topic Re: Use SSL with Sharepoint protocol in Alfresco Archive

Use SSL with Sharepoint protocol

pacco_robin — Mon, 28 Apr 2014 11:48:17 GMT

Hi,I followed some instructions to run the Sharepoint protcol with SSL on port 7070.First changed vti-context.xml to use SSL, then added this to vti.properties:vti.server.port=7070vti.server.protocol=httpsvti.server.ssl.keystore=/opt/alfresco-4.2.f/alf_data/keystore/ssl.keystorevti.server.ssl.passwo

Re: Use SSL with Sharepoint protocol

eswbitto — Tue, 29 Apr 2014 15:55:55 GMT

Take a look at this thread HERE

Re: Use SSL with Sharepoint protocol

pacco_robin — Thu, 01 May 2014 13:49:00 GMT

That didn't work.
I get errors from Apache that RequestHeader is misspelled.

I am using Apache and mod_jk.

HTTPS for Alfresco is working fine and certificate looks ok.

This is my config in 000-default.conf:
<VirtualHost *:443>
 ServerName x.y.com
 SSLEngine On
 SSLCertificateFile /etc/ssl/certs/certificate.crt
 SSLCertificateKeyFile /etc/ssl/private/key.key
 SSLCertificateChainFile /etc/ssl/certs/AddTrustExternalCARoot.crt
 SSLCertificateChainFile /etc/ssl/certs/PositiveSSLCA2.crt
 <Location />
 SSLRequireSSL On
 SSLVerifyClient optional
 SSLRenegBufferSize 104860000
 SSLVerifyDepth 1
 SSLOptions +StdEnvVars +StrictRequire
 </Location>
 # Send everything for the context / to worker named worker1 via ajp13
 JkMount /* ajp13_worker
</VirtualHost>

Regards,

Frank

Re: Use SSL with Sharepoint protocol

eswbitto — Fri, 02 May 2014 15:50:00 GMT

You should be able to use sharepoint/webdav with the SSL working. What distro are you using? Also, What does your virtual host look like? Did you make sure to add the Listen (port) in your ssl.conf?

Re: Use SSL with Sharepoint protocol

pacco_robin — Tue, 06 May 2014 14:35:00 GMT

We use Ubuntu 12.04LTS.
I followed these steps: https://forums.alfresco.com/comment/145306#comment-145306
When I add the virtual host VirtualHost *:1111 I get the Apache errors.
You can check my virtual host in my previous reply.

Kind regards,
Frank

Re: Use SSL with Sharepoint protocol

eswbitto — Tue, 06 May 2014 16:11:26 GMT

The logs that you initially posted won't point to a particular issue for this connection problem. I get the same logs and I have SSL working. I think it is part of a different issue. What does your apache logs say when trying to connect?

Question: Did you actually use the port 1111 as in the example or the default?

Re: Use SSL with Sharepoint protocol

pacco_robin — Thu, 08 May 2014 11:15:22 GMT

<body>
I retried with a new approach! Let me explain the steps I take.
Previously I installed Apache, mod_jk and mod_ssl to make SSL work with Alfresco. 
This is explained here: http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/configuration/change-alfresco-use-ssl-and
These setup works perfectly. I can connect to https://alfrescoserver.ourdomain.com and I can see my third party certificate.
Now I wanted to setup this certificate for Sharepoint communication.
1. I opened port 1111 in ufw. 
sudo ufw allow 1111 
I get some warnings: 
WARN: Duplicate profile 'Apache', using last found 
WARN: Duplicate profile 'Apache Secure', using last found 
WARN: Duplicate profile 'Apache Full', using last found 
Rule added 
Rule added (v6) 
But when I check the status, port 1111 is added.
2. I change the vti.properties at this location: /opt/alfresco-4.2.f/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/module/org.alfresco.module.vti/context
Here I have: 
vti.server.port=7070 
vti.server.protocol=https 
vti.server.ssl.keystore=/opt/alfresco-4.2.f/alf_data/keystore/ssl.keystore 
vti.server.ssl.password=kT9X6oe68t 
vti.server.url.path.prefix=/alfresco 
vti.server.external.host=alfrescoserver.ourdomain.com 
vti.server.external.port=7070 
vti.server.external.protocol=https 
vti.server.external.contextPath=/alfresco
I changed this: 
vti.server.external.host=alfrescoserver.ourdomain.com 
vti.server.external.port=1111 
vti.server.external.protocol=https
3. I added virtualhost *:1111 in 000-default.conf at this location: /etc/apache2/sites-available
<VirtualHost *:1111> 
ServerName alfrescoserver.ourdomain.com 
SSLEngine On 
SSLCertificateFile /etc/ssl/certs/alfrescoserver.ourdomain.com.crt 
SSLCertificateKeyFile /etc/ssl/private/alfrescoserver.ourdomain.com.key 
SSLCertificateChainFile /etc/ssl/certs/AddTrustExternalCARoot.crt 
SSLCertificateChainFile /etc/ssl/certs/PositiveSSLCA2.crt 
<Location /> 
SSLRequireSSL On 
SSLVerifyClient optional 
SSLRenegBufferSize 104860000 
SSLVerifyDepth 1 
SSLOptions +StdEnvVars +StrictRequire 
</Location> 
# Send everything for the context / to worker named worker1 via ajp13 
JkMount /* ajp13_worker 
</VirtualHost>
VirtualHost *:1111 now looks exactly the same as VirtualHost *:443
4. I changed vti-context.xml at this location: /opt/alfresco-4.2.f/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/module/org.alfresco.module.vti/context
 <!– Use this Connector for plain text (non-SSL) communications –> 
<!– 
<bean id="vtiServerConnector" class="org.mortbay.jetty.bio.SocketConnector"> 
<property name="port"> 
<value>${vti.server.port}</value> 
</property> 
<property name="headerBufferSize"> 
<value>32768</value> 
</property> 
</bean> 
–>
 <!– Use this Connector instead for SSL communications –> 
<!– You will need to set the location of the KeyStore holding your –> 
<!– server certificate, along with the KeyStore password –> 
<!– You should also update the vti.server.protocol property to https –>
 <bean id="vtiServerConnector" class="org.mortbay.jetty.security.SslSocketConnector"> 
<property name="port"> 
<value>${vti.server.port}</value> 
</property> 
<property name="headerBufferSize"> 
<value>32768</value> 
</property> 
<property name="maxIdleTime"> 
<value>30000</value> 
</property> 
<property name="keystore"> 
<value>${vti.server.ssl.keystore}</value> 
</property> 
<property name="keyPassword"> 
<value>${vti.server.ssl.password}</value> 
</property> 
<property name="password"> 
<value>${vti.server.ssl.password}</value> 
</property> 
<property name="keystoreType"> 
<value>JCEKS</value> 
</property> 
</bean>
I commented out non-SSL communication and uncommented SSL communication.
5. I changed ports.conf at this location: /etc/apache2
<IfModule ssl_module> 
Listen 443 
Listen 1111 
</IfModule>
<IfModule mod_gnutls.c> 
Listen 443 
Listen 1111 
</IfModule>
6. I restarted the Alfresco server
When I try to edit a document online Word starts up, but I only see a message about Word contacting the server and then Word opens without any document.
</body>

Re: Use SSL with Sharepoint protocol

pacco_robin — Thu, 08 May 2014 11:38:09 GMT

<body>
When I put in this virtualhost I get this error trying to restart Apache. 
 
<VirtualHost *:1111> 
ServerName alfrescoserver.ourdomain.com 
SSLEngine On 
SSLCertificateFile /etc/ssl/certs/alfrescoserver.ourdomain.com.crt 
SSLCertificateKeyFile /etc/ssl/private/alfrescoserver.ourdomain.com.key 
SSLCertificateChainFile /etc/ssl/certs/AddTrustExternalCARoot.crt 
SSLCertificateChainFile /etc/ssl/certs/PositiveSSLCA2.crt 
RequestHeader set X-Forwarded-Proto "https" 
ProxyPass / ajp://127.0.0.1:7070/ 
ProxyPassReverse / ajp:127.0.0.1:7070/ 
ProxyTimeout 300 
SSLProxyEngine on
 <Proxy *> 
Allow from all 
</Proxy> 
</VirtualHost>
 Error is: 
 
* Starting web server apache2 * 
* The apache2 configtest failed. 
Output of config test was: 
AH00526: Syntax error on line 69 of /etc/apache2/sites-enabled/000-default.conf: 
Invalid command 'RequestHeader', perhaps misspelled or defined by a module not i ncluded in the server configuration 
Action 'configtest' failed. 
The Apache error log may have more information. 
 
There is no information in the error log.
 

</body>

Re: Use SSL with Sharepoint protocol

eswbitto — Thu, 08 May 2014 16:25:04 GMT

DO you have this as a module to load in your apache config?


headers_module modules/mod_headers.so
‍‍‍

It sounds like you don't have the module installed.

Also your vti-context.xml file should look like this.


<!–
    <bean id="vtiServerConnector" class="org.mortbay.jetty.bio.SocketConnector">
        <property name="port">
             <value>${vti.server.port}</value>
        </property>
        <property name="headerBufferSize">
             <value>32768</value>
        </property>
    </bean>
–>

    <bean id="vtiServerConnector" class="org.mortbay.jetty.ajp.Ajp13SocketConnector">
        <property name="port">
             <value>${vti.server.port}</value>
        </property>
        <property name="headerBufferSize">
             <value>8192</value>
        </property>
    </bean>



    <!– Use this Connector instead for SSL communications –>
    <!– You will need to set the location of the KeyStore holding your –>
    <!–  server certificate, along with the KeyStore password –>
    <!– You should also update the vti.server.protocol property to https –>
<!–
    <bean id="vtiServerConnector" class="org.mortbay.jetty.security.SslSocketConnector">
        <property name="port">
             <value>${vti.server.port}</value>
        </property>
        <property name="headerBufferSize">
             <value>32768</value>
        </property>
        <property name="maxIdleTime">
             <value>30000</value>
        </property>
        <property name="keystore">
             <value>${vti.server.ssl.keystore}</value>
        </property>
        <property name="keyPassword">
             <value>${vti.server.ssl.password}</value>
        </property>
        <property name="password">
             <value>${vti.server.ssl.password}</value>
        </property>
        <property name="keystoreType">
             <value>JCEKS</value>
        </property>
    </bean> 
–>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Yes the second SSL snippet that comes with Alfresco is commented out.

Re: Use SSL with Sharepoint protocol

pacco_robin — Tue, 13 May 2014 08:39:35 GMT

I added headers_module modules/mod_headers.so to httpd.conf. Apache told me module was already there.
I changed vti-context.xml to your settings.
Realized that I didn't download jetty-ajp-6.1.14.jar. So I did.
For the Apache errors I enabled mod proxy_http.

Alfresco now starts perfectly without errors.

But when I try to edit a Word or Excel file online Office warns me that the file at port 1111 can be harmful. Then Word or Excel starts and finally I get a message that the file (https://servername.domain.com:1111/path_to_file/file) cannot be opened.

This is driving me nuts!!!

When I look at your explanation in the other post I skipped creating the tomcat connector. I already enabled SSL through mod_jk. I suppose the worker is also defined (if I look at my virtualhost:443).
Added virtualhost:1111 the way you explained.

No errors in catalina.out and this is what I find in the Apache error log:
[Tue May 13 10:34:11.276856 2014] [ssl:error] [pid 2849:tid 139913534048000] [client 10.0.1.111:17642] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesStore/f0ad09c0-be24-4731-8ee4-585b21836456
[Tue May 13 10:34:11.430631 2014] [ssl:error] [pid 2849:tid 139913458513664] [client 10.0.1.111:17644] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesStore/f0ad09c0-be24-4731-8ee4-585b21836456
[Tue May 13 10:34:11.434038 2014] [ssl:error] [pid 2849:tid 139913542440704] [client 10.0.1.111:17645] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesStore/f0ad09c0-be24-4731-8ee4-585b21836456
[Tue May 13 10:34:11.436806 2014] [ssl:error] [pid 2849:tid 139913617975040] [client 10.0.1.111:17647] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesStore/f0ad09c0-be24-4731-8ee4-585b21836456
[Tue May 13 10:34:11.461485 2014] [ssl:error] [pid 2849:tid 139913626367744] [client 10.0.1.111:17646] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesStore/f0ad09c0-be24-4731-8ee4-585b21836456
[Tue May 13 10:34:14.559882 2014] [proxy:warn] [pid 2849:tid 139913643153152] [client 10.0.1.111:17654] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/documentLibrary/. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.
[Tue May 13 10:34:16.924618 2014] [proxy:warn] [pid 2849:tid 139913601189632] [client 10.0.1.111:17655] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/documentLibrary/Zandbak.docx. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.
[Tue May 13 10:34:16.952391 2014] [proxy:warn] [pid 2849:tid 139913559226112] [client 10.0.1.111:17656] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.
[Tue May 13 10:34:17.053874 2014] [proxy:warn] [pid 2849:tid 139913576011520] [client 10.0.1.111:17657] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/documentLibrary/Zandbak.docx. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.

Re: Use SSL with Sharepoint protocol

pacco_robin — Tue, 13 May 2014 08:41:11 GMT

Re: Use SSL with Sharepoint protocol

eswbitto — Tue, 13 May 2014 20:54:00 GMT

Do you have a firewall that maybe blocking the connection?

Also, I only used 1111 as the port number as an example; for my actual production I used a port number in the 7000 range. I'm not sure if that would have any bearing on it or not, but it could be worth a try. I also get the "this file might be harmful" blah blah blah…which we live with.

Another thing you can try is to upload a fresh document to Alfresco and then try online editing which should open up your office product.

**Edit**
I asked around on this and a suggestion was to install a2enmod headers and make sure they are enabled.