Skip to content
Docs sslbrain sslbrain.com

Oracle WebLogic

Copy link to the page “Oracle WebLogic”

← All integrations

Linux · Apps and databases

Installs the identity under the configured WebLogic alias and can activate one local server supervised by systemd.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. Finds the server and secure-channel keystore and alias. Imports the PFX identity into a copy under the configured alias and checks the key password before replacement. Other entries are retained.
  3. Takes a protected backup and atomically replaces the keystore with the same owner and file permissions. Known certificate managers for this keystore are reported; only an explicitly selected dedicated renewal timer can be taken over.
  4. Restarts only the matched systemd service and waits for fresh TLS connections serving the requested certificate. Without supported local activation, the file is installed with a warning; use your operator activation procedure. If it fails: If a previously working service breaks, recovery restores only unchanged state owned by the package, including the original state of a taken-over timer. Recovery is confirmed only when the old certificate answers again. A still-working old certificate or unknown state does not trigger blind rollback; pending new file bytes can activate on a later restart.
  5. Verification reports the stored alias separately from observed local TLS certificates. Undeploy retains keys with active or unknown bindings until they are rebound in WebLogic.

Technical details

Connection
The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports
7001, 7002
You need
The service agent installed on the server. keytool on the server PATH, access to the identity keystore and its separate key password. Local TLS checks use OpenSSL. Automatic activation requires xmlstarlet, local config.xml, one WebLogic server directly supervised by systemd and permission to restart it.
Actions
Discovery, Installation, Verification, Rollback, Removal
Packages
oracle-weblogic-ssh 1.1.0
Note
  • Discovery finds the running WebLogic server, its domain directory, and the identity keystore and alias the server uses according to config.xml. Other keystores under the usual install folders are listed after it.
  • New activation fields are optional; supported local activation can also be discovered automatically. The default start wait is 600 seconds, configurable from 1–3600 seconds. Appliance 0.4.44 has a separate 300-second queue limit; longer queued starts are not verified.
  • Separate key passwords are supported in JKS; standard keytool requires equal store and key passwords in PKCS12. The alias and passwords must already match WebLogic configuration, which the package does not rewrite.
  • Evidence covers local TLS certificate identity, not chain trust, application health or all cluster nodes. Node Manager, KSS, NFS and extended ACL/SELinux attributes are not qualified. No physical customer device has been verified.

Get started