topic Tomcat SSL Help Plz [Solved] in Alfresco Archive

Tomcat SSL Help Plz [Solved]

102020 — Tue, 26 Mar 2013 20:35:35 GMT

Greetz!So I've been working on getting my 3dp CA installed but coming into problems. I know a lot of people are using mod_jk and fronting with Apache, don't want to do that, seems really unnecessary.After looking at server.xml for tomcat, I see that Alfresco is using ssl.keystore and ssl.truststore.

Re: Tomcat SSL Help Plz [Solved]

102020 — Mon, 08 Apr 2013 18:50:00 GMT

Ok so here are the commands and such you need to do, we used StartCom SSL for our 3DP ssl.

keytool -genkey -alias myServer.FQDN.com -dname "cn=myServer.FQDN.com, o=FQDN, o=.com" -keystore c:\Alfresco\alf_data\keystore\keystore.jks -keysize 2048 -keyalg RSA

keytool -certreq -alias myServer.FQDN.com -file myServer.FQDN.com.csr

>Copy contents of csr, paste into startcom, generates crt, download crt. at same time download intermediate and root certs.

keytool -import -trustcacerts -alias startcom.ca -file c:\Alfresco\alf_data\keystore\ca.crt -keystore c:\Alfresco\java\jre\lib\security\cacerts

keytool -import -trustcacerts -alias startcom.ca.sub -file c:\Alfresco\alf_data\keystore\sub.class3.server.ca.crt -keystore c:\Alfresco\java\jre\lib\security\cacerts

>Restart Alfresco

keytool -importcert -alias myServer.FQDN.com -file c:\Alfresco\alf_data\keystore\myServer.FQDN.com.signed.crt -trustcacerts -keystore c:\Alfresco\alf_data\keystore\keystore.jks

>Edit c:\Alfresco\tomcat\conf\server.xml

Find:
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
               maxThreads="150" scheme="https" keystoreFile="C:\Alfresco/alf_data/keystore/ssl.keystore" keystorePass="kT9X6oe68t" keystoreType="JCEKS"
secure="true" connectionTimeout="240000" truststoreFile="C:\Alfresco/alf_data/keystore/ssl.truststore" truststorePass="kT9X6oe68t" truststoreType="JCEKS"
               clientAuth="false" sslProtocol="TLS" allowUnsafeLegacyRenegotiation="true" maxSavePostSize="-1" />

Replace:
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
               maxThreads="150" scheme="https" keystoreFile="C:\Alfresco/alf_data/keystore/keystore.jks" keystorePass="kT9X6oe68t" keystoreType="JKS"
secure="true" connectionTimeout="240000" clientAuth="false" sslProtocol="TLS" allowUnsafeLegacyRenegotiation="true" maxSavePostSize="-1" />

This will get SSL on port 8443 (or whatever you set your SSL port as) to be a fully signed certificate. You can also go into your alfresco-global.properties and add the following to use the same certificate for Share Point SSL over port 7070:

### Sharepoint ###
vti.server.external.host=myServer.FQDN.com
vti.server.external.port=7070
vti.server.external.protocol=https
vti.server.ssl.keystore=C:/Alfresco/keys/keystore.jks
vti.server.ssl.password=kT9X6oe68t

just a note: the vti.server.ssl.password value is the default keystore password.

Re: Tomcat SSL Help Plz [Solved]

eswbitto — Tue, 18 Jun 2013 21:05:21 GMT

I have followed your instructions and modified them accordingly to work on the OS that I'm using.

My topic is here: http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/integration-other-systems/integrating-0

I followed your instructions from here:
http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/installation-upgrades/howto-installconfig-3x

So I skipped over the first part and went down to the https part and followed the instructions for a self signed cer. I didn't do that above part where you add to the alfresco-global.properties file. I don't know if it is crucial to have that step or not. When I make the changes and restart alfresco I can't reach https://my.fqdn.addy:8443/share nor http://my.fqdn.addy:8080/share. Neither one works…in fact it breaks. I end up having to completely erase the whole install and re-install.
So I tried modifying the share-config-custom.xml like the original instructions said to do. That doesn't do anything either.

Is there any off chance you could point me in the right direction of what I need to do? Right now I'm working on using apache (httpd) to handle the ssl and not worry about the tomcat version that alfresco uses. I'd like not to do it that way, but I'm running out of options to try.

Bitto