Skip to content

Commit

Permalink
Merge branch 'rmarano/hide-14120-info' into 'main'
Browse files Browse the repository at this point in the history
Remove refs to 141200

See merge request weblogic-cloud/weblogic-kubernetes-operator!4697

(cherry picked from commit 88f525c)

bd51e48 Remove refs to 141200
  • Loading branch information
rjeberhard committed May 9, 2024
1 parent e06b7ef commit fda7c90
Show file tree
Hide file tree
Showing 3 changed files with 2 additions and 41 deletions.
Expand Up @@ -2,6 +2,7 @@
title = "Upgrade managed domains to v14.1.2.0"
date = 2023-10-05T16:43:45-05:00
weight = 7
draft = true
pre = "<b> </b>"
description = "Upgrade managed domains to v14.1.2.0."
+++
Expand Down Expand Up @@ -443,7 +444,7 @@ serverPod:

### Sample WDT model for secured production mode and SSL

If you are upgrading an existing domain to 14.1.2.0 and your existing domain does not have secured production mode enabled, the operator, by default, will _disable_ secured production mode. If you want to override this behavior, you must enable it explicitly. Optionally, you can delete the existing domain and let the operator completely rebuild the domain and, by default, secured production mode will be enabled; you do not have to enable it explicitly.
If you are upgrading an existing domain to 14.1.2.0 and your existing domain does not have secured production mode enabled, the operator, by default, will _disable_ secured production mode. If you want to override this behavior, you must enable it explicitly. Optionally, you can delete the existing domain and let the operator completely rebuild the domain and, by default, secured production mode will be enabled; you do not have to enable it explicitly.

The following is a code snippet of a WDT model for setting up secured production mode and SSL.

Expand Down
Expand Up @@ -52,44 +52,6 @@ When you deploy a Model in Image domain resource YAML file:
- The operator subsequently boots your domain's WebLogic Server pods.
- The pods will obtain their domain home from the ConfigMap.

### Using demo SSL certificates in v14.1.2.0.0 or later

{{% notice note %}}
Beginning with WebLogic Server version 14.1.2.0.0, when a domain is `production` mode enabled, it is automatically `secure mode` enabled, therefore, all communications with the domain are using SSL channels and non-secure listening ports are disabled. If there are no custom certificates configured for the SSL channels, then the server uses the demo SSL certificates.
The demo SSL certificates are now domain specific and generated when the domain is first created,
unlike previous releases, which were distributed with the WebLogic product installation. Oracle recommends using custom SSL
certificates in a production environment.
{{% /notice %}}

The certificates are created under the domain home `security` folder.

```
-rw-r----- 1 oracle oracle 1275 Feb 15 15:55 democakey.der
-rw-r----- 1 oracle oracle 1070 Feb 15 15:55 democacert.der
-rw-r----- 1 oracle oracle 1478 Feb 15 15:55 DemoTrust.p12
-rw-r----- 1 oracle oracle 1267 Feb 15 15:55 demokey.der
-rw-r----- 1 oracle oracle 1099 Feb 15 15:55 democert.der
-rw-r----- 1 oracle oracle 1144 Feb 15 15:55 DemoCerts.props
-rw-r----- 1 oracle oracle 2948 Feb 15 15:55 DemoIdentity.p12
```

For Model in Image domains, whenever you change any security credentials including, but not limited to, the Administration Server credentials, RCU credentials, and such, the domain will be recreated and a new set of demo SSL certificates will be generated. The SSL certificates are valid for 6 months, then they expire.

The demo CA certificate expires in 5 years, however, whenever the domain is recreated, the entire set of certificates are regenerated so you _must_ import the demo CA certificate again.

If you have any external client that needs to communicate with WebLogic Servers using SSL, then you need to import the current self-signing CA certificate, `democacert.der`,
into your local trust store.

```shell
keytool -importcert -keystore <keystore path> -alias wlscacert -file $HOME/Downloads/democacer.der
```

If you are using the WebLogic Scripting Tool, before starting the WLST session, you can set the following system properties.

```shell
export WLST_PROPERTIES="-Dweblogic.security.TrustKeyStore=DemoTrust -Dweblogic.security.SSL.ignoreHostnameVerification=true"
```

### Runtime updates

Model updates can be applied at runtime by changing an image, secrets, a domain resource, or a WDT model ConfigMap after initial deployment.
Expand Down
Expand Up @@ -42,8 +42,6 @@ the change requires entirely shutting domain the domain,
applying the change, and finally restarting the domain. Full domain restarts are described in
[Full domain restarts]({{< relref "/managing-domains/domain-lifecycle/startup/_index.md#full-domain-restarts">}}).

**NOTE**: If you are using WebLogic Server 14.1.2.0.0 or later, see [Using demo SSL certificates in v14.1.2.0.0 or later]({{< relref "/managing-domains/model-in-image/overview#using-demo-ssl-certificates-in-v141200-or-later" >}}).

**NOTE**: Supported and unsupported changes are described in these sections: [Supported updates](#supported-updates) and [Unsupported updates](#unsupported-updates).
_It is the administrator's responsibility to make the necessary changes to a domain resource to initiate the correct approach for an update._

Expand Down

0 comments on commit fda7c90

Please sign in to comment.