topic Can not save account after SSL configuration in Alfresco Archive

Can not save account after SSL configuration

alexjm — Thu, 07 Jul 2016 16:12:55 GMT

Hi, I have two question for it.Question 1:In the beginning, I installed Alfresco community 5.1 on CentOS 7, non-SSL. Tested Mobile(IOS) Apps connect to Server was fine. Mobile version is 2.3.Then, I builded up Alfresco + Apache, configured SSL with the StartSSL certificate(free mode,1 year), and tes

Re: Can not save account after SSL configuration

alexjm — Fri, 08 Jul 2016 05:33:00 GMT

I have followed this but not works:
https://forums.alfresco.com/comment/149481#comment-149481

chage server.xml of tomcat to this:
<Connector port="8080" URIEncoding="UTF-8" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" scheme="https" proxyName="external.prox.host.name" proxyPort="443" maxHttpHeaderSize="32768" />

<Connector port="8009" URIEncoding="UTF-8" protocol="AJP/1.3" redirectPort="8443" />

<Connector port="8443" URIEncoding="UTF-8" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
               maxThreads="150" scheme="https" keystoreFile="/home/alfresco-community/alf_data/keystore/ssl.keystore" keystorePass="xxxxxxxxx" keystoreType="JCEKS"
secure="true" connectionTimeout="240000" truststoreFile="/home/alfresco-community/alf_data/keystore/ssl.truststore" truststorePass="xxxxxxxxx" truststoreType="JCEKS"
               clientAuth="want" sslProtocol="TLS" allowUnsafeLegacyRenegotiation="true" maxHttpHeaderSize="32768" maxSavePostSize="-1" />

and my alfresco-global.properties configuration:

alfresco.context=alfresco
alfresco.host=external.prox.host.name
alfresco.port=443
alfresco.protocol=https
share.context=share
share.host=external.prox.host.name
share.port=443
share.protocol=https
opencmis.context.override=true
opencmis.context.value=
opencmis.servletpath.override=true
opencmis.servletpath.value=
opencmis.server.override=true
opencmis.server.value=https://external.prox.host.name

But now, same error persists!
Is there anything else should be modified ?

Thanks!

Alex

Re: Can not save account after SSL configuration

alexjm — Fri, 08 Jul 2016 10:19:15 GMT

Hi!

I come back again. Progress has been made

I found some errors in the ssl_error_log of apache. Like this:
"File does not exist: /usr/local/apache2/htdocs/alfresco/service/api/server"
Look like something is wrong in "httpd.conf"
I followed "http://docs.alfresco.com/community/tasks/configure-ssl-prod.html" to configure httpd.conf, and it un-comment these lines for public API access
   " # JkMount /alfresco/api/*/public/cmis/versions/* alfresco-worker
    # JkMount /alfresco/api/*/public/alfresco/versions/* alfresco-worker
    # JkMount /alfresco/service/api/server alfresco-worker
    # JkMount /alfresco/cmisatom/* alfresco-worker
    # JkMount /alfresco/service/cmis/* alfresco-worker
    # JkMount /alfresco/api/cmis/versions/* alfresco-worker "

I didn't noticed it before.
So I chage all "JkMount"s to "JkMount /* alfresco-worker". Now, below are my "httpd.conf" configuration:
<javascript>
ServerName external.proxy.host.name
PidFile     /usr/local/apache2/logs/httpd.pid
ErrorLog    /usr/local/apache2/logs/error_log
LogLevel    info

LoadModule unixd_module       /usr/local/apache2/modules/mod_unixd.so
LoadModule authn_core_module /usr/local/apache2/modules/mod_authn_core.so
LoadModule authz_host_module /usr/local/apache2/modules/mod_authz_host.so
LoadModule authz_core_module /usr/local/apache2/modules/mod_authz_core.so
LoadModule rewrite_module     /usr/local/apache2/modules/mod_rewrite.so

<IfModule unixd_module>
    User daemon
    Group daemon
</IfModule>

<Directory />
RewriteEngine on
RewriteBase    /
RewriteRule    ^/share/(.*)/proxy/alfresco/api/solr/(.*)$   -   [F]
RewriteRule    ^/share/-default-/proxy/alfresco/api/(.*)$   -   [F]
</Directory>

LoadModule     jk_module /usr/local/apache2/modules/mod_jk.so
JkWorkersFile /usr/local/apache2/conf/worker.properties
JkLogFile      /usr/local/apache2/logs/mod_jk.log
JkLogLevel     info
JkShmFile      /usr/local/apache2/logs/jk-runtime-status

LoadModule ssl_module /usr/local/apache2/modules/mod_ssl.so
Listen 443
<VirtualHost *:443>
    SSLEngine           on
    SSLProtocol         all -SSLv2 -SSLv3
    SSLCipherSuite      ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!LOW:!aNULL:!eNULL
    SSLVerifyClient     none
    SSLCertificateFile /usr/local/apache2/startssl/site.crt
    SSLCertificateKeyFile /usr/local/apache2/startssl/site.key
    SSLCertificateChainFile /usr/local/apache2/startssl/root_bundle.crt
    ErrorLog            /usr/local/apache2/logs/ssl_error_log

    LogLevel            debug
    JkMount /* alfresco-worker
</VirtualHost>
</javascript>

Try again in mobile.Checking everything OK but "checking repository connection" fail.
The last remaining error showed in the "ssl_error_log" is not resolved:
"(70014)End of file found: [client my.phone.ip:11861] AH01991: SSL input filter read failed."

Please help!

Thanks!

Alex