Can not save account after SSL configuration

[alexjm]

Hi, I have two question for it.

Question 1:
In the beginning, I installed Alfresco community 5.1 on CentOS 7, non-SSL. Tested Mobile(IOS) Apps connect to Server was fine. Mobile version is 2.3.

Then, I builded up Alfresco + Apache, configured SSL with the StartSSL certificate(free mode,1 year), and tested login on browser just fine.
But when I tried to use Mobile App, it can not save account.

I have followed this page http://docs.alfresco.com/community/tasks/configure-ssl-prod.html much more to configure SSL.
mobile configuration(ios 9,iphone 6s plus):
User name: Myname
Password: Mypassword
Hostname:file.g****.com.my
Description: Alfresco Server
HTTPS: On
Port: 443
Service Document: /alfresco
Client Certificate: none

Connection Diagnostic:
Checking network connection: OK
Checking server connection: Not OK

I google many post, try to find the problem. like this:
https://forums.alfresco.com/forum/end-user-discussions/alfresco-mobile/alfresco-ios-211-ios-8-failed...

Is it a problem as I use StartSSL certificate? Is it belong a self-signed certificate?

Question 2:
With this doubt, I tried to use HTTP 8080 on mobile again, because it still works on browser. But it also can not save account this time.

mobile configuration(this setting was OK before SSL configuration):
User name: Myname
Password: Mypassword
Hostname:172.**.**.***(Server intranet IP)
Description: Alfresco Server
HTTPS: Off
Port: 8080
Service Document: /alfresco
Client Certificate: none

Connection Diagnostic:
Checking network connection: OK
Checking server connection: OK
Authenticating with Alfresco: OK
Connecting to Alfresco: OK
Checking repository connection: Not OK

I finded this answer: https://forums.alfresco.com/comment/149481#comment-149481, it seems not realy the same, And don't know how to fix it.

Please Help!

[alexjm]

I have followed this but not works:
https://forums.alfresco.com/comment/149481#comment-149481

chage server.xml of tomcat to this:
<Connector port="8080" URIEncoding="UTF-8" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" scheme="https" proxyName="external.prox.host.name" proxyPort="443" maxHttpHeaderSize="32768" />

<Connector port="8009" URIEncoding="UTF-8" protocol="AJP/1.3" redirectPort="8443" />

<Connector port="8443" URIEncoding="UTF-8" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
               maxThreads="150" scheme="https" keystoreFile="/home/alfresco-community/alf_data/keystore/ssl.keystore" keystorePass="xxxxxxxxx" keystoreType="JCEKS"
secure="true" connectionTimeout="240000" truststoreFile="/home/alfresco-community/alf_data/keystore/ssl.truststore" truststorePass="xxxxxxxxx" truststoreType="JCEKS"
               clientAuth="want" sslProtocol="TLS" allowUnsafeLegacyRenegotiation="true" maxHttpHeaderSize="32768" maxSavePostSize="-1" />


and my alfresco-global.properties configuration:

alfresco.context=alfresco
alfresco.host=external.prox.host.name
alfresco.port=443
alfresco.protocol=https
share.context=share
share.host=external.prox.host.name
share.port=443
share.protocol=https
opencmis.context.override=true
opencmis.context.value=
opencmis.servletpath.override=true
opencmis.servletpath.value=
opencmis.server.override=true
opencmis.server.value=https://external.prox.host.name

But now, same error persists!
Is there anything else should be modified ?

Thanks!

Alex

[alexjm]

Hi!

I come back again. Progress has been made

I found some errors in the ssl_error_log of apache. Like this:
"File does not exist: /usr/local/apache2/htdocs/alfresco/service/api/server"
Look like something is wrong in "httpd.conf"
I followed "http://docs.alfresco.com/community/tasks/configure-ssl-prod.html" to configure httpd.conf, and it un-comment these lines for public API access
   " # JkMount /alfresco/api/*/public/cmis/versions/* alfresco-worker
    # JkMount /alfresco/api/*/public/alfresco/versions/* alfresco-worker
    # JkMount /alfresco/service/api/server alfresco-worker    
    # JkMount /alfresco/cmisatom/* alfresco-worker    
    # JkMount  /alfresco/service/cmis/* alfresco-worker
    # JkMount /alfresco/api/cmis/versions/* alfresco-worker  "

I didn't noticed it before.
So I chage all "JkMount"s to "JkMount /* alfresco-worker". Now, below are my "httpd.conf" configuration:
<javascript>
ServerName  external.proxy.host.name
PidFile     /usr/local/apache2/logs/httpd.pid
ErrorLog    /usr/local/apache2/logs/error_log
LogLevel    info

LoadModule  unixd_module       /usr/local/apache2/modules/mod_unixd.so
LoadModule  authn_core_module  /usr/local/apache2/modules/mod_authn_core.so
LoadModule  authz_host_module  /usr/local/apache2/modules/mod_authz_host.so
LoadModule  authz_core_module  /usr/local/apache2/modules/mod_authz_core.so
LoadModule  rewrite_module     /usr/local/apache2/modules/mod_rewrite.so

<IfModule unixd_module>
    User daemon
    Group daemon
</IfModule>  

<Directory />
RewriteEngine  on
RewriteBase    /
RewriteRule    ^/share/(.*)/proxy/alfresco/api/solr/(.*)$   -   [F]
RewriteRule    ^/share/-default-/proxy/alfresco/api/(.*)$   -   [F]
</Directory>

LoadModule     jk_module /usr/local/apache2/modules/mod_jk.so
JkWorkersFile  /usr/local/apache2/conf/worker.properties
JkLogFile      /usr/local/apache2/logs/mod_jk.log
JkLogLevel     info
JkShmFile      /usr/local/apache2/logs/jk-runtime-status

LoadModule ssl_module /usr/local/apache2/modules/mod_ssl.so
Listen 443
<VirtualHost *:443>
    SSLEngine           on
    SSLProtocol         all -SSLv2 -SSLv3
    SSLCipherSuite      ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!LOW:!aNULL:!eNULL
    SSLVerifyClient     none
    SSLCertificateFile  /usr/local/apache2/startssl/site.crt
    SSLCertificateKeyFile  /usr/local/apache2/startssl/site.key
    SSLCertificateChainFile  /usr/local/apache2/startssl/root_bundle.crt
    ErrorLog            /usr/local/apache2/logs/ssl_error_log

    LogLevel            debug
    JkMount /* alfresco-worker
</VirtualHost>
</javascript>

Try again in mobile.Checking everything OK but "checking repository connection" fail.
The last remaining error showed in the "ssl_error_log" is not resolved:
"(70014)End of file found: [client my.phone.ip:11861] AH01991: SSL input filter read failed."

Please help!

Thanks!

Alex