topic Re: SSL via Apache2 Proxy and Tomcat6/Alfresco in Alfresco Archive

SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Mon, 05 Oct 2009 17:35:36 GMT

Hello,I am trying to use Apache2 to set up an SSL-connection with Alfresco. I have a reversed proxied Alfresco with Apache2 and SSL, but I get warnings that the connection isn't entirely encrypted. (Warning: Connection Partially Encrypted) Is there something I have to do on the Alfresco/Tomcat6 sid

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

gronfelt — Mon, 05 Oct 2009 17:55:31 GMT

What does the configuration look like?

Personally I prefer to use mod_jk when proxying Tomcat with Apache, it's very simple to setup and seems to be pretty failsafe:

http://tomcat.apache.org/connectors-doc/generic_howto/quick.html

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Mon, 05 Oct 2009 18:03:34 GMT

Hi gronfelt,

This is the current Apache2 SSL config running the reversed proxy.

<IfModule mod_ssl.c>
NameVirtualHost *:443

####
####       DOCS.DOMAIN.TLD         ####
####


<virtualhost *:443>
      ServerName docs.domain.tld
      ServerAlias alfresco.domain.tld
      ServerAdmin webmaster@domain.tld

### ### ### ### ### ###

      ### Start SSL
       SSLEngine On

   ### Certificates
      SSLCertificateFile /etc/apache2/ssl/star_domain_tld.crt
      SSLCertificateKeyFile /etc/apache2/ssl/star_domain_tld.key
      SSLCertificateChainFile /etc/apache2/ssl/DigiCertCA.crt

   ### Only allow SSLv3 and TLSv1 and HIGH/MED encryption.
      SSLCipherSuite -ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:+TLSv1:+SSLv3:-EXP:-eNULL
      SSLProtocol -all +SSLv3 +TLSv1

### ### ### ### ### ###

   #Dummy folder for virtual host   
       DocumentRoot /var/www/htdocs/docs.domain.tld/
    

   <directory /var/www/htdocs/docs.domain.tld/>
            Options -Indexes -FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            allow from all
   </directory>

       ErrorLog /var/log/apache2/docs.domain.tld_error.log

       # Possible values include: debug, info, notice, warn, error, crit,
       # alert, emerg.
       LogLevel warn

       CustomLog /var/log/apache2/docs.domain.tld_access.log combined

### Log to Syslog
LogLevel notice
ErrorLog syslog:local6 
#CustomLog "|/usr/bin/logger -t apache -i -p local6.notice" combined

ServerSignature Off

ProxyRequests Off

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyPass /share http://localhost:8080/share
ProxyPassReverse /share http://localhost:8080/share 
ProxyPass /alfresco http://localhost:8080/alfresco
ProxyPassReverse /alfresco http://localhost:8080/alfresco 

</virtualhost>
</IfModule>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Mon, 05 Oct 2009 18:09:50 GMT

What does the configuration look like?

Personally I prefer to use mod_jk when proxying Tomcat with Apache, it's very simple to setup and seems to be pretty failsafe:

http://tomcat.apache.org/connectors-doc/generic_howto/quick.html

Hi again gronfelt,

I am quite new to Tomcat6… Could you enlighten me on why you prefer mod_jk over ordinary apache proxying? Is it better speedwise, more secure, or just easier, etc… Thanks for sharing.

BTW, I am currently on Ubuntu 9.04 server. When running a2enmod I have module proxy_ajp available. Is that the same as mod_jk? Also, is it just Apache2 I have to configure (like with normal proxy) or do I have to configure Tomcat6 as well?

EDIT: proxy_ajp is not the same as mod_jk. apt-get install libapache2-mod-jk installed the correct Apache2 module… ops:

Regards,

Oblivian

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

gronfelt — Mon, 05 Oct 2009 19:02:30 GMT

Well, to a great extent it's probably just due to the fact that I started to use mod_jk and got used to that.

But as far as I understand using ajp is normally much faster than accessing tomcat through http, but wether you choose to use proxy_ajp/proxypass or mod_jk seems to be mostly a matter of taste.

Tomcat configuration is the same, regardless, the only thing you need to do is to uncomment the AJP connector in server.xml.

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Mon, 05 Oct 2009 19:30:56 GMT

Hi gronfelt,

I have now set up Apache2 to use mod_jk and it works perfectly with Alfresco/Tomcat6. All traffic is now sent correctly over SSL and so no more warnings.

Thanks for all your help.

Oblivian

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

unknown-user — Sun, 11 Oct 2009 23:04:01 GMT

I have Alfresco working with SSL, however in IE8 I keep getting a security warning that pops up on every single page telling me that some of the pages are non-secure. This is true, there is one hardcoded Alfresco call to http://www.alfresco.com/assets/images/common/alfresco_community_horiz30.gif

This one http call are the only one that's not transferred into a https page. After reading the following I tried to upgrade to the latest Alfresco build without luck. https://issues.alfresco.com/jira/browse/ETHREEOH-2331

Do you have this also? Did any manage to get this to work? :cry:

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Sun, 11 Oct 2009 23:19:09 GMT

I use to have the same problem when running Alfresco with Apache reverse proxy over SSL. When using mod_jk instead, all problems vanished.

I recommend you do the same.

Regards.

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

unknown-user — Mon, 12 Oct 2009 06:45:22 GMT

I use to have the same problem when running Alfresco with Apache reverse proxy over SSL. When using mod_jk instead, all problems vanished.

I recommend you do the same.

Regards.

That sounds really good

Could you post your configuration files, that would help me alot. You are right, I was running reverse proxy over SSL but after reading this page I tried to change to mod_jk, apparently without any luck ops:

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Mon, 12 Oct 2009 19:16:56 GMT

Hi,

Sorry for late reply. Did you manage or do you want me to post my configs?

Oblivian

PS. What platform are you on? I'm on Ubuntu 9.04.

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

unknown-user — Mon, 12 Oct 2009 20:08:39 GMT

Right now its not working, so I would be very happy to take a deep look at your config files (apache and tomcat server.xml)

I am running on a Debian 5 server.

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

oblivian — Mon, 12 Oct 2009 21:18:07 GMT

OK, here goes.

Make sure mod_jk is installed and enabled in Apache2.

Add the following at the bottom of the main Apache2 config file. (apache2.conf)

JkWorkersFile /etc/apache2/workers.properties

# Where to put jk logs
JkLogFile /var/log/apache2/mod_jk.log

# Set the jk log level [debug/error/info]
JkLogLevel info

# Select the log format
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "

# JkOptions indicate to send SSL KEY SIZE,
JkOptions +ForwardKeySize -ForwardDirectories

# JkRequestLogFormat set the request format
JkRequestLogFormat "%w %V %T"

# Send servlet for context /alfresco to your repository
JkMount /share worker1
JkMount /alfresco worker1

# Send JSPs for context /alfresco/* to your repository
JkMount /share/* worker1
JkMount /alfresco/* worker1
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Create a new file: /etc/apache2/worker.properties and enter the following. (Make neccesary adjustments to the java_home and tomcat_home)

workers.tomcat_home=/usr/share/tomcat6
workers.java_home=/usr/lib/jvm/java-6-sun-1.6.0.16
ps=/
worker.list=worker1

worker.default.port=8009
worker.default.host=localhost
worker.default.type=ajp13
worker.default.lbfactor=1‍‍‍‍‍‍‍‍‍

Add the following to server.xml (On Ubuntu 9.04 /etc/tomcat6/server.xml)
Add the following lines

<!– Define an AJP 1.3 Connector on port 8009 –>
    <Connector port="8009"
               enableLookups="false" redirectPort="8442" protocol="AJP/1.3" URIEncoding="UTF-8" />‍‍‍

NB. Add the above lines just before the following lines: (Around line 70).
<Connector port="8080" protocol="HTTP/1.1" URIEncoding="UTF-8"
connectionTimeout="20000"
redirectPort="8443" />

Add the following lines to the Apache2 SSL-enabled virtual server: (Just before the the virtualhost close tag) </virtualhost>

JkMountCopy On
JkMount /alfresco worker1
JkMount /alfresco/* worker1
JkMount /share worker1
JkMount /share/* worker1
‍‍‍‍‍‍

And that should be it.

Good luck!

PS. You have to restart both Apache2 and Tomcat6 too se the changes of course…

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

unknown-user — Mon, 12 Oct 2009 23:31:12 GMT

Beautiful, so simple and jet so complicated… Its working, thank you very much

Re: SSL via Apache2 Proxy and Tomcat6/Alfresco

gopei — Fri, 16 May 2014 04:23:15 GMT

excuse me oblivian,… where is path directory & what file i have to change it ???

"….Add the following lines to the Apache2 SSL-enabled virtual server: (Just before the the virtualhost close tag)…."

thanks