Knowledge Base

How to Install and Bind an SSL Certificate on Oracle WebLogic Server 15.1.1

Updated on August 14, 2026

Overview

By the end of this article, the WebLogic AdminServer will present a trusted, publicly issued SSL certificate on an HTTPS listen port, and administrators will be able to reach the console securely. The article works through three stages.

First, it covers keystore preparation on the WebLogic host: creating the keystore directory, generating a keypair and a Certificate Signing Request (CSR) with the Java keytool utility, submitting that request to a public Certificate Authority (CA), importing the returned certificates, and verifying the resulting Java KeyStore (JKS) file.

Second, it covers configuration in WebLogic Remote Console: pointing the AdminServer at the custom identity and trust keystores, selecting the server private key alias, enabling the SSL listen port, and committing the changes.

Finally, it covers restarting the AdminServer, verifying the certificate chain over HTTPS, and resolving the most common failures.

Prerequisites

Before you begin, confirm that you have the following:

Oracle WebLogic Server 15.1.1 installed and running.
WebLogic Remote Console 2.4.19 connected to the AdminServer over HTTP on port 7001.
The AdminServer running successfully.
The Java keytool utility and OpenSSL available on the WebLogic host.
Write access to the domain directory on the WebLogic host, and the keystore and private key passwords you intend to set.

Part 1 — Prepare the keystore on the WebLogic host

Step 1: Create the keystore directory

Create a dedicated directory on the WebLogic host to hold the keystore file, so it is kept separate from the domain configuration files. Adjust the path to match your own domain location.

keystores

Step 2: Generate the keypair and Certificate Signing Request (CSR)

A Certificate Signing Request (CSR) is the encoded request file that a Certificate Authority (CA) uses to issue your certificate. Run both commands below from the keystore directory created in Step 1. The first command creates the private key and its Java KeyStore (JKS) container; the second exports the request file you will submit for issuance.

keytool -genkeypair -alias weblogic_ssl -keyalg RSA -keysize 2048 \
  -keystore identity.jks -storetype JKS \
  -dname "CN=your.fqdn.example, OU=IT, O=Company, L=City, ST=State, C=US" \
  -ext SAN=dns:your.fqdn.example,ip:SERVER_IP

keytool -certreq -alias weblogic_ssl -keystore identity.jks -file weblogic.csr

Replace the placeholder values before running the commands:

Placeholder	Meaning
weblogic_ssl	Alias that identifies the key entry inside the keystore. Reused in Step 7.
CN=your.fqdn.example	Common Name (CN) — the Fully Qualified Domain Name (FQDN) clients will use to reach the AdminServer.
OU, O, L, ST, C	Organizational Unit, Organization, Locality, State, and Country of the requesting organization.
SAN=dns:...,ip:SERVER_IP	Subject Alternative Name (SAN) entries — the Domain Name System (DNS) name and, where required, the IP address of the server.

The private key is generated inside identity.jks and never leaves the host. Protect the keystore file and its passwords, because the certificate cannot be used without the matching private key.

Step 3: Submit the Certificate Signing Request (CSR) to a public Certificate Authority (CA)

Submit the file weblogic.csr created in Step 2 to your public Certificate Authority (CA) and request a TLS server certificate. Complete any validation the Certificate Authority requires. Once issued, download the server certificate together with the intermediate and root certificates that form the chain.

Step 4: Import the Certificate Authority (CA) certificates and the server certificate

Import the certificates into identity.jks in the order below. Importing out of order breaks the chain, because each certificate must be able to validate against the one above it.

Root Certificate Authority (CA) certificate: keytool -importcert -trustcacerts -alias root_ca -file root.crt -keystore identity.jks
Intermediate Certificate Authority (CA) certificate: keytool -importcert -trustcacerts -alias intermediate_ca -file intermediate.crt -keystore identity.jks
Issued server certificate, imported against the original alias so it pairs with the private key created in Step 2: keytool -importcert -trustcacerts -alias weblogic_ssl -file server.crt -keystore identity.jks

Step 5: Verify the Java KeyStore (JKS) contents

Before configuring WebLogic, confirm the keystore holds a complete, usable key entry:

keytool -list -v -keystore identity.jks

Check that the alias weblogic_ssl is listed with the type PrivateKeyEntry and shows a full certificate chain — server certificate, intermediate, and root. If the alias shows as trustedCertEntry instead, the server certificate was imported under the wrong alias; repeat Step 4, item 3.

Part 2 — Configure the AdminServer in WebLogic Remote Console

Step 6: Point the AdminServer at the custom keystores

WebLogic Remote Console is the browser-based administration interface for the WebLogic domain. In the console, navigate to Edit Tree → Environment → Servers → AdminServer → Security → Keystores, then set the following values and click Save.

Setting	Value
Keystores	Custom Identity and Custom Trust
Custom Identity Key Store File Name	identity.jks
Custom Identity Key Store Type	JKS
Custom Identity Key Store Pass Phrase	The keystore password you set in Step 2
Custom Trust Key Store File Name	identity.jks
Custom Trust Key Store Type	JKS
Custom Trust Key Store Pass Phrase	The keystore password you set in Step 2

Figure 1: WebLogic Remote Console Keystores page for AdminServer with Custom Identity and Custom Trust selected

Step 7: Select the server private key alias

Navigate to Edit Tree → Environment → Servers → AdminServer → Security → SSL. This page tells the AdminServer which key entry inside the identity keystore to present to clients. Set the values below and click Save.

Setting	Value
Server Private Key Alias	weblogic_ssl
Server Private Key Pass Phrase	The private key password you set in Step 2

Figure 2: WebLogic Remote Console SSL page for AdminServer with the server private key alias field

Step 8: Enable the HTTPS listen port

Navigate to AdminServer → General, enable SSL Listen Port Enabled, set the port to 7002, and click Save. This is the port on which the AdminServer will accept HTTPS connections.

Figure 3: WebLogic Remote Console General page for AdminServer with SSL Listen Port Enabled set to 7002

Step 9: Commit the changes and restart the AdminServer

Open the Shopping Cart, which holds the pending configuration changes, and select Commit Changes.
Restart the AdminServer using startWebLogic.sh so the new keystore configuration and SSL listen port take effect.

Figure 4: WebLogic Remote Console Shopping Cart with pending configuration changes ready to commit

Before publishing, check all four screenshots for real server hostnames, domain paths, IP addresses, keystore file paths, and any visible passphrase field, and mask anything that identifies a real server or environment.

How to Verify Success

Open https://your.fqdn.example:7002 in a browser and confirm the console loads with no certificate warning.
View the certificate details in the browser and confirm the Common Name (CN) or a Subject Alternative Name (SAN) entry matches the address you used.
Confirm the full chain is presented — server certificate, intermediate Certificate Authority (CA), and root Certificate Authority (CA) — and that the issuer is your public Certificate Authority, not a self-signed demonstration certificate.
Check the AdminServer start-up log for SSL initialization errors before treating the installation as complete.

Troubleshooting

Issue: The browser reports an untrusted or incomplete certificate chain.
Cause: The intermediate Certificate Authority (CA) certificate was not imported, or the certificates were imported in the wrong order.
Solution: Run keytool -list -v -keystore identity.jks and confirm the weblogic_ssl alias shows the full chain. If it does not, repeat Step 4 in the documented order — root, then intermediate, then server certificate.

Issue: The AdminServer still presents the default demonstration certificate after restart.
Cause: The keystore configuration was staged but never committed, or the Server Private Key Alias does not match the alias in the keystore.
Solution: Confirm the Shopping Cart changes were committed in Step 9, verify the alias in Step 7 is weblogic_ssl, and restart the AdminServer again.

Issue: The AdminServer fails to start after the keystore is configured, with a keystore or password error in the log.
Cause: An incorrect keystore pass phrase or private key pass phrase, or an incorrect keystore file path.
Solution: Re-enter both pass phrases in Step 6 and Step 7, and confirm the file path matches the location created in Step 1.

Issue: Port 7002 does not respond.
Cause: The SSL listen port was not enabled, or the port is blocked by a host or network firewall.
Solution: Confirm SSL Listen Port Enabled is set in Step 8, then confirm port 7002 is open on the WebLogic host.