Using public SSL certificate in Alfresco

tonymbarrett 2015-06-03 11:12:02 UTC #1

I struggled for ages trying to get stock Alfresco to use a public signed SSL certificate for SSL access over standard TCP port 443 (not 8443 that Alfresco Tomcat uses).

Bitnami Alfresco seems to be a far more polished, and hopefully there's a simple way of achieving this. So, what I'm aiming to do is to generate an SSL CSR, which we'll then get signed by our preferred public CA. I then need to install this cert into Bitnami Alfresco, so we can have public access to the server over SSL (443) using a genuine, trusted cert.

I'm ok with the CSR part, and will have no problem getting the cert issued (along with the trusted CA bundle), but I want to confirm the requirements to install and use this cert. Bitnami Alfresco 5.0.d (I'm currently using the packaged Ubuntu VM) seems to use apache anyway, which is a good start, but what will the processe be to install this cert?

tonymbarrett 2015-06-04 11:50:17 UTC #2

Ok, managed to achieve this, and is was far easier than expected. Having been pulling my hair out trying to get standard Alfresco Tomcat to use a specific cert, knowing that Bitnami seem to use apache by default meant it was just a matter of requesting a new cert using openssl, then replacing the existing apache certs. Seemed to work ok.

davidg 2015-06-04 12:53:29 UTC #3

Hi @tonymbarrett,

We are glad you solve the issue.

This link can help you next time:
https://wiki.bitnami.com/Components/Apache#How_to_create_a_SSL_certificate.3f

Thanks a lo for let us know.

digiwill 2015-10-19 12:17:26 UTC #4

Hi there guys,

I'm struggling with the following regarding OPENSSL....

I managed to create a new server.key file and generated a .csr file.
This is signed by a public CA (genuine) and I got 3 files back:

CA_Root.cer
CA_Intermediate.cer
domainname.cer

I couldn't find out how to create 1 .crt file from these 3 .cer files and create a trust. Now SOLR is not working. Basicly I'd like to know how to install these certificates properly, the wiki site supplied here doesn't mention the installation of the .crt file.

thanks in advance!

tomasp 2015-10-19 15:52:59 UTC #5

Hi @digiwill,

The .cer files and .crt files are equivalents. Please take a look to the next guide where it is explained how to configure apache to use SSL certificates:

https://wiki.bitnami.com/Components/Apache#How_to_enable_HTTPS_support_with_SSL_certificates

In your case you will need to use the domainname.cer as server.crt and CA_Intermediante.cer as server-ca.crt using the notation of the guide.
Please remember to run apachectl -t before restart the apache server to check if the syntax is correct.

Let me know if you have any troubles.

Tomas

digiwill 2015-10-19 19:23:31 UTC #6

hi @tomasp
tnx for your reply, much appreciated!

I added the Intermediate cer as well, the chain seems to work now indeed (checked with sslshopper tool).
Https connection is showing the trusted certificate issued by my CA.

however the solr thingy is still showing issues.....
tags can't be loaded and shows this error in alfresco dashboard:
org.alfresco.repo.search.impl.lucene.LuceneQueryParserException: 09190066

also the solr.log is showing:
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 34 more

maybe i need to config a separate file for solr?
Any suggestions to this? thanks!

p.s. im not sure where to put the commando apachectl -t u provided to check the syntax? can u enlighten me

digiwill 2015-10-21 12:05:43 UTC #7

anyone? been researching the webs but I can't figure it out :/

tomasp 2015-10-21 16:31:43 UTC #8

Hi @digiwill,

Sorry for the delay. Could you please tell me a bit more about your environment? Are you using a native installer, a VM or a cloud image? In the case you are using a native installer could you tell me the operative system? And the last thing, could you tell me which ports are you using for apache and tomcat? You can find this information easily in the properties.ini file that is in your installdir.

About the apachectl -t command, you should execute in your sever.

Tomas

digiwill 2015-10-21 18:12:40 UTC #9

hi @tomasp

tnx 4 your reply mate.

I'm using the native installer @ windows 2012 r2 server 64bit.

[Tomcat]
tomcat_server_port=8080
tomcat_server_ssl_port=8443
tomcat_server_shutdown_port=8005
tomcat_server_ajp_port=8009
tomcat_root_directory=D:\Alfresco/apache-tomcat
tomcat_domainname=127.0.0.1
tomcat_configuration_directory=D:\Alfresco/apache-tomcat/conf
tomcat_unique_service_name=alfrescoTomcat
[Apache]
apache_server_port=8080
apache_server_ssl_port=443
apache_root_directory=D:\Alfresco/apache2
apache_htdocs_directory=D:\Alfresco/apache2/htdocs
apache_domainname=h2466486
apache_configuration_directory=D:\Alfresco/apache2/conf
apache_unique_service_name=alfrescoApache

Shouldn't the tomcat ssl port be 443 as well ?

the apache command I put somewhere in the command prompt I guess?

these were the initial steps i did
step1
openssl genrsa -out D:\Alfresco/apache2/conf/server.key 2048

step2
openssl req -new -key D:\Alfresco/apache2/conf/server.key -out D:\Alfresco/apache2/conf/cert.csr -config D:\Alfresco/apache2/conf/openssl.cnf

and then sent the csr info to the public CA...

if i should do these steps again / different please let me know

p.s. looking at the openssl.cnf file .. it looks like an example file rather than an actual file that's being used?? maybe this is the issue ?

digiwill 2015-10-23 07:34:32 UTC #10

I copied back the original files from stock install with the example cert etc.just to correlate some things.
These give the same results, tags can't be retrieved error... so I'm not sure what's going on ??

tomasp 2015-10-23 09:55:31 UTC #11

Hi @digiwill ,

Sorry for the delay on this. I am trying to reproduce the error on our side but I couldn't reproduce it yet. I think that maybe there is a mess with some of the ports on the installation. Could you check this older community post? The user had a similar environment.

Tomas

digiwill 2015-10-23 15:32:00 UTC #12

port 8443 is being used by Parallels Plesk, I will map it to 8444 so 8443 will become available. Port 8080 is the default http port for my Alfresco instance.

but SSL is being used by port 443 at the moment, so that's confusing. But I will give it a go!

digiwill 2015-10-23 16:48:42 UTC #13

update:
I've installed the native installer @ my laptop (win7 pro x64) and indeed this works fine. Haven't tested the certificates thing yet.

I'll keep you updated! tnx.

update2:

woohoo that was the trick @tomasp tnx 4 your efforts

edu_ 2015-10-26 17:12:11 UTC #14

Hi @digiwill,

I'm glad that it worked for you!

Please feel free to come back and ask any question you may find in the future!

Edu.

system 2017-11-16 13:19:12 UTC #15

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!