topic Re: Securing community edition with a SSL. in Alfresco Forum

Securing community edition with a SSL.

michaelr93 — Thu, 05 Jan 2017 17:53:00 GMT

Currently i have 5.x version of community edition and i want to install a ssl to secure the site. I have followed many docs from this site on how to setup and apparently i must be missing a few things because i still cannot get my site to work.Here i what I have done so farI used the tool keytool to

Re: Securing community edition with a SSL.

kaynezhang — Fri, 06 Jan 2017 02:49:20 GMT

Try to set the SSLEnabled="true" for tomcat connector

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"

Re: Securing community edition with a SSL.

michaelr93 — Fri, 06 Jan 2017 15:39:44 GMT

I have all that configured and still cannot get it to work. One other thing that i forget to put in the post is the ssl certificate.

When i purchared the cert i was in .crt and i used the keytool to import into ssl.keystore. I also thought that might be the wrong format so i then when back to my provider and downloaed the .pem file and imported it. So I'm not sure if i have the cert in the correct spot or if its correctly configured in my ssl.keystore.

Re: Securing community edition with a SSL.

jpotts — Fri, 06 Jan 2017 23:34:30 GMT

The easiest way to get SSL working is to install Apache (or your favorite HTTP server) and use it as a reverse proxy. That way, Apache is handling the SSL and Tomcat can concentrate on being an app server.

Also, on a side note, it sounds like it may be too late, but if this is a public facing machine you can get a free, high-quality cert from letsencrypt.org. There is a project on github called certbot which scripts the whole thing. It removes all of the keytool/certificate fuss and muss. I've used it on many of my client projects and it works great.

Re: Securing community edition with a SSL.

michaelr93 — Mon, 09 Jan 2017 17:48:01 GMT

Thanks for all the comments. I think i will try the previous suggestion on having apache which is already built into my server and forward the traffic tot he tomcat after its secured. I will reply again my progress whether it good or bad.