Importing wildcard certificates into a java keystore

Weblogic managed servers support java keystores (.jks) but you have received signed wildcard certificates(.crt) which cannot be directly imported into the keystore.
You may get below error:
Error
keytool error: java.lang.Exception: Input not an X.509 certificate
java.lang.Exception: Input not an X.509 certificate
        at sun.security.tools.keytool.Main.addTrustedCert(Main.java:2655)
        at sun.security.tools.keytool.Main.doCommands(Main.java:1009)
        at sun.security.tools.keytool.Main.run(Main.java:343)
        at sun.security.tools.keytool.Main.main(Main.java:336)
There are myriad number of ways in achieving this along with support from many blogs, videos or you can follow these steps and achieve it. 

Firstly, ensure you have received all the certificates like the CA Root, additional Trust Certificates and intermediate certificates along with a wildcard certificate and a private key/server key which was used while generating the CSR (certificate signing request).
Some clients send these certificates packaged into PKCS12 if not follow the steps from the beginning

Tools required: OpenSSL software

1. Add all certificates and the private key to a single .pem file
openssl x509 -in each_certificate.crt -out complete_pem.txt -outform PEM

2. Now create a .pkcs12 file which is compatible with JAVA 8

openssl pkcs12 -export -inkey complete_pem.txt -in complete_pem.txt -out complete_key.p12

You will be prompted for a password, don't forget to keep a record of it.

3. Create a java keystore now:

Go to JAVA_HOME\bin preferably above Java 8 

keytool -­importkeystore -­deststorepass <hidden> -­destkeypass <hidden> -­destkeystore clientIdentity.jks -­srckeystore

complete_key.p12 -­srcstoretype PKCS12 ­-srcstorepass <password> ­-alias <anything_meaningful>

Here: deststorepass/destkeypass is the destination keystore password

-destkeystore : Java keystore you create.

-srckeystore : is the keystore you created in step 2

-srcstorepass : the password you used in step 2

This is identity keystore as it also contains the private key. Although you can use the same keystore for both. Generally, I like to keep Identity keystore and the Trust keystore separated. 

Similarly, you can create another keystore with only trusted root certificates which will be named as clientTrust.jks.

keytool -import -v -trustcacerts -alias CARoot -file AddTrustExternalCARoot.crt -keystore clientTrust.jks -storepass <hidden>

Import these keystores into Weblogic managed servers, FR Studio , EAS Clients , java security folder(cacerts) etc. There are many documents available on Oracle support for Full SSL Deployment. 

Note: alias is case-sensitive.It is important to note the aliases as Identity key requires it.

This post covers only steps for generating java keystore, when provided with certificates from trusted entities. Once keystores are read it can be used in various locations as required.

For further generic steps on security management refer here:

Security Management

Read More

HPCM 11.1.2.4.123

Error:
Caused by: java.sql.SQLSyntaxErrorException: ORA-00904: "ENABLED_FLG": invalid identifier

Symptoms:
Launching HPCM application from Workspace gives above error post patching HPCM with 11.1.2.4.123 patch.


Solution:
Manually run this step from the Read Me:
Run the following database update script in the Profitability and Cost Management product schema/user using

Oracle SQL Developer:
<EPM_ORACLE_HOME>\products\Profitability\database\Common\Oracle\create_11.1.2.4.120.sql

This creates a column ENABLED_FLG column.

Read More

New Knowledge Article: Troubleshooting Hyperion Financial Management Crash and Hang Issues

Oracle recently launched this new article for most of the HFM issues. It is handy and easy to use.
Helps during troubleshooting.

• Troubleshooting HFM Crash and Hang Issues (Doc ID 2060755.2) 

It provides detail step through process of each issue.

Here's one snippet of it. 

Read More

A connection to the server has failed (Status=503)

We got this error when one of the long running rules was timing out. I knew I could fix this in a jiffy since we faced this issue multiple times but to my surprise that was not the case. I logged into the environment and found that there was no Oracle HTTP Server (OHS) , client had used IIS as the Web Server. I had to read quite a few documents related to Weblogic and IIS.

Here is first a little from what I understood about the two,
Weblogic uses IIS plugin. This plugin allows requests to be proxied from IIS server to the Weblogic Server. The static pages of the Hyperion website are rendered by the IIS server and all the dynamic pages like the JSPs, HTTP Servlets are rendered by the Weblogic (hfm.war) .


The directory structure of the epm instance will have a folder D:\Oracle\Middleware\user_projects\httpconfig\virtualdirectories
This contains folder for every location like Planning , HFM , Reporting etc.
Each folder contains a file IISPROXY.INI.

 Issue Screenshot

Cause:
 Timeout is set too low for current task to complete.


Solution for IIS Web Server
1.Go to the location of iisproxy.ini and add these values to the file

HungServerRecoverSecs=1800
WLIOTimeoutSecs=1800

Do not miss the '=' sign.
HungServerRecoverSecs is replaced by WLIOTimeoutSecs and





Solution for OHS Web Server

1. Go to the mod_wl_ohs.conf file and add WLIOTimeoutSecs to the respective location where issue exists.

<LocationMatch ^/aif>

    SetHandler weblogic-handler

    WeblogicCluster SERVERNAME:6550

    WLIOTimeoutSecs 1800

</LocationMatch> .



These settings can be done at the time of setting up the environment as a preventive measure. Saves a downtime and loads of frustrated users. 

Read More

Improve Performance of slow running Business Rules - Hyperion Planning

Improve Performance of slow running Business Rule - Hyperion Planning

We had this client who complained that their rules take more than 8 minutes to run where it should have taken hardly 3 seconds. This was a vast difference. We were able to resolve this hurdle by doing the things below

1. Fine tune your rules. This is really important, make sure the rules are efficient. Since I am not from the Planning development side so I would know only little on this. An expert in writing rules will always craft efficient rules. 

2. Fine tune your environment: This makes a significant difference in the performance of the system.

Tune the Essbase Server , Hyperion Services - Planning, Shared Services, OHS, Windows System, Weblogic . Follow this guide -  Tuning Guide 11.1.2.X

3. Run Time Prompts (RTP) are a great help for more focused calculations. Planning validates the values entered. By default, the values for processed runtime prompts in the application are stored in the database and available for viewing from the Job Console (select Tools, then Job Console). If many users are running business rules with runtime prompts, tracking these values consumes significant system resources. To improve performance, you can turn off this function so Planning does not capture runtime prompt values. To do so, add the CAPTURE_RTP_ON_JOB_CONSOLE property to the properties table, with the property value of FALSE (to turn it back on again, change its value to TRUE). See more details here

Disabling this made the performance of the system super-fast. We were able to run the Business rules in less than 3 seconds. 

4. Use sample application: Using Sample Planning application will really be helpful in troubleshooting performance issue. I usually load the planning sample app and then test its performance against the system. If it works fine, I  know that the environment is not the one that needs further tuning but it is the application design , business rules that need a little makeup. 

5. It also depends on the network configuration of the environment. If the Essbase is in different Network zone from Planning, of course there would be lag. 

IPSec tables have caused slowness when applied between the server in the environment. 

QoS also caused slowness. Get the Network team to play around and tune down the network security to minimal limits between the server in a secure environment. 

Hope this helpful.

.

Read More