Home -> Mailing Lists -> Oracle-L -> RE: EM 12.1.0.5 Up and Running (Thanks to Brian Pardy) [Solution]

RE: EM 12.1.0.5 Up and Running (Thanks to Brian Pardy) [Solution]

From: Chitale, Hemant K <Hemant-K.Chitale_at_sc.com>
Date: Tue, 17 Nov 2015 03:25:38 +0000
Message-ID: <2FE2AA1C5F8DEC478F58DF8DD32BA63713CF5E_at_HKWPIPXMB03C.zone1.scb.net> 





> I'm probably going to [re]start a blog just because of this issue.



Agreed.  Too much detail in an email that may disappear.



Hemant K Chitale




From: oracle-l-bounce_at_freelists.org [mailto:oracle-l-bounce_at_freelists.org] On Behalf Of Chris Taylor
Sent: Tuesday, November 17, 2015 8:11 AM
To: oracle-l_at_freelists.org


Subject: EM 12.1.0.5 Up and Running (Thanks to Brian Pardy) [Solution]



I'm probably going to [re]start a blog just because of this issue.  HUGE thanks goes out to Brian Pardy for his help on this and writing a great blog about recreating (modifying) the Oracle Wallets to get rid of the demo certs.



First, this "adventure" started with laying down EM 12.1.0.5 vanilla install.  Due to the numerous java vulnerabilities identified in the last 12-15 months, there have been several patches that browser makers have applied and pushed out.  These browser updates effectively "broke" the ability to peruse EM 12c (the console) and generated numerous Metalink documents.



The error was:



https://host:port/console generates Server has a weak ephemeral Diffie-Hellman public key.  The https://host:port/em server seemed to work ok.



Secondly, after trying to patch this problem away using the CPU 2015 Patch Guide (Applying Enterprise Manager 12c Recommended Patches (Doc ID 1664074.1), the brokeness of the EM 12.1.0.5 install only increased.



Then, I ran across Brian Pardy's blog post about setting the Oracle wallets and getting rid of the demo certs and generating new certificates HERE:
https://pardydba.wordpress.com/2015/03/03/step-by-step-configuring-third-party-ssltls-certificates-in-em12c-r4/



(I skipped the section "Creating Wallets for each agent" about generating certificates for each agent for now as that would require CSRs for each host where an agent will be running.  I might come back to that though.



So, here's the steps that got me to a perfectly useable EM 12.1.0.5 installation.  I'm going to attempt the October 2015 Patching guide again now but at least I know I can flash back to this structure and it be useable.
In a nutshell, when laying down EM 12.1.0.5 vanilla install today, you REALLY should get 1024 or 2048 bit keys, appropriate Trusted/Issuing/User Certificates, and patch Weblogic.



Steps (at a high level) - the only steps I came up with were the 3 Weblogic Patching steps to support Keys longer than 512 bits (steps 16-18).   This may be messy but I formatted it with FIXED WIDTH and it shows up correctly in draft mode.


01. Install EM 12.1.0.5 Software                                  Browse to https://host:port/console - should receive error due to browser updates. If not, you don't have the latest updates.


02. Backup installed directories:


- agent dir $ORACLE_BASE/product/agent12c





This email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please delete all copies and notify the sender immediately. You may wish to refer to the incorporation details of Standard Chartered PLC, Standard Chartered Bank and their subsidiaries at https://www.sc.com/en/incorporation-details.html

--
http://www.freelists.org/webpage/oracle-l


Received on Tue Nov 17 2015 - 04:25:38 CET












Original text of this message