01-05-2017 09:53 AM
Currently i have 5.x version of community edition and i want to install a ssl to secure the site. I have followed many docs from this site on how to setup and apparently i must be missing a few things because i still cannot get my site to work.
Here i what I have done so far
I used the tool keytool to import my chain and my cert into tomcat.
I then edited server.xml to port to 443 instead of 80 (that i originally had changed)
I then edited share-config-custom to reflect my Url's etc: https://localhost/alfresco
i then edited alfresco-global.properties to point my share and my context to port 443 and i changed the protocol to https.
When i restarted the alfresco site with the ./alfresco.sh restart command everything starts like it should but I cannot access the site.
I get a message that the "SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG"
Not sure what I'm doing wrong and could really use a little help.
Thanks in advanced
michaelr93
01-05-2017 06:49 PM
Try to set the SSLEnabled="true" for tomcat connector
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
01-06-2017 07:39 AM
I have all that configured and still cannot get it to work. One other thing that i forget to put in the post is the ssl certificate.
When i purchared the cert i was in .crt and i used the keytool to import into ssl.keystore. I also thought that might be the wrong format so i then when back to my provider and downloaed the .pem file and imported it. So I'm not sure if i have the cert in the correct spot or if its correctly configured in my ssl.keystore.
01-06-2017 03:34 PM
The easiest way to get SSL working is to install Apache (or your favorite HTTP server) and use it as a reverse proxy. That way, Apache is handling the SSL and Tomcat can concentrate on being an app server.
Also, on a side note, it sounds like it may be too late, but if this is a public facing machine you can get a free, high-quality cert from letsencrypt.org. There is a project on github called certbot which scripts the whole thing. It removes all of the keytool/certificate fuss and muss. I've used it on many of my client projects and it works great.
01-09-2017 09:48 AM
Thanks for all the comments. I think i will try the previous suggestion on having apache which is already built into my server and forward the traffic tot he tomcat after its secured. I will reply again my progress whether it good or bad.
Explore our Alfresco products with the links below. Use labels to filter content by product module.