Accessing Squore via HTTPS

You can configure JBoss to allow https access to Squore Server instead of http by following the instructions below.

Note

These instructions are based on the standard JBoss instructions for securing the web server and use a self-signed certificate managed in the Java keystore, which may show a warning in users' browsers.

If your company supply their own certificate and you want to import it instead of generating one, refer to the instructions in the section called “Key and Certificate Management”.

If you want to use openSSL instead of a java keystore and manage keys natively, refer to the advanced instructions on https://docs.jboss.org/author/display/AS71/SSL+setup+guide?_sscc=t.

Generate a secret key/certificate and store it in a file called a "key store" (foo.keystore in the current directory). The certificate is valid for 30 years (10950 days). The password use for encryption is "secret". One important issue is the common name (CN) of the certificate. For some reason this is referred to as "first and last name". It should however match the name of the web server, or some browsers like IE will claim the certificate to be invalid although you may have accepted it already.

 $ keytool -genkey -alias foo -keyalg RSA -keystore foo.keystore -validity 10950
Enter keystore password: secret
Re-enter new password: secret
What is your first and last name?
  [Unknown]:  foo.acme.com
What is the name of your organizational unit?
  [Unknown]:  Foo
What is the name of your organization?
  [Unknown]:  acme corp
What is the name of your City or Locality?
  [Unknown]:  Duckburg
What is the name of your State or Province?
  [Unknown]:  Duckburg
What is the two-letter country code for this unit?
  [Unknown]:  WD
Is CN=foo.acme.com, OU=Foo, O=acme corp, L=Duckburg, ST=Duckburg, C=WD correct?
  [no]:  yes

Enter key password for <deva> secret
    (RETURN if same as keystore password):  
Re-enter new password: secret

Configure JBoss by adding a https connector to the subsystem called default-host in <INSTALLDIR>/server/standalone/configuration/standalone.xml:

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
  <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http" />
 
  <connector name="https" scheme="https" protocol="HTTP/1.1" socket-binding="https" enable-lookups="false" secure="true">
    <ssl name="foo-ssl" password="secret" protocol="TLSv1" key-alias="foo" certificate-key-file="/path/to/foo.keystore" />
  </connector>
  (...)
</subsystem>

Note

Alternatively, if you want to completely disable HTTP access, remove the http connector .

Start Squore Server. The SSL port is 8443 + the offset selected at installation. By default you should therefore be able to access the web interface via https://localhost:8543 in your browser.

Tip

It is also possible to use Apache as a reverse proxy in from of Squore Server to achieve the same result. For more information, consult the Apache documentaion about the mod_proxy module at http://httpd.apache.org/docs/2.4/mod/mod_proxy.html.

Prev	Up	Next
Chapter 6. Integrating Squore on Your Network	Home \| ToC	Redirecting from HTTP to HTTPS