Java Key Store Commands

Common Keytool Commands

Following table lists keytool commands you use when creating and using JKS keystores with WebLogic Server.

 

Table  Commonly Used keytool Commands 

Command	Description
keytool -genkey -keystore keystorename -storepass keystorepassword	Generates a new private key entry and self-signed digital certificate in a keystore. If the keystore does not exist, it is created.
keytool -import -alias aliasforprivatekey -file privatekeyfilename.pem-keypass privatekeypassword-keystore keystorename -storepass keystorepassword	Updates the self-signed digital certificate with one signed by a trusted CA.
keytool -import -alias rootCA -trustcacerts -file RootCA.pem -keystore trust.jks -storepass keystorepassword keytool -import -alias intermediate -trustcacerts -file Intermediate.pem -keystore keystorename -storepasskeystorepassword	Creates a custom keystore to be used for holding an intermediate CA certificate.  The first keytool command creates the keystore, trust.jks, which holds the root CA certificate.  The second keytool command imports the intermediate CA certificate into trust.jks. This enables WebLogic Server’s SSL implementation to transmit the intermediate certificate with the server’s public certificate to the client during the SSL handshake.
keytool -import -alias aliasfortrustedca -trustcacerts -file trustedcafilename.pem -keystore keystorename -storepass keystorepassword	Loads a trusted CA certificate into a keystore. If the keystore does not exist, it is created.
keytool -certreq -alias alias -sigalg sigalg-file certreq_file-keypass privatekeypassword-storetype keystoretype-keystore keystorename-storepass keystorepassword	Generates a Certificate Signing Request (CSR), using the PKCS#10 format, and a self-signed certificate with a private key. Stores the CSR in the specified certreq_file, and the certificate/private key pair as a key entry in the specified keystore under the specified alias.
keytool -list -keystore keystorename	Displays what is in the keystore.
keytool -delete -keystore keystorename -storepass keystorepassword -alias privatekeyalias	Deletes the entry identified by the specified alias from the keystore.
keytool -help	Provides online help for keytool.

OIM 11.1.2.2 : Check OIM Scheduler Status Without Logging In

OIM 11.1.2.2 :  Check OIM Scheduler Status Without Logging In 

Change the localhost and port 8080 below to your OIM server's hostname and port number

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.net.URLConnection;

public class CheckSchedulerStatus{

  public CheckSchedulerStatus(){

  }

  public void SchedulerStatus(){

   try{

    URL url = null;
    URLConnection urlconn = null;
    url =new URL("http://mindtelligent-d:14000/xlScheduler/ddstatus");
    urlconn = url.openConnection();

    urlconn.connect();
    InputStream response =urlconn.getInputStream();
    StringBuffer buffer = new StringBuffer();
    BufferedReader dataInput =
     new BufferedReader(new InputStreamReader(response));
    String line;
    while ((line = dataInput.readLine()) != null) {
     buffer.append(line);
     buffer.append('\n');
    }   if(buffer.toString().toUpperCase().indexOf("STARTED")!=-1){
System.out.println("Scheduler Status: " + "STARTED");
    }
    else    if(buffer.toString().toUpperCase().indexOf("STOPPED")!=-1){
System.out.println("Scheduler Status: " + "STOPPED");

     int stackTraceLocation = buffer.toString().indexOf("Detaild Stack Trace follows");
     if (stackTraceLocation > -1) {
      int stackTraceBeingIndex = buffer.toString().indexOf("<PRE>",stackTraceLocation)+5; 
      int stackTraceEndIndex = buffer.toString().indexOf("</PRE>",stackTraceLocation); 
      String stackTrace = buffer.toString().substring(stackTraceBeingIndex,stackTraceEndIndex);
System.out.println(stackTrace);
     }


    }
  }

  catch(Exception e){
   e.printStackTrace();

  }

 }
  public static void main(String[] args){

   CheckSchedulerStatus chckSch = new CheckSchedulerStatus();
   chckSch.SchedulerStatus();
  }
}

Configuring and Installation Talend ESB 5.2 on Tomcat 6.0 on Linux- Part 1 Installation of Administration Center

Configuring and Installation Talend ESB 5.2 on Tomcat 6.0  Part 1 Installation of Administration Center

First, install the Apache Tomcat application server and stop the Tomcat service if it is automatically started.
In the rest of this documentation, <TomcatPath> points out the path where Tomcat has been installed.
Indeed we recommend you to stop this service prior to deploying the Web application
(org.talend.administrator.war).

Using 7zip:

1. Unzip the package delivered by Talend: Talend-AdministrationCenter-rYYYYY-VA.B.C.
This will give you access to the different components needed to benefit from all the Talend Administration
Center functionalities:

       • org.talend.administrator.war, the archive containing the actual Talend Administration Center Web
         application.

        • Talend-Artifact-Repository-VA.B.C.zip, the archive containing an artifact repository software, based         on Apache Archiva, that will be used to handle software updates, and also ESB artifacts, only if you             subscribed to one of Talend ESB oriented solutions.

       • an endorsed folder containing a library necessary to use the ESB Conductor of Talend Administration
          Center, only if you subscribed to one of our ESB oriented solutions.


2. Unzip the Web application, org.talend.administrator.war, into the following directory of Tomcat:
<TomcatPath>/webapps/.

3. If you subscribed to one of our ESB oriented solutions, to be able to use the ESB Conductor module of Talend Administration Center, copy the endorsed folder provided into the root directory of Tomcat.

Configuration of  Administration Center

Using a browser navigate to URL

• http://localhost:8080/org.talend.administrator
• Click on Set new license

• On Selection of the license. The Admin Center validates that information and following screen is displayed.

• Clock on "Go to login page" and enter username admin@company.com and password admin to start using the Admin Center

Putty with XMING for OFM installations

Putty with XMING for OFM installations

PuTTY

PuTTY is a free terminal emulator that supports SSH, Telnet and Rlogin network protocols.

PuTTY has a graphical configuration interface with features like; storage of connection data, port forwarding and SCP and SFTP support

URL:     à http://www.putty.org/

           

SUGGESTED CONFIGURATION:

1)   Connection à Data – set Terminal-type = xterm or vt220.

        2)  Connection à SSH – order Blowfish then 3DES
3)    Window à Colours – leave background as black, Modify Default Foreground(text) as desired.
4)    Connection à SSH à X11 – click on Enable X11 forwarding box
5)    Click on Save, then Open

Xming:

Xming is the leading Free Software X Window Server for Microsoft Windows.

URL:        http://www.straightrunning.com/XmingNotes/

FILE LIST –

1.       Xming-6-9-0-31-setup.exe
-Xming 2.15MB Microsoft Windows program installer.
-Standard Xming uses the OpenGL renderer.
-Installs only the absolute minimum fonts and includes the XLaunch wizard as an optional component.

2.       Xming-fonts-7-3-0-15-setup.exe
-Font package
-Xming-fonts 30.0MB optional extra, may be used to supersede the
-absolute minimum 'Bitmap fonts' installed with Xming as well as
-providing the bulk of X Window standard fonts.
àRequired for Oracle GUI
àInstall fonts in the folder where Xming is already installed.

USAGE:

Execute Xming – icon will open in system tray on bottom right of screen.

Execute PuTTY à connect to server à enter xterm – the new window will open.
In the new xterm window start your GUI

OPEN SSL Commands

OPEN SSL to create PKCS12 Keystore

A root certificate is a fundamental component of the Public Key Infrastructure (PKI) that forms the backbone of secure communications on the internet. It is issued by a trusted entity called a Certificate Authority (CA) and is used to establish trust for a chain of certificates.

---

Key Characteristics of a Root Certificate:

1. Self-Signed Certificate:

   • A root certificate is self-signed, meaning it is signed by the Certificate Authority (CA) itself.
   • This makes it the "trust anchor" of the certificate chain.

2. Trusted by Operating Systems and Browsers:

   • Root certificates are pre-installed in the trust stores of operating systems (e.g., Windows, macOS, Linux) and browsers (e.g., Chrome, Firefox).
   • If a root certificate is in the trust store, all certificates signed by it (or intermediates it has signed) are trusted.

3. Top of the Certificate Chain:

   • In the certificate chain, the root certificate is at the top, followed by one or more intermediate certificates, and finally the end-entity certificate (e.g., a website certificate).

---

Structure of a Root Certificate:

A root certificate includes:

• Issuer: The name of the CA that issued the root certificate (usually itself, since it's self-signed).
• Subject: The name of the entity the certificate is issued to (the CA itself).
• Public Key: The CA's public key, used to verify signatures.
• Validity Period: The start and expiry dates of the certificate.
• Signature Algorithm: The cryptographic algorithm used to create the certificate's signature.

---

Why Root Certificates Are Important:

1. Trust Establishment:

   • Root certificates enable secure connections (e.g., HTTPS, email encryption) by creating a chain of trust.

2. Certificate Chain Validation:

   • When you visit a website, your browser validates the website’s certificate by following the chain of trust back to a root certificate in its trust store.

3. Security:

   • Root certificates ensure that only trusted parties (like websites or services) can communicate securely with users.

---

Example of a Certificate Chain:

1. Root Certificate:

   • Issued by "GlobalSign Root CA."
   • Installed in your system/browser's trust store.

2. Intermediate Certificate:

   • Issued by "GlobalSign Intermediate CA" and signed by the root certificate.

3. End-Entity Certificate:

   • Issued to "example.com" and signed by the intermediate certificate.

When you visit example.com, the browser validates the chain:

• The end-entity certificate is trusted because it is signed by the intermediate certificate.
• The intermediate certificate is trusted because it is signed by the root certificate.

1.)Create a Self Signed Certificate
openssl req -x509 -nodes -days 365  -newkey rsa:1024 -keyout selfsigned.pem -out selfsigned.pem

2.) Verify a self-signed certificate
openssl verify selfsigned.pem

3.) Export selfsigned.pem as PKCS#12 file, identity.pfx 
openssl pkcs12 -export -out identity.pfx -in selfsigned.pem -name "selfsigned"

4:) Extract public certificate from url

openssl s_client -showcerts -connect core-integrations.mindtelligent.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > certificate.pem

5:) Extract Private Key

If you have a .p7b (PKCS#7) certificate file and need to extract the private key, it’s important to note that .p7b files typically do not include the private key. They usually only contain the certificate chain (public certificates).

If you still want to extract a private key and believe the key is associated with this file, you will need the original private key that was created during the Certificate Signing Request (CSR) process or convert the .p7b to another format like .pem to handle certificates and key extraction.

To extract the private key from a .p12 (PKCS#12) file, you can use the openssl command. Here's how to do it:

 openssl pkcs12 -in ./core-integrations.mindtelligent.com.p12 -out privatekey.pem -nodes -password pass:password123

6:) Extract Certificate Chain

 

 openssl pkcs12 -in core-integrations.mindtelligent.com.p12 -clcerts -nokeys -out  core-integrations-mindtelligent.com.certchain.pem -password pass:password123

Mule ESB 3.4.4: Configure Oracle JDBC driver in Mule Developer Studio

Mule ESB 3.4.4: Configure  Oracle JDBC driver in Mule Developer Studio

A JDBC driver is a software component enabling a Java application to interact with a database. 

To connect with individual databases, JDBC (the Java Database Connectivity API) requires drivers for each database. The JDBC driver gives out the connection to the database and implements the protocol for transferring the query and result between client and database.

• Right Click on Project Explorer
• Right Click on Build Path
• Right Click on Add External Archives

• Choose the location of the Oracle JDBC driver. Press Open.

• You can the driver in the Referenced Libraries .

Create a Data Source

• 1.) Click on Global Elements; 2.) Click on Create; 3.) Click on Data Sources; 4.) Click on Oracle Data Sources;5.)Click on OK

• 1.) Enter JDBC URL;2.) Enter user name; 3.)Enter password.

Create a connector

• 1.) Click on Global Elements; 2.) Click on Create; 3.) Click on Connectors; 4.) Click on Database;5.)Click on OK

• Choose the Data Source and Press OK.

OIAM 11.1.2. / SOA 11.1.1.7 : Reset Expired Passwords for Infrastructure tables

OIAM 11.1.2. / SOA 11.1.1.7 : Reset Expired Passwords for Infrastructure  tables

By default the passwords for OIM and SOA infrastructure tables expire in 180 days. Incase the password expire we need to reset the password so the OIAM and SOA managed servers can be started.

To resolve this issue, following steps can be taken.

1.)  Connect to database using sys users.


2.)  Run the SQL statement select * from dba_profiles;

Here PASSWORD_LIFE_TIME field is responsible for expiring of password after 180 days.

3.  Execute following command to disable this feature:

Sql> ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED;

SQL> select * from dba_profiles;

5.) We need to Reset the password of the locked user. We can use the same password or a different password.

SQL> SPOOL PassworrdResetList.sql

SQL> select 'alter user "'||d.username||'" identified by values '''||u.password||''';' c

from dba_users d, sys.user$ u

where u.user# = d.user_id

and  d.username IN (select username from dba_users where account_status like 'EXPIRED%')

SQL>SPOOL OFF

6.) SPOOL file will give a list of ALTER USER commands. execute these commands to reset the passwords.

7.) 

SQL> SPOOL LockedUsers.sql

SQL> select 'ALTER USER ' || username || ' ACCOUNT UNLOCK;' from dba_users where account_status like '%LOCKED%';

SQL> SPOOL OFF

8.) Run all the ALTER USER username ACCOUNT UNLOCK from the spool file. Please ensure that you DO NOT UNLOCK those users which are recommended to remain LOCKED by Oracle.