topic Re: Replacing self-signed certificates with Zentyal-generated certificates in Alfresco Archive

Replacing self-signed certificates with Zentyal-generated certificates

dfliddle — Thu, 07 Feb 2013 13:49:21 GMT

In order to provide our staff with a consistent experience with each of the servers we run, I'm replacing self-signed certificates with those issued by our Zentyal server, which is acting as the CA. I haven't found entries in either this forum or Zentyal's that deal with this particular topic thorou

Re: Replacing self-signed certificates with Zentyal-generated certificates

heiko_robert — Thu, 07 Feb 2013 15:55:23 GMT

Hi David,

I would recommend not to go this way. Instead you should configure an apache in front of tomcat. This is best practice for all our installations and much, much more easy to handle. As a side effect you can harden Alfresco, create redirects and open just the URLs and requests using apache config. Tomcat should be configured to talk only to apache and SOLR.
Anyway you should create new certificates to prevent that everyone can read your content with the default certs who has access to tomcat. For this Alfresco allready provides scripts not to make any mistakes.
Of course you can use commercial certs for the tomcat ssl connector but as long you don't understand the complexity in alfresco/SOLR communication and if you're not very familiar with openssl and keystore mechanisms you shouldn't touch this. Otherwise it is very likely that at least your SOLR search will not work any more. So don't go the trappy way if there is an easy and robust one.

Re: Replacing self-signed certificates with Zentyal-generated certificates

dfliddle — Wed, 13 Feb 2013 13:58:18 GMT

Thank you for the reply, Heiko. I have seen many such recommendations for the Apache reverse proxy server, and using this technique could help simplify other services that we run. Do you know if it can handle the Alfresco IMAP component also? I have read of others attempting IMAP funneling with that and Nginx, but it's not always easy to tell how successful or satisfied they were.