On 10/06/2017 08:39 AM, Dayne Ellanna wrote: > I am having the worst time getting tomcat to do https for dspace. I > followed the instructions on the dspace site but cannot make heads or > tails of the instructions as I am definitely not a certificate expert. > The instructions use generic names and don't explain where root ca's > come from or generating certificate requests and from what do I generate > these. Can someone give me very specific instructions about how to set > up the https on tomcat to run dspace. So far I have gotten dspace to > run successfully as http://myserver.domain:8080/xmlui. As per > instructions on the dspace site I have tried to create the RSA key, and > we use incommon for our certs which I can obtain, but have not been able > to figure out the beginning to end process for this. I tried using curl > to test but no success. I really need a succinct explanation of all the > pieces, where to get them or how to generate them in order to run the > ssl. HELP! > > Thanks, > Dayne >
Dayne, We proxy tomcat behind apache httpd to solve this exact issue. Our tomcat listens on port 8877. If you want to try that, in short what you will need is to install httpd and set it up to run ssl. Then you can define a ssl-enabled virtualhost in apache that proxies your tomcat. Here is our httpd conf file for the virtualhost, I've added my comments in ### (with sensitive bits changed, but still in the right places): # Default host when using NameVirtualHost <VirtualHost *:80> ### ^ this creates a httpd server listening on port 80. ServerAdmin [email protected] DocumentRoot /var/www/html ServerName dspace-devel.mydomain.edu ServerAlias dspace-devel ErrorLog logs/dspace-devel.mydomain.edu-http-error_log CustomLog logs/dspace-devel.mydomain.edu-http-access_log combined ProxyPass / http://127.0.0.1:8877/ retry=10 connectiontimeout=5 ### ^ this tells httpd to redirect it's / to localhost port 8877 timeout=300 ProxyPassReverse / http://127.0.0.1:8877/ retry=10 ### ^ this tells httpd that tomcat's url's should be rewritten to look ### like they're coming from httpd. ProxyPreserveHost On ### ^ this tells httpd to keep the Host: information from the client and ### pass it on to tomcat. </VirtualHost> <VirtualHost dspace-devel.mydomain.edu:443> ### ^ this creates a httpd server that listens on port 443. ServerAdmin [email protected] DocumentRoot /var/www/html ServerName dspace-devel.mydomain.edu ServerAlias dspace-devel ErrorLog logs/dspace-devel.mydomain.edu-https-error_log CustomLog logs/dspace-devel.mydomain.edu-https-access_log combinedssl Include conf.d/ssl.include Include conf.d/ssl.include.star ### ^ these point to a file which specifies where the ssl certificates ### live on the host. ProxyPass / http://127.0.0.1:8877/ retry=10 connectiontimeout=5 ### ^ this tells httpd to redirect it's / to localhost port 8877 timeout=300 ProxyPassReverse / http://127.0.0.1:8877/ retry=10 ### ^ this tells httpd that tomcat's url's should be rewritten to look ### like they're coming from httpd. ProxyPreserveHost On ### ^ this tells httpd to keep the Host: information from the client and ### pass it on to tomcat. </VirtualHost> So much for the virtualhost/proxy setup. To get httpd to use ssl, you will need to have mod_ssl installed, a ssl.conf file telling httpd how to use ssl and include files(mentioned above) with information about your certificates. Here's our ssl.conf file: Listen 443 https SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog SSLSessionCache shmcb:/run/httpd/sslcache(512000) SSLSessionCacheTimeout 300 SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed connect builtin SSLCryptoDevice builtin SSLStaplingCache shmcb:/run/httpd/ocsp(128000) # The default 'combined' format extended with SSL protocol and cipher logging LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{SSL_PROTOCOL}x\" \"%{SSL_CIPHER}x\"" combinedssl This is our ssl.include file: SSLEngine on # modern configuration, tweak to your needs SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 SSLHonorCipherOrder on SSLCompression off # OCSP Stapling, only in httpd 2.3.3 and later SSLUseStapling on SSLStaplingResponderTimeout 5 SSLStaplingReturnResponderErrors off And this is our ssl.include.star file: SSLCertificateFile /etc/pki/tls/certs/star.mydomain.edu.crt SSLCertificateChainFile /etc/pki/tls/certs/star.mydomain.edu.chain.crt SSLCertificateKeyFile /etc/pki/tls/private/star.mydomain.edu.key I hope this helps a bit. We're running CentOS so YMMV. /tony -- Tony Albers Systems administrator, IT-development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. Tel: +45 2566 2383 / +45 8946 2316 -- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/dspace-tech. For more options, visit https://groups.google.com/d/optout.
