topic SSL Problems in Alfresco Archive

SSL Problems

tman247 — Tue, 28 Apr 2015 14:39:01 GMT

Pulling my hair out over this one.Ultimately, we needed to change the internal SSL certificate in Alfresco to a public signed one. Getting the cert isn't a problem. Getting Alfresco to use it is. I spent ages using keytool to try and inject the new cert and signing chain, and even though in the end

Re: SSL Problems

eswbitto — Tue, 28 Apr 2015 16:40:00 GMT

I may or may not get a double post here. I originally sent a link, but it didn't show up so I'm doing it again.

https://forums.alfresco.com/forum/installation-upgrades-configuration-integration/installation-upgrades/setup-https-and-ports#comment-145306

I think your issue is on your virtual hosts in the httpd.conf you are not pointing to your certificates.

Edit by AFaust: Previous/double post removed.

Re: SSL Problems

rjohnson — Wed, 29 Apr 2015 10:24:02 GMT

We use the approach you mention on several installations. I have an installation guide (more notes to self really as I don't do it that often) but its PDF. Send me a private message with your email address and I will email it to you.

Re: SSL Problems

tman247 — Fri, 01 May 2015 15:18:47 GMT

Really appreciate the link. I'll work through that next week.

I had actually gone back to see if I can get Alfresco working with a different SSL cert using the native tomcat settings. My god, I can only say it's painful. I've tried absolutely everything I can think of, but no matter what I try, Alfresco continues to use it's own internal self-signed certificate. Even hard-coding the new keystores I created into into server.xml doesn't work. The log file (catalina.out) just keeps telling me that "unable to find valid certification path to requested target". I double checked everything as well. Frustrating or what. All I want to do it switch to a new cert and (ideally) get back on the standard SSL port.

Oh well, back to looking at Apache+Alfresco again then!

Re: SSL Problems

tman247 — Fri, 08 May 2015 14:53:22 GMT

I've been spending some more time looking at the integration with apache. I've followed the guide in the link (we don't use the SharePoint functionality, so I skipped that part). After much trial and error, I'm almost there, but not quite. I've added the following block of code to httpd.conf;


<VirtualHost *:443>

  ServerName collab2

  SSLEngine on
  SSLCertificateKeyFile /etc/httpd/ssl/collab2-private.key
  SSLCertificateFile /etc/httpd/ssl/collab2.crt
  SSLCACertificateFile /etc/httpd/ssl/certchain.crt
  SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
  SSLProtocol all -SSLv2
  ErrorLog logs/ssl_error_log
  TransferLog logs/ssl_access_log
  LogLevel warn

  #ProxyPass /paste http://localhost/paste/
  #ProxyPassReverse /paste http://localhost/paste/

  RequestHeader set X-Forwarded-Proto "https"
  ProxyPass / http://collab2:8080/
  ProxyPassReverse / http://collab2:8080/

  ProxyTimeout 300
  SSLProxyEngine on

  <Proxy *>

  allow from all

  </Proxy>

</VirtualHost>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

With this, I can get the Alfresco logon page up using Apache (https://collab2/share). I've verified the correct cert is being used now, but after entering logon credentials, I just get the following message;

<blockquote>
A server error has occurred.

There are a number of reasons why this could have happened:

    You have attempted to access a page that does not exist - check the URL in the address bar.
    You have attempted to access a page that is not accessible to you, such as a private Site dashboard.
    A valid page has been requested but the server was unable to render it due to an internal error - contact your administrator.

Return to your dashboard page

Alfresco Software Inc. © 2005-2015 All rights reserved.
</blockquote>

I don't know exactly where the problem could be. The Apache ssl_access_log doesn't show any errors. Is something not being proxied properly still? Any ideas welcome.

Re: SSL Problems

eswbitto — Fri, 08 May 2015 15:48:00 GMT

I would upgrade to Alfresco 4.2.f
If you have a firewall on your centos turn it off and see if that could be the issue.

The error that you get usually means that Alfresco hasn't really started. The sure fire way to know is to actually go to https://collab2/alfresco and see if you can use the old interface.

Edit:
I'm wondering if you don't have your share-config-custome.xml setup or not. Here is a copy of what I have. I've edited it to put in "FQDN" so search for that in the document and replace it with your own fqdn.

/alfinstall/tomcat/shared/classes/alfresco/web-extension


<alfresco-config>

   <!– Example config to turn off the CSRF filter
   <config evaluator="string-compare" condition="CSRFPolicy" replace="true">
      <filter/>
   </config>–>
   
   <!– Configuration for Apache reverse proxy on localhost:8089 –>
   <config evaluator="string-compare" condition="CSRFPolicy" replace="true">

      <!–
         Will be used and exposed to the client side code in Alfresco.contants.CSRF_POLICY.
         Use the Alfresco.util.CSRFPolicy.getHeader() or Alfresco.util.CSRFPolicy.getParameter() with Alfresco.util.CSRFPolicy.getToken()
         to set the token in custom 3rd party code.
       –>
      <client>
         <cookie>Alfresco-CSRFToken</cookie>
         <header>Alfresco-CSRFToken</header>
         <parameter>Alfresco-CSRFToken</parameter>
      </client>

      <!– The first rule with a matching request will get its action invoked, the remaining rules will be ignored. –>
      <filter>
         <!–
            Certain Surf POST requests form the WebScript console must be allowed to pass without a token since
            the Surf WebScript console code can't be dependent on a Share specific filter.
         –>
         <rule>
            <request>
               <method>POST</method>
               <path>^\/page\/caches\/dependency\/clear|^\/page\/index|^\/page\/surfBugStatus|^\/page\/modules\/deploy|^\/page\/modules\/module|^\/page\/api\/javascript\/debugger</path>
            </request>
            <action name="assertReferer">
               <param name="always">false</param>
               <param name="referer">https://FQDN.ca/.*</param>
            </action>
            <action name="assertOrigin">
               <param name="always">false</param>
               <param name="origin">https://FQDN</param>
            </action>
         </rule>

         <!– Certain Share POST requests does NOT require a token –>
         <rule>
            <request>
               <method>POST</method>
               <path>^/page/dologin.*|^\/page/site\/[^\/]+\/start-workflow|^\/page/start-workflow</path>
            </request>
            <action name="assertReferer">
               <param name="always">false</param>
               <param name="referer">https://FQDN/.*</param>
            </action>
            <action name="assertOrigin">
               <param name="always">false</param>
               <param name="origin">https://FQDN</param>
            </action>
         </rule>

         <!– Clear the token when logging out –>
         <rule>
            <request>
               <method>GET</method>
               <path>^/page/dologout.*</path>
            </request>
            <action name="clearToken">
               <param name="session">Alfresco-CSRFToken</param>
               <param name="cookie">Alfresco-CSRFToken</param>
            </action>
         </rule>

         <!– Make sure the first token is generated –>
         <rule>
            <request>
               <session>
                  <attribute name="_alf_USER_ID">.*</attribute>
                  <attribute name="Alfresco-CSRFToken"/>
                  <!– empty attribute element indicates null –>
               </session>
            </request>
            <action name="generateToken">
               <param name="session">Alfresco-CSRFToken</param>
               <param name="cookie">Alfresco-CSRFToken</param>
            </action>
         </rule>

         <!– Refresh token on new "page" visit when a user is logged in –>
         <rule>
            <request>
               <method>GET</method>
               <path>^/page/.*</path>
               <session>
                  <attribute name="_alf_USER_ID">.*</attribute>
                  <attribute name="Alfresco-CSRFToken">.*</attribute>
               </session>
            </request>
            <action name="generateToken">
               <param name="session">Alfresco-CSRFToken</param>
               <param name="cookie">Alfresco-CSRFToken</param>
            </action>
         </rule>

         <!– Verify multipart requests contains the token as a parameter and also correct referer & origin header if available –>
         <rule>
            <request>
               <method>POST</method>
               <header name="Content-Type">^multipart/.*</header>
               <session>
                  <attribute name="_alf_USER_ID">.*</attribute>
               </session>
            </request>
            <action name="assertToken">
               <param name="session">Alfresco-CSRFToken</param>
               <param name="parameter">Alfresco-CSRFToken</param>
            </action>
            <action name="assertReferer">
               <param name="always">false</param>
               <param name="referer">https://FQDN/.*</param>
            </action>
            <action name="assertOrigin">
               <param name="always">false</param>
               <param name="origin">https://FQDN</param>
            </action>
         </rule>

         <!–
            Verify there is a token in the header for remaining state changing requests and also correct
            referer & origin headers if available. We "catch" all content types since just setting it to
            "application/json.*" since a webscript that doesn't require a json request body otherwise would be
            successfully executed using i.e. "text/plain".
         –>
         <rule>
            <request>
               <method>POST|PUT|DELETE</method>
               <session>
                  <attribute name="_alf_USER_ID">.*</attribute>
               </session>
            </request>
            <action name="assertToken">
               <param name="session">Alfresco-CSRFToken</param>
               <param name="header">Alfresco-CSRFToken</param>
            </action>
            <action name="assertReferer">
               <param name="always">false</param>
               <param name="referer">FQDN/.*</param>
            </action>
            <action name="assertOrigin">
               <param name="always">false</param>
               <param name="origin">https://FQDN.ca</param>
            </action>

         </rule>
      </filter>
   </config>
   
</alfresco-config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍