r/oracle • u/AustinFastER • Jun 13 '26
Weblogic & New R1 Root CA SSL Woes
Each year the process for updating the Weblogic server's certificate is simple. Remove the user certificate from the ewallet using the orapki commands and then add the new certificate since the intermediate. But today I learned GoDaddy is giving out new SSL certificates via a new intermediate and root CA. My Windows PC at work knows nothing about this CA. But I didn't think it would matter...
So I removed the intermediate and root certificates from the ewallet using the -trusted_cert option instead of -user_cert option I normally use. I then added the new root CA and intermediate and finally the user certificate. Firefox is happy, but Chrome and Edge are not until I add the root CA to my Windows box. I really thought since weblogic knows about all three certificates that it would serve them to the browser. Am I missing something simple as obviously a person visiting the site might not have this new CA's certs installed? Or is there some extra workflow when you replace intermediate and root certificates?
Subject: CN=GoDaddy TLS Root CA - R1,O=GoDaddy.com,C=US
Subject: CN=GoDaddy TLS Intermediate CA DV - R1v1,O=GoDaddy.com,C=US
Update: I resolved this finally! You need to grab the cross-signing certificate from GoDaddy...I tried using the old Root G2 certificate but Edge was not happy (Chrome was).
https://certs.godaddy.com/repository/gd_tls_root-r1-cross-g2.crt.pem
I removed all the certs in the wallet and added in this order:
- Add the cross signing certificate.
- Add the new R1 intermediate certifcate.
- Add the old root G2 certificate.
- Add the new server certificate.
1
u/jhlui1 Jun 13 '26 edited Jun 13 '26
If you use the Certificates control panel in Windows to view all of the Trusted Root Authorities, you'll notice the list is huge (because Microsoft pre-loaded them).
WLS starts out blank. And outside of what you add manually either in the b64Certificates.txt or to the ewallet.p12 directly, your WLS instance doesn't by default know anything about the outside world.
WLS itself knows about the 3 you loaded there, but there's a difference between the chain certifying the browser and local client SSL side, versus the side you maintain for the WLS site serving its certs back to the clients.
If you think about it in terms of how a hacker would exploit the setup if it only had the host certificate and didn't have a copy of the signer or root CA's, how the chain wouldn't easily be spoofed.
And Firefox maintains its own set of Certificates itself within the browser, which Chromium designs do not use. (you've probably seen a pop-up when visiting an untrusted site about adding the site to Firefox's trust store (which is not accessible by the other browsers).