PITSS, L=Troy, ST=Michigan, C=us\"<\/p>\r\n

Arguments:<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-genkey:<\/b> Required. This tells keytool to create a keystore with a private key.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-alias<\/b>: Required. This creates a name for the identity keystore that is created within your java keystore.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keysize<\/b>: Optional, but recommended. This specifies the encryption key size of the encryption algorithm. Default size is 1024; it is recommended to use an algorithm of at least 2048.\r\nNote: The encryption key size must be a multiple of 64.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keyalg:<\/b>\u00a0 Optional, but recommended. This specifies the encryption algorithm type. The default is DSA; it is recommended to use RSA.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keystore:<\/b> Required. This tells keytool what filename to create the keystore under.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-validity:<\/b> Optional, but recommended. This specifies the time length period of which the default self-signed certificate will use when your keystore is first created. Default is 90 days. It is recommended to use a validity period which reflects your trusted certificates produced by your Certificate Authority (CA).<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-dname:<\/b> Optional but recommended. This specifies what you would like for your values to be for CN (Common Name), OU (Organizational Unit), O (Organization), L (Location: City), ST (State), C (Country).<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>If the \u2013dname<\/b> argument is not provided with the values mentioned above, you will be prompted by the keytool program to enter them.<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>For CN, depending on your certificate authority and how your end-users will access your application(s), you can use one the following values listed below. Please use the option that suites to your server architecture and certificate authority.<\/p>\r\n

\u00a7<\/span>\u00a0 <\/span><\/span>Domain name without asterisk (my.example.com)<\/p>\r\n

\u00a7<\/span>\u00a0 <\/span><\/span>Domain name with an asterisk (*.example.com)<\/p>\r\n

\u00a7<\/span>\u00a0 <\/span><\/span>IP Address<\/p>\r\n

After entering the command above in command line interface, you will be prompted to enter a password for your keystore, confirm the keystore password and if you want to specify a password for the alias you are creating. It\u2019s recommended to keep the alias password and keystore password the same.<\/p>\r\n

Once the keystore creation process is done successfully, the keystore file will be created with the \u201cjks\u201d file extension, within the current working directory of your command line interface. For instance, if you run the example command above in \u201c\/opt\/oracle\u201d, your keystore\u2019s full file path will be \u201c\/opt\/oracle\/example.jks\u201d.<\/p>\r\n

** For more information on \u201ckeytool\u201d usage please refer to Oracle\u2019s official keytool documentation: <\/span>http:\/\/download.oracle.com\/javase\/1.4.2\/docs\/tooldocs\/windows\/keytool.html<\/span><\/span><\/p>\r\n\r\n

<\/a><\/a>4.3<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Create CSR<\/span><\/span><\/h2>\r\n

Please see the following command for creating a CSR. Refer to the argument usage below for how to tailor the command to your requirements.<\/p>\r\n

Run the following command:<\/b><\/p>\r\n

keytool -certreq -alias server -keystore example.jks -file example.csr<\/p>\r\n

Arguments:<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-certreq<\/b>: Required. This argument tells keytool to create a CSR.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-alias:<\/b> Required. Must be set to the alias name specified during the keystore creation step above. For the current example, this will be \u201cserver\u201d.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keystore<\/b>: Required. This argument tells keytool which keystore file path to use.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-file:<\/b> Optional but recommended. CSR will output the CSR into the specified file path. In the example above, CSR will store the CSR into \u201cexample.csr\u201d<\/p>\r\n\r\n

<\/a><\/a>4.4<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Send the CSR to Your Certificate Authority<\/span><\/span><\/h2>\r\n

Once your CSR is generated, you must send the CSR to your Certificate Authority to generate your SSL certificate. If you do not have a Certificate Authority, or if you have any questions on Certificate Authorities, please contact PITSS.<\/p>\r\n\r\n

<\/a><\/a>4.5<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Optional: Extract Certificates From Bundled Certificate File<\/span><\/span><\/h2>\r\n

Some certificate authorities may send your certificates in a bundled certificate file like PKCS#7 or your certificate authority may send you your certificates in plain text.<\/p>\r\n

IMPORTANT:<\/b> If you received your certificates in plain text, please skip this step<\/u>. If you received your certificates in a single base encoded file, like PKCS#7 (.p7b), then this step must be followed.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>On a Windows system, save the certificate file onto your local file system.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Open a Windows Explorer window; navigate to the folder containing your base encoded certificate file.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Open the p7b file. This will launch Windows Certificate Manager (certmgr).<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>From the Certificates Navigator on the left hand side, please navigate down into the \u201cCertificates\u201d folder.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>When the \u201cCertificates\u201d folder is selected you should see two or three certificates listed in the Certificate viewer. Depending on your CA, you will have your public key certificate and your Root CA Certificate, and likely an Intermediate CA Certificate. Some certificate authorities will call these certificates \u201cprimary\u201d and \u201csecondary\u201d certificates respectively.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>For each certificate, right click on each certificate, then click each \u201cexport<\/b>\u201d from the \u201cAll Tasks<\/b>\u201d menu.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Please select the \u201cBase-64 encoded X.509\u201d certificate option when prompted for an export file type.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Specify the target file name for the certificate file. The following are example filenames for each certificate type.<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>Public key: pub_cert.cer<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>Root CA: root_cert.cer<\/p>\r\n

o<\/span>\u00a0\u00a0 <\/span><\/span>Intermediate CA: inter_cert.cer<\/p>\r\n\r\n

<\/a><\/a>4.6<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Create Full Certificate Chain<\/span><\/span><\/h2>\r\n

When your certificate authority sends you your certificates, the number of certificates you receive will vary depending on how your certificate authority distributes certificates. However all authorities will give you at least your SSL\/X.509 certificate and a root CA certificate.<\/p>\r\n

Some authorities may give you \u201cintermediary\u201d CA certificates, which should be included in your certificate chain. Please refer to the following list on what order certificates must be chained in. Once your chain is completed, you can import that chain into your java keystore.<\/p>\r\n

1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>SSL Certificate<\/p>\r\n

2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Intermediary CA Certificate(s) (If applicable)<\/p>\r\n

3.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Root CA Certificate<\/p>\r\n

To create a certificate chain, simply concatenate each proper certificate in the respective order above into a blank ASCII text file.<\/p>\r\n

For an example certificate chain, please see the following example. Note the examples below are not actual certificates and are meant for example purposes only.<\/p>\r\n

Certificate: cert.cer<\/b><\/p>\r\n

\"clip_image001[4]\"<\/a><\/p>\r\n

Root CA Certificate: root_ca.cer<\/b><\/p>\r\n

\"clip_image002[4]\"<\/a><\/p>\r\n

Full Certificate Chain: chain.cer<\/b><\/p>\r\n

\"clip_image003[4]\"<\/a><\/p>\r\n\r\n

<\/a><\/a>4.7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Conditional: Create Trusted Certificate Chain<\/span><\/span><\/h2>\r\n

If you plan on setting up your keystore for SSL support on WebLogic and if you received multiple CA Certificates, this step must be followed. Otherwise if you only received a Root CA Certificate and your actual certificate or if you are only wish sign jar files with your keystore, this step can be skipped.<\/p>\r\n

As described in step 2.6, some certificate authorities will give you multiple CA certificates. For example, some authorities will provide an Intermediate CA Certificate with a Root CA Certificate. Thus you will need to create a trusted certificate chain for when you need to create a trust keystore by starting creating a chain in the following order:<\/p>\r\n

1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Intermediary CA Certificate<\/p>\r\n

2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Root CA Certificate<\/p>\r\n

Please see the following example below to create a trusted certificate chain.<\/p>\r\n

Intermediary CA Certificate: inter_ca.cer<\/b><\/p>\r\n

\"clip_image004[4]\"<\/a><\/p>\r\n

Root CA Certificate: root_ca.cer<\/b><\/p>\r\n

\"clip_image005[4]\"<\/a><\/p>\r\n

Trusted Certificate Chain: trust_chain.cer<\/b><\/p>\r\n

\"clip_image006[4]\"<\/a><\/p>\r\n\r\n

<\/a><\/a>4.8<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Import Certificates into Identity Keystore<\/span><\/span><\/h2>\r\n

Once you have your certificate chain created, you can now import the full certificate chain into your identity keystore. To do this, please see the following example command to run in your command line interface.<\/p>\r\n

Run the following command to configure your Identity Keystore:<\/b><\/p>\r\n

keytool -import -alias server -file chain.cer -keystore example.jks<\/p>\r\n

Arguments:<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-import<\/b>: Required. Tells keytool to import a certificate into the keystore<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-alias<\/b>: Required. The value must be the alias name used during the keystore and CSR creation processes.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-file:<\/b> Required. Tells keytool which certificate file to import into the keystore. In the example above, chain.cer is created in step 2.6.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keystore:<\/b> Required. Tells keytool which keystore to import the certificate into.<\/p>\r\n\r\n

<\/a><\/a>4.9<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Optional: Trust Keystore Configuration for SSL Implementation<\/span><\/span><\/h2>\r\n

If you need to configure your keystores to support SSL for WebLogic Servers, follow this step to configure your keystores. If you do not need to configure your keystores for SSL support , you may skip this step.<\/p>\r\n

To provide full SSL support, a trust keystore must be created. You can add the trusted keystore onto your existing keystore file or create a new keystore file for your trusted keystores (Oracle Recommended Approach).<\/p>\r\n

Run the following command to create and configure a new trusted<\/u> keystore:<\/b><\/p>\r\n

keytool -alias trust -trustcacerts -import -file root_ca.cer -keystore example_trust.jks<\/p>\r\n

OR - Run the following command to add a trusted keystore into an existing<\/u> keystore:<\/b><\/p>\r\n

keytool -alias truststore -trustcacerts -import -file root_ca.cer -keystore example.jks<\/p>\r\n

Keytool Arguments:<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-alias: <\/b>Required. Specify a new<\/u> alias for your trusted keystore.<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-trustcacerts: <\/b>Required. Tells keytool to import a trusted certificate or trusted certificate chain.<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-import: <\/b>Required. Tells keytool that you are importing a trusted certificate or trusted certificate chain.<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-file: <\/b>Required. Tells keytool the filename of the trusted certificate or trusted certificate to import.<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keystore: <\/b>Required. Specify either a new keystore filename (to separate your trusted keystore from identity keystore) or an existing keystore filename to import your trusted keystore into. <\/b><\/p>\r\n\r\n

<\/a>5<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Jar File Jar Signing<\/span><\/span><\/h3>\r\n

<\/a><\/a>5.1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Sign your jar file(s) with a self-signed certificate<\/span><\/span><\/h2>\r\n

Some companies may not require jar files be signed with X.509 certificates depending on resources and requirements. If that is the case, you can sign your jar files with a \u201cself-signed\u201d certificate. Please complete the following steps to sign a jar file with a self-signed certificate.<\/p>\r\n

The following process will use Oracle\u2019s prebuilt process, it is not mandatory to use Oracle\u2019s process \u2013 you can always use Oracle\u2019s prebuilt script as a template and adjust the logic to suite your requirements.<\/p>\r\n

Preparing the Jar Signing Script<\/b><\/p>\r\n

1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Go to \u201c$ORACLE_INSTANCE\/bin\u201d directory<\/p>\r\n

2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Open \u201csign_webutil.sh\u201d (UNIX-Based) or \u201csign_webutil.bat\u201d (Windows) in an editor<\/p>\r\n

3. \u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Go to the Line: \u00a0KEYSTORE_PASSWORD=<\/p>\r\n

a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Replace \u201c\u201d with a password of your choice.<\/p>\r\n

4.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Go to the Line:\u00a0 JAR_KEY_PASSWORD=<\/p>\r\n

a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Replace \u201c\u201d with a password of your choice. It\u2019s common practice for both KEYSTORE and JAR_KEY_PASSWORD values to be same.<\/p>\r\n

5.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Save the \u201csign_webutil\u201d script<\/p>\r\n

6.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Write down the file path of sign_webutil.<\/p>\r\n

Sign your jar file<\/b><\/p>\r\n

1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Go to your $ORACLE_HOME\/forms\/java directory in command-line<\/p>\r\n

2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>It is recommended to create a separate directory in the \u201cjava\u201d folder to work in, so complete the following steps to prevent runtime issues with your Forms environment.<\/p>\r\n

3.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Run a command similar to the examples below. Note replace \u201cfilename.jar\u201d with the filename of your jar:<\/p>\r\n

a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>UNIX-Based: $ORACLE_INSTANCE\/bin\/sign_webutil.sh filename.jar<\/b><\/p>\r\n

b.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Windows: $ORACLE_INSTANCE\/bin\/sign_webutil.bat filename.jar<\/b><\/p>\r\n

4.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>If your jar file signed successfully, you are done! The sign_webutil script backs up your jar file with a \u201c.old\u201d file extension, then will have a \u201csigned\u201d copy of your jar file ready.<\/p>\r\n

5.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>When you are ready to deploy your jar file(s) to the \u201c$ORACLE_HOME\/forms\/java\u201d directory, please plan on rebooting your 11g Forms server for your configuration changes to take effect.<\/p>\r\n\r\n

<\/a>5.2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Sign your jar file(s)<\/span><\/span> with an X.509 Certificate<\/span><\/span><\/h2>\r\n

If you have created your identity keystore for X.509 Certificate Code signing highlighted in section \u201c4 Java Keystore Configuration\u201c, you can proceed with signing your jar file(s) with an X.509 Certificate.<\/p>\r\n

Common jar files to sign are jacob.jar (used by Oracle\u2019s webutil functionality), icon jar files (used by your forms applications), and any other custom built jar files containing images or java code.<\/p>\r\n

Jar Signer Usage:<\/b><\/p>\r\n

jarsigner -keystore jks_filename.jks jar_filename.jar keystore_alias<\/p>\r\n

Please see the following example to sign a jar file:<\/b><\/p>\r\n

jarsigner -keystore example.jks jacob.jar server<\/p>\r\n

Arguments:<\/b><\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>-keystore:<\/b> Required. Specify the identity keystore which has your full certificate chain imported and put a space after your keystore, followed by the alias name of your identity keystore. Do not use the \u201c-alias\u201d argument for the alias.<\/p>\r\n

Note: all jar files beginning with \u201cfrm\u201d in the \u201c%ORACLE_HOME%\/forms\/java\u201d directory which have the same modified timestamp are jar files developed and signed by Oracle. These are critical runtime jar files that should not<\/b> be modified or otherwise signed with new certificates \u2013 as Oracle will not support an Oracle Forms Installation whose jar runtime files have been modified. These jar files are set to expire 2 years after the release date of your installed Oracle Forms release. When these jar file\u2019s certificates expire, it is recommended to patch your Forms release to the most current release.<\/p>\r\n\u00a0<\/span><\/b>\r\n

<\/a><\/a>5.3<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Verify your signed jar files<\/span><\/span><\/h2>\r\n

If you signed your jar files with a self-signed or X.509 certificate, it is recommended to verify that the jar files have been properly signed. You can do so by referring to the examples below.<\/p>\r\n

Quick Check Command:<\/b><\/p>\r\n

jarsigner -verify -certs file_name.jar<\/p>\r\n

The following will give you one line of output indicating if your jar has been signed or not with two possible results below. However this does not tell you if the jar is signed with expired or authorized certificates.<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>\u201cjar verified\u201d Jar is signed with a proper certificate<\/p>\r\n

\u00b7<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>\u201cjar is unsigned. (signatures missing or not parsable)\u201d Jar is not signed with a proper certificate<\/p>\r\n

Verbose Check Command:<\/b><\/p>\r\n

jarsigner -verify -certs -verbose file_name.jar > results.log<\/p>\r\n

This command will give you an in-depth analysis of each respective file that has been signed or unsigned and put the results into a results.log file. It will display detailed information on each certificate that is used to sign each individual file within the jar file that is being checked.<\/p>","_et_gb_content_width":"","footnotes":""},"categories":[22,4,19,10],"tags":[11,23,13,44,17,45,43,24],"class_list":["post-2824","post","type-post","status-publish","format-standard","hentry","category-forms","category-install-config","category-unix-linux","category-windows","tag-11g","tag-forms","tag-installation-setup","tag-java","tag-linux","tag-solaris","tag-unix-based","tag-windows"],"_links":{"self":[{"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/posts\/2824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/comments?post=2824"}],"version-history":[{"count":13,"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/posts\/2824\/revisions"}],"predecessor-version":[{"id":9823,"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/posts\/2824\/revisions\/9823"}],"wp:attachment":[{"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/media?parent=2824"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/categories?post=2824"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pitss.org\/us\/wp-json\/wp\/v2\/tags?post=2824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}