Configure Weblogic SSL to deny SSLv2

Quick post, with a quick solution.

We are going through some security audits, and one of the things that we had failed on was an SSL test on our OBIEE server. The issue was that by default, Weblogic was allowing SSLv2 and weak ciphers, something out security team doesn't like.

The solution took me some googleing, but I found the change and it was quite simple. Essentially we had to add a simple command line argument to our bi_server startup script:

-Dweblogic.security.SSL.protocolVersion=SSL3 -Dweblogic.security.disableNullCipher=true

That resolved it, and now we are passing the SSL check.

For reference on how we setup SSL for OBIEE in Weblogic on the appserver, check out the previous blog post.

Setting up SSL for Weblogic

We recently needed to setup SSL for OBIEE so that we could accept the EBS cookie for single sign on between EBS and OBIEE (post to come soon on how to get that all wired up). Unfortunatly I don't have all of the steps, as someone else on the team handles the making of the actual cert, but I can provide all steps around the process.

Continue on to read what I did to create a private key, create a certificate request (CSR), and configure WebLogic to enable the SSL port for OBIEE.