You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@openmeetings.apache.org by "Ninnig, Alexander" <Al...@rechnungshof.rlp.de> on 2020/06/12 08:31:43 UTC
HTTPS with OpenMeetings 4 (4.0.10)
Hello,
I'm really sorry to bother, but I can't get HTTPS working with OpenMeetings 4. The site (https/5443) cannot be displayed.
I had the same problem with OpenMeetings 5, until someone told me not to use the keystore, but to alter the server.xml instead and change the lines into something like that:
<Connector port="5443"
SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateFile="/etc/mycertfolder/server.pem"
certificateKeyFile="/etc/mycertfolder/key.pem"
certificateChainFile="/etc/mycertfolder/chain.pem"
sslProtocol="TLS"/>
</SSLHostConfig>
</Connector>
As I said, that worked with OpenMeetings 5.
Unfortunately, OM5 is not production-ready yet, but I need a solution now.
And unfortunately, there is no server.xml in OM4.
I also searched the whole filesystem for strings like "Connector", but I got no match.
Before I tell you everything I tried in ordner to make the keystore work:
Can you tell me, If there is a similar solution as the one, mentioned above, in OpenMeetings 4?
Meaning: can I simply edit a config-file and provide this config with the paths to my certificates?
Or do I have to use the keystore?
If I have to use the keystore, I will describe to you what I tried so far.
Best wishes,
Alex
Re: HTTPS with OpenMeetings 4 (4.0.10)
Posted by Maxim Solodovnik <so...@gmail.com>.
The instructions are shipped with every OM release
And can be found for ex. here
https://om.alteametasoft.com/openmeetings/docs/RTMPSAndHTTPS.html
On Fri, 12 Jun 2020 at 15:31, Ninnig, Alexander <
Alexander.Ninnig@rechnungshof.rlp.de> wrote:
> Hello,
>
> I’m really sorry to bother, but I can’t get HTTPS working with
> OpenMeetings 4. The site (https/5443) cannot be displayed.
>
> I had the same problem with OpenMeetings 5, until someone told me not to
> use the keystore, but to alter the server.xml instead and change the lines
> into something like that:
> <Connector port="5443"
> SSLEnabled="true">
> <SSLHostConfig>
> <Certificate certificateFile="/etc/mycertfolder/server.pem"
> certificateKeyFile="/etc/mycertfolder/key.pem"
> certificateChainFile="/etc/mycertfolder/chain.pem"
> sslProtocol="TLS"/>
> </SSLHostConfig>
> </Connector>
> As I said, that worked with OpenMeetings 5.
> Unfortunately, OM5 is not production-ready yet, but I need a solution now.
> And unfortunately, there is no server.xml in OM4.
> I also searched the whole filesystem for strings like „Connector“, but I
> got no match.
>
> Before I tell you everything I tried in ordner to make the keystore work:
> Can you tell me, If there is a similar solution as the one, mentioned
> above, in OpenMeetings 4?
> Meaning: *can I **simply edit** a config-file and * *provide this config
> with the paths to my certificates?*
> *Or do I have to use the keystore?*
>
> If I have to use the keystore, I will describe to you what I tried so far.
>
> Best wishes,
> Alex
>
>
>
>
--
Best regards,
Maxim
AW: HTTPS with OpenMeetings 4 (4.0.10)
Posted by "Ninnig, Alexander" <Al...@rechnungshof.rlp.de>.
Hi Maxim,
thanks for your quick response.
Yes, I tried those.
Didn’t work.
So before I tell you everything I tried so far: can I use a config-file instead of the keystore?
Just like in OM5, where I can alter the server.xml and edit the path to the certificates?
Best wishes,
Alex
Von: Maxim Solodovnik <so...@gmail.com>
Gesendet: Freitag, 12. Juni 2020 10:41
An: Openmeetings user-list <us...@openmeetings.apache.org>
Betreff: Re: HTTPS with OpenMeetings 4 (4.0.10)
The instructions are shipped with every OM release
And can be found for ex. here https://om.alteametasoft.com/openmeetings/docs/RTMPSAndHTTPS.html
On Fri, 12 Jun 2020 at 15:31, Ninnig, Alexander <Al...@rechnungshof.rlp.de>> wrote:
Hello,
I’m really sorry to bother, but I can’t get HTTPS working with OpenMeetings 4. The site (https/5443) cannot be displayed.
I had the same problem with OpenMeetings 5, until someone told me not to use the keystore, but to alter the server.xml instead and change the lines into something like that:
<Connector port="5443"
SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateFile="/etc/mycertfolder/server.pem"
certificateKeyFile="/etc/mycertfolder/key.pem"
certificateChainFile="/etc/mycertfolder/chain.pem"
sslProtocol="TLS"/>
</SSLHostConfig>
</Connector>
As I said, that worked with OpenMeetings 5.
Unfortunately, OM5 is not production-ready yet, but I need a solution now.
And unfortunately, there is no server.xml in OM4.
I also searched the whole filesystem for strings like „Connector“, but I got no match.
Before I tell you everything I tried in ordner to make the keystore work:
Can you tell me, If there is a similar solution as the one, mentioned above, in OpenMeetings 4?
Meaning: can I simply edit a config-file and provide this config with the paths to my certificates?
Or do I have to use the keystore?
If I have to use the keystore, I will describe to you what I tried so far.
Best wishes,
Alex
--
Best regards,
Maxim
WG: HTTPS with OpenMeetings 4 (4.0.10)
Posted by "Ninnig, Alexander" <Al...@rechnungshof.rlp.de>.
Hello again,
as I said before: if that was a way, I would prefer to use PEM-files and configure the path to these pem-files in a config-file.
That works in OpenMeetings 5, where I can just edit the server.xml (section: <Connector port="5443">)
In case that DOESN’T work in OpenMeetings 4: I repeated all the steps from the official instructions (shipped with my OM, docs/RTMPSAndHTTPS.html).
Just to be sure, I did all these steps on a fresh and INTERNAL OpenMeetings4-server, so there is no way, our central firewall would be the problem.
I also used the default-password (changeit) and the url „red5“ (I created an entry in my Windows-hosts-file).
I was really thorough, I can find no error.
Here is what I did:
cd /opt/red54010/conf
sudo mv keystore.jmx keystore.bak
sudo mv truststore.jmx truststore.bak
sudo keytool -keysize 2048 -genkey -alias red5 -keyalg RSA -keystore /opt/red54010/conf/keystore.jks
# changeit
# changeit
# red5
# IT
# Organization
# City
# State
# DE
# yes
sudo keytool -certreq -keyalg RSA -alias red5 -file red5.csr -keystore /opt/red54010/conf/keystore.jks
# changeit
sudo cp red5.csr /media/netshare/
# https://myissuingca/certsrv - This is a Microsoft Windows Server 2012 R2 Server with an intermediate CA
# "Request a certificate"
# "Submit an advanced certificate request"
# "Submit a certificate request that uses a Base64-encoded CMD or PKCS10 file, or a renewal request that uses a Base64-encoded PKCS7 file"
# I open the CSR-File I copied on my Windows-Server-Netshare with notepad.exe, I copy & paste the whole text into the input-field of my CA-website
# "Choose certificate-template": I choose "Webserver" which is a default-template (I normally would use a template I created ("webserveradvanced"), which allows me to export the private key)
# Field "Additional Attributes" stays empty - send in request
# Certificate is created, I have 4 download-options: DER-certificate [cer], DER-certificate with complete chain [p7b], BASE64-certificate [cer], BASE64-certificate with complete chain [p7b]. I download them all:
# red5_DER.cer, red5_DER.p7b, red5_Base64.cer, red5_Base64.p7b
# I copy the files in my netshare-folder
sudo cp /media/netshare/red5*.cer /opt/red54010/conf/
sudo cp /media/netshare/red5*.p7b /opt/red54010/conf/
# I copy the certificates of my root-CA and my issuing-CA (intermediate CA) onto my Windows-Server-Netshare. I double-check the files, so I can be sure, those are the right ones
sudo cp /media/netshare/root.crt /opt/red54010/conf/
sudo cp /media/netshare/intermediate.crt /opt/red54010/conf/
# I check with: ls. Yes, everything is there.
cd /opt/red54010/conf
sudo keytool -import -alias root -keystore /opt/red54010/conf/keystore.jks -trustcacerts -file root.crt
# changeit
# Trust this certificate: yes [I checked: yes, it is the certificate of my root-CA]
# certificate was added to keystore
sudo keytool -import -alias intermed -keystore /opt/red54010/conf/keystore.jks -trustcacerts -file intermediate.crt
# changeit
# certificate was added to keystore
sudo keytool -import -alias red5 -keystore /opt/red54010/conf/keystore.jks -trustcacerts -file red5_Base64.cer
# I chose the Base64-certificate without chain
# changeit
# Certificate reply was installed in keystore
sudo cp keystore.jks truststore.jks
sudo cp keystore.jks keystore.screen
sudo cp jee-container.xml jee-container.bak
sudo vi jee-container.xml
# search for <!-- Tomcat without SSL enabled -->
# and comment-out the whole section, so:
# <!-- <bean id="tomcat.server" (...)
# </bean> -->
# search for <! Tomcat with SSL enabled -->
# and remove the comment for the whole section, so
# remove <!-- before <bean id="tomcat.server" (...)
# and remove --> right after </bean> but before </beans>
# save file with :w! and quit with :q
# Open my openmeetings-website: http://red5:5080/openmeetings, login as admin
# Go to administration / configuration an set flash.secure="true" and flash.secure.proxy="none" (already set). Save configuration
sudo /etc/init.d/red5-ubdeb2 restart
# Open: https://red5:5443/openmeetings
# --> result: No access to page/site
# I double-checked the connection:
# I can ping the server, so I can resolve the name/url
# I checked my proxy-settings: don't use a proxy for this site
# I also created a special rule in my central firewall: allow 5443 TCP from my network to the openmeetings-server
# http://red5:5080/openmeetings still works
Best wishes,
Alex
Von: Ninnig, Alexander <Al...@rechnungshof.rlp.de>
Gesendet: Freitag, 12. Juni 2020 11:08
An: user@openmeetings.apache.org
Betreff: AW: HTTPS with OpenMeetings 4 (4.0.10)
Hi Maxim,
thanks for your quick response.
Yes, I tried those.
Didn’t work.
So before I tell you everything I tried so far: can I use a config-file instead of the keystore?
Just like in OM5, where I can alter the server.xml and edit the path to the certificates?
Best wishes,
Alex
Von: Maxim Solodovnik <so...@gmail.com>
Gesendet: Freitag, 12. Juni 2020 10:41
An: Openmeetings user-list <us...@openmeetings.apache.org>
Betreff: Re: HTTPS with OpenMeetings 4 (4.0.10)
The instructions are shipped with every OM release
And can be found for ex. here https://om.alteametasoft.com/openmeetings/docs/RTMPSAndHTTPS.html
On Fri, 12 Jun 2020 at 15:31, Ninnig, Alexander <Al...@rechnungshof.rlp.de>> wrote:
Hello,
I’m really sorry to bother, but I can’t get HTTPS working with OpenMeetings 4. The site (https/5443) cannot be displayed.
I had the same problem with OpenMeetings 5, until someone told me not to use the keystore, but to alter the server.xml instead and change the lines into something like that:
<Connector port="5443"
SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateFile="/etc/mycertfolder/server.pem"
certificateKeyFile="/etc/mycertfolder/key.pem"
certificateChainFile="/etc/mycertfolder/chain.pem"
sslProtocol="TLS"/>
</SSLHostConfig>
</Connector>
As I said, that worked with OpenMeetings 5.
Unfortunately, OM5 is not production-ready yet, but I need a solution now.
And unfortunately, there is no server.xml in OM4.
I also searched the whole filesystem for strings like „Connector“, but I got no match.
Before I tell you everything I tried in ordner to make the keystore work:
Can you tell me, If there is a similar solution as the one, mentioned above, in OpenMeetings 4?
Meaning: can I simply edit a config-file and provide this config with the paths to my certificates?
Or do I have to use the keystore?
If I have to use the keystore, I will describe to you what I tried so far.
Best wishes,
Alex
--
Best regards,
Maxim
Re: HTTPS with OpenMeetings 4 (4.0.10)
Posted by Maxim Solodovnik <so...@gmail.com>.
Great, you were able to figure it out :)
On Fri, 12 Jun 2020 at 18:17, Ninnig, Alexander <
Alexander.Ninnig@rechnungshof.rlp.de> wrote:
> Hello,
>
>
>
> I found it.
>
> After I checked the log, I saw, that I still needed to change the password
> in the red5.properties-file.
>
> I wouldn’t have thought this necessary, because this step is under
> „Self-Signed Certificate“ (in docs/RTMPSAndHTTPS.html), which I don’t use
> in this scenario.
>
>
>
>
>
>
>
> That’s the mail, I was gonna send a few minutes ago, but since I was able
> to solve it, you can ignore that.
>
>
>
> Best wishes,
>
> Alex
>
>
>
>
>
>
>
>
>
> Hello,
>
>
>
> I also would like to add a log-file. But as I wrote before: If there was a
> way NOT to use the keystore (like there is in OM5), I would prefer that.
>
>
>
> So, here is the red5.log (I changed the IP-address in this mail, because I
> don’t want to give out an internal IP):
>
>
>
> 2020-06-12 12:46:47,635 [main] INFO org.red5.server.Launcher - Red5
> Server 1.1.0 (https://github.com/Red5)
>
> 2020-06-12 12:46:48,153 [main] INFO o.r.spring.Red5ApplicationContext -
> setApplicationContext:
> org.springframework.context.support.FileSystemXmlApplicationContext@7e0b85f9,
> started on Fri Jun 12 12:46:47 CEST 2020
>
> 2020-06-12 12:46:48,161 [main] INFO o.r.spring.Red5ApplicationContext -
> Red5ApplicationContext init
>
> 2020-06-12 12:46:48,864 [main] INFO o.r.spring.Red5ApplicationContext -
> setApplicationContext:
> org.springframework.context.support.FileSystemXmlApplicationContext@7e0b85f9,
> started on Fri Jun 12 12:46:47 CEST 2020
>
> 2020-06-12 12:46:48,865 [main] INFO o.r.spring.Red5ApplicationContext -
> Red5ApplicationContext init
>
> 2020-06-12 12:46:48,948 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport -
> RTMP will be bound to [0.0.0.0:1935]
>
> 2020-06-12 12:46:48,949 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport -
> RTMP Mina Transport Settings
>
> Acceptor style: default I/O threads: 8
>
> TCP no-delay: true keep-alive: false
>
> 2020-06-12 12:46:48,966 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport -
> Traffic class modification is disabled
>
> 2020-06-12 12:46:48,966 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport -
> Send buffer size: 65536 recv buffer size: 65536 so linger: -1 traffic
> class: 0
>
> 2020-06-12 12:46:49,002 [main] INFO org.red5.server.ContextLoader -
> ContextLoader init
>
> 2020-06-12 12:46:49,004 [main] INFO org.red5.server.ContextLoader -
> Loading: default.context = ${red5.root}/webapps/red5-default.xml =>
> /opt/red54010/webapps/red5-default.xml
>
> 2020-06-12 12:46:49,088 [main] INFO org.red5.server.Context - Setting
> parent bean factory as core
>
> 2020-06-12 12:46:49,093 [main] INFO o.r.net.websocket.WebSocketPlugin -
> Setting server scope listener
>
> 2020-06-12 12:46:49,094 [main] INFO o.r.net.websocket.WebSocketPlugin -
> Got global scope: default
>
> 2020-06-12 12:46:49,095 [main] INFO o.red5.server.plugin.PluginLauncher -
> Loaded plugin: org.red5.net.websocket.WebSocketPlugin
>
> 2020-06-12 12:46:49,166 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Loading Tomcat
>
> 2020-06-12 12:46:49,166 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Server root: /opt/red54010
>
> 2020-06-12 12:46:49,166 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Config root: /opt/red54010/conf
>
> 2020-06-12 12:46:49,185 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Application root: /opt/red54010/webapps
>
> 2020-06-12 12:46:49,234 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Starting Tomcat servlet engine
>
> 2020-06-12 12:46:49,422 [main] INFO o.a.c.core.AprLifecycleListener - The
> APR based Apache Tomcat Native library which allows optimal performance in
> production environments was not found on the java.library.path:
> [/opt/red54010/lib/native]
>
> 2020-06-12 12:46:49,427 [main] INFO o.a.c.http11.Http11Nio2Protocol -
> Initializing ProtocolHandler ["http-nio2-0.0.0.0-5080"]
>
> 2020-06-12 12:46:49,464 [main] INFO o.a.c.http11.Http11Nio2Protocol -
> Initializing ProtocolHandler ["https-jsse-nio2-0.0.0.0-5443"]
>
> 2020-06-12 12:46:55,045 [main] WARN o.a.tomcat.util.net.Nio2Endpoint -
> The executor associated with thread pool [https-jsse-nio2-0.0.0.0-5443] has
> not fully shutdown. Some application threads may still be running.
>
> 2020-06-12 12:46:55,053 [main] ERROR o.a.catalina.util.LifecycleBase -
> Failed to initialize component
> [Connector[org.apache.coyote.http11.Http11Nio2Protocol-5443]]
>
> org.apache.catalina.LifecycleException: Protocol handler initialization
> failed
>
> at
> org.apache.catalina.connector.Connector.initInternal(Connector.java:983)
>
> at
> org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
>
> at
> org.apache.catalina.core.StandardService.initInternal(StandardService.java:533)
>
> at
> org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
>
> at
> org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1057)
>
> at
> org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
>
> at
> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:173)
>
> at
> org.apache.catalina.startup.Tomcat.start(Tomcat.java:459)
>
> at
> org.red5.server.tomcat.TomcatLoader.start(TomcatLoader.java:381)
>
> at
> org.red5.server.tomcat.TomcatLoader.afterPropertiesSet(TomcatLoader.java:177)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1855)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1792)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:595)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:517)
>
> at
> org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:323)
>
> at
> org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
>
> at
> org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:321)
>
> at
> org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:227)
>
> at
> org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveNamedBean(DefaultListableBeanFactory.java:1155)
>
> at
> org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveBean(DefaultListableBeanFactory.java:416)
>
> at
> org.springframework.beans.factory.support.DefaultListableBeanFactory.getBean(DefaultListableBeanFactory.java:349)
>
> at
> org.springframework.beans.factory.support.DefaultListableBeanFactory.getBean(DefaultListableBeanFactory.java:342)
>
> at
> org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1126)
>
> at
> org.red5.server.service.ShutdownServer.afterPropertiesSet(ShutdownServer.java:116)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1855)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1792)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:595)
>
> at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:517)
>
> at
> org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:323)
>
> at
> org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
>
> at
> org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:321)
>
> at
> org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
>
> at
> org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:879)
>
> at
> org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:878)
>
> at
> org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550)
>
> at org.red5.server.Launcher.launch(Launcher.java:73)
>
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
> Method)
>
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>
> at
> java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>
> at
> java.base/java.lang.reflect.Method.invoke(Method.java:566)
>
> at org.red5.server.Bootstrap.bootStrap(Bootstrap.java:123)
>
> at org.red5.server.Bootstrap.main(Bootstrap.java:51)
>
> Caused by: java.lang.IllegalArgumentException: keystore password was
> incorrect
>
> at
> org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:99)
>
> at
> org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
>
> at
> org.apache.tomcat.util.net.Nio2Endpoint.bind(Nio2Endpoint.java:142)
>
> at
> org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1142)
>
> at
> org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1155)
>
> at
> org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:575)
>
> at
> org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)
>
> at
> org.apache.catalina.connector.Connector.initInternal(Connector.java:980)
>
> ... 41 common frames omitted
>
> Caused by: java.io.IOException: keystore password was incorrect
>
> at
> java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2108)
>
> at
> java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243)
>
> at
> java.base/java.security.KeyStore.load(KeyStore.java:1479)
>
> at
> org.apache.tomcat.util.security.KeyStoreUtil.load(KeyStoreUtil.java:69)
>
> at
> org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:217)
>
> at
> org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:206)
>
> at
> org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:283)
>
> at
> org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:247)
>
> at
> org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:97)
>
> ... 48 common frames omitted
>
> Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe
> contents entry: javax.crypto.BadPaddingException: Given final block not
> properly padded. Such issues can arise if a bad key is used during
> decryption.
>
> ... 57 common frames omitted
>
> 2020-06-12 12:46:55,070 [main] INFO o.a.catalina.core.StandardService -
> Starting service [Tomcat]
>
> 2020-06-12 12:46:55,070 [main] INFO o.a.catalina.core.StandardEngine -
> Starting Servlet engine: [Apache Tomcat/9.0.29]
>
> 2020-06-12 12:46:55,199 [main] INFO o.a.catalina.startup.ContextConfig -
> No global web.xml found
>
> 2020-06-12 12:46:55,305 [main] INFO o.a.c.c.C.[.[0.0.0.0].[/] - No Spring
> WebApplicationInitializer types detected on classpath
>
> 2020-06-12 12:46:56,886 [main] INFO o.a.c.c.C.[.[.0.0.0.[/openmeetings] -
> No Spring WebApplicationInitializer types detected on classpath
>
> 2020-06-12 12:46:56,980 [main] INFO c.h.config.AbstractConfigLocator -
> Loading 'hazelcast.xml' from the classpath.
>
> 2020-06-12 12:46:57,047 [main] WARN c.h.config.AbstractXmlConfigHelper -
> Name of the hazelcast schema location is incorrect, using default
>
> 2020-06-12 12:46:57,251 [main] WARN c.h.i.HazelcastInstanceFactory -
> Hazelcast is starting in a Java modular environment (Java 9 and newer) but
> without proper access to required Java packages. Use additional Java
> arguments to provide Hazelcast access to Java internal API. The internal
> API access is used to get the best performance results. Arguments to be
> used:
>
> --add-modules java.se --add-exports
> java.base/jdk.internal.ref=ALL-UNNAMED --add-opens
> java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.nio=ALL-UNNAMED
> --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens
> java.management/sun.management=ALL-UNNAMED --add-opens
> jdk.management/com.sun.management.internal=ALL-UNNAMED
>
> 2020-06-12 12:46:57,292 [main] INFO c.hazelcast.instance.AddressPicker -
> [LOCAL] [dev] [3.12] Prefer IPv4 stack is true, prefer IPv6 addresses is
> false
>
> 2020-06-12 12:46:57,296 [main] INFO c.hazelcast.instance.AddressPicker -
> [LOCAL] [dev] [3.12] Picked [192.168.0.50]:5701, using socket
> ServerSocket[addr=/0:0:0:0:0:0:0:0,localport=5701], bind any local is true
>
> 2020-06-12 12:46:57,307 [main] INFO com.hazelcast.system -
> [192.168.0.50]:5701 [dev] [3.12] Hazelcast 3.12 (20190409 - 915d83a)
> starting at [192.168.0.50]:5701
>
> 2020-06-12 12:46:57,308 [main] INFO com.hazelcast.system -
> [192.168.0.50]:5701 [dev] [3.12] Copyright (c) 2008-2019, Hazelcast, Inc.
> All Rights Reserved.
>
> 2020-06-12 12:46:57,631 [main] INFO c.h.s.i.o.i.BackpressureRegulator -
> [192.168.0.50]:5701 [dev] [3.12] Backpressure is disabled
>
> 2020-06-12 12:46:58,414 [main] INFO c.h.s.i.o.i.OperationExecutorImpl -
> [192.168.0.50]:5701 [dev] [3.12] Starting 4 partition threads and 3 generic
> threads (1 dedicated for priority tasks)
>
> 2020-06-12 12:46:58,421 [main] INFO c.h.i.diagnostics.Diagnostics -
> [192.168.0.50]:5701 [dev] [3.12] Diagnostics disabled. To enable add
> -Dhazelcast.diagnostics.enabled=true to the JVM arguments.
>
> 2020-06-12 12:46:58,432 [main] INFO com.hazelcast.core.LifecycleService -
> [192.168.0.50]:5701 [dev] [3.12] [192.168.0.50]:5701 is STARTING
>
> 2020-06-12 12:46:58,448 [main] WARN com.hazelcast.instance.Node -
> [192.168.0.50]:5701 [dev] [3.12] No join method is enabled! Starting
> standalone.
>
> 2020-06-12 12:46:58,470 [main] INFO com.hazelcast.core.LifecycleService -
> [192.168.0.50]:5701 [dev] [3.12] [192.168.0.50]:5701 is STARTED
>
> 2020-06-12 12:46:58,484 [main] INFO o.a.wicket.util.file.WebXmlFile -
> web.xml: url mapping found for filter with name OpenmeetingsApplication:
> [/*]
>
> 2020-06-12 12:46:58,582 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init:
> org.wicketstuff.dashboard.DashboardContextInitializer@71637a85
>
> 2020-06-12 12:46:58,704 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: Wicket core library initializer
>
> 2020-06-12 12:46:58,705 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: DevUtils DebugBar Initializer
>
> 2020-06-12 12:46:58,706 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: Wicket extensions initializer
>
> 2020-06-12 12:46:58,715 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: Wicket Kendo UI initializer
>
> 2020-06-12 12:46:58,716 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: Wicket jQuery UI initializer (plugins)
>
> 2020-06-12 12:46:58,717 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: Wicket Kendo UI initializer (theme-default)
>
> 2020-06-12 12:46:58,719 [main] INFO org.apache.wicket.Application -
> [OpenmeetingsApplication] init: Wicket jQuery UI initializer
>
> 2020-06-12 12:46:58,765 [main] INFO o.a.w.protocol.http.WebApplication -
> [OpenmeetingsApplication] Started Wicket version 8.6.1 in DEPLOYMENT mode
>
> 2020-06-12 12:46:59,428 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /
>
> 2020-06-12 12:46:59,529 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.CalendarWebService
> from class org.apache.openmeetings.webservice.CalendarWebService
>
> 2020-06-12 12:47:00,162 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /CalendarService
>
> 2020-06-12 12:47:00,169 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.ErrorWebService
> from class org.apache.openmeetings.webservice.ErrorWebService
>
> 2020-06-12 12:47:00,195 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /ErrorService
>
> 2020-06-12 12:47:00,197 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.GroupWebService
> from class org.apache.openmeetings.webservice.GroupWebService
>
> 2020-06-12 12:47:00,299 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /GroupService
>
> 2020-06-12 12:47:00,301 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.InfoWebService
> from class org.apache.openmeetings.webservice.InfoWebService
>
> 2020-06-12 12:47:00,325 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /InfoService
>
> 2020-06-12 12:47:00,328 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.FileWebService
> from class org.apache.openmeetings.webservice.FileWebService
>
> 2020-06-12 12:47:00,420 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /FileService
>
> 2020-06-12 12:47:00,422 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.RecordingWebService
> from class org.apache.openmeetings.webservice.RecordingWebService
>
> 2020-06-12 12:47:00,468 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /RecordService
>
> 2020-06-12 12:47:00,472 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.RoomWebService
> from class org.apache.openmeetings.webservice.RoomWebService
>
> 2020-06-12 12:47:00,659 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /RoomService
>
> 2020-06-12 12:47:00,662 [main] INFO
> o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {
> http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.UserWebService
> from class org.apache.openmeetings.webservice.UserWebService
>
> 2020-06-12 12:47:00,740 [main] INFO org.apache.cxf.endpoint.ServerImpl -
> Setting the server's publish address to be /UserService
>
> 2020-06-12 12:47:00,781 [main] INFO o.a.c.http11.Http11Nio2Protocol -
> Starting ProtocolHandler ["http-nio2-0.0.0.0-5080"]
>
> 2020-06-12 12:47:00,784 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Context initialized: path: /opt/red54010/webapps/root/
>
> 2020-06-12 12:47:00,789 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Context initialized: /openmeetings path: /opt/red54010/webapps/openmeetings/
>
> 2020-06-12 12:47:00,789 [main] INFO org.red5.server.tomcat.TomcatLoader -
> Dedicated RTMPT server configuration was not specified
>
> 2020-06-12 12:47:00,796 [main] INFO o.r.server.service.ShutdownServer -
> JEE server was found: TomcatLoader [serviceEngineName=red5Engine]
>
> 2020-06-12 12:47:00,857 [Loader:] INFO org.red5.server.Context - Setting
> parent bean factory as core
>
> 2020-06-12 12:47:00,872 [Loader:] INFO org.red5.server.scope.WebScope -
> Set server [Server@4559116map[[empty]]]
>
> 2020-06-12 12:47:00,882 [Loader:] INFO org.red5.server.scope.Scope -
> Scope null name reset to: disallowed
>
> 2020-06-12 12:47:00,888 [Loader:] INFO org.red5.server.Server - Add
> mapping global: default host: context: null
>
> 2020-06-12 12:47:00,888 [Loader:] INFO org.red5.server.scope.Scope -
> Invalid scope name, null is not allowed
>
> 2020-06-12 12:47:00,888 [Loader:] WARN org.red5.server.scope.Scope -
> Invalid scope rejected: Scope [name=null, path=/default, type=APPLICATION,
> autoStart=true, creationTime=1591958820859, depth=1, enabled=true,
> running=false]
>
> 2020-06-12 12:47:00,888 [Loader:] WARN org.red5.server.scope.Scope -
> Scope not added to parent
>
> 2020-06-12 12:47:00,888 [Loader:] INFO org.red5.server.scope.WebScope -
> Webscope already registered; remove the 'init-method' from your 'web.scope'
> bean to prevent this message in the future.
>
> 2020-06-12 12:47:01,547 [Loader:/openmeetings] INFO
> org.red5.server.Context - Setting parent bean factory as core
>
> 2020-06-12 12:47:01,780 [Loader:/openmeetings] INFO
> o.s.o.j.LocalEntityManagerFactoryBean - Initialized JPA
> EntityManagerFactory for persistence unit 'openmeetings'
>
> 2020-06-12 12:47:01,890 [Loader:/openmeetings] INFO
> c.h.config.AbstractConfigLocator - Loading 'hazelcast.xml' from the
> classpath.
>
> 2020-06-12 12:47:01,913 [Loader:/openmeetings] WARN
> c.h.config.AbstractXmlConfigHelper - Name of the hazelcast schema location
> is incorrect, using default
>
> 2020-06-12 12:47:01,993 [Loader:/openmeetings] INFO
> c.h.i.p.impl.PartitionStateManager - [192.168.0.50]:5701 [dev] [3.12]
> Initializing cluster partition table arrangement...
>
> 2020-06-12 12:47:02,221 [Loader:/openmeetings] INFO
> org.red5.server.scope.WebScope - Set server [Server@4559116map['/' ->
> 'default']]
>
> 2020-06-12 12:47:02,233 [Loader:/openmeetings] INFO
> org.red5.server.Server - Add mapping global: default host: context:
> openmeetings
>
> 2020-06-12 12:47:02,233 [Loader:/openmeetings] INFO
> org.red5.server.Server - Add mapping global: default host: localhost
> context: openmeetings
>
> 2020-06-12 12:47:02,233 [Loader:/openmeetings] INFO
> org.red5.server.Server - Add mapping global: default host: 127.0.0.1
> context: openmeetings
>
> 2020-06-12 12:47:03,883 [pool-1-thread-1] INFO
> o.r.net.websocket.WebSocketPlugin - Creating WebSocketScopeManager for
> org.apache.openmeetings.core.remote.ScopeApplicationAdapter@2d9bfee2
>
> 2020-06-12 12:47:03,883 [pool-1-thread-1] INFO
> o.r.net.websocket.WebSocketPlugin - WebSocketPlugin application:
> org.apache.openmeetings.core.remote.ScopeApplicationAdapter@2d9bfee2
>
> 2020-06-12 12:47:03,885 [pool-1-thread-1] INFO
> o.red5.net.websocket.WebSocketScope - Application scope: Scope
> [name=openmeetings, path=/default, type=APPLICATION, autoStart=true,
> creationTime=1591958821575, depth=1, enabled=true, running=true]
>
> 2020-06-12 12:47:03,886 [pool-1-thread-1] INFO
> o.r.n.w.WebSocketScopeManager - addWebSocketScope: WebSocketScope
> [path=/openmeetings, listeners=0, connections=0]
>
> 2020-06-12 12:47:03,888 [pool-1-thread-1] INFO
> o.red5.net.websocket.WebSocketScope - WebSocket scope added
>
> 2020-06-12 12:47:04,170 [Loader:/openmeetings] INFO
> org.quartz.impl.StdSchedulerFactory - Using default implementation for
> ThreadExecutor
>
> 2020-06-12 12:47:04,194 [Loader:/openmeetings] INFO
> o.quartz.core.SchedulerSignalerImpl - Initialized Scheduler Signaller of
> type: class org.quartz.core.SchedulerSignalerImpl
>
> 2020-06-12 12:47:04,194 [Loader:/openmeetings] INFO
> org.quartz.core.QuartzScheduler - Quartz Scheduler v.2.3.2 created.
>
> 2020-06-12 12:47:04,195 [Loader:/openmeetings] INFO
> org.quartz.simpl.RAMJobStore - RAMJobStore initialized.
>
> 2020-06-12 12:47:04,196 [Loader:/openmeetings] INFO
> org.quartz.core.QuartzScheduler - Scheduler meta-data: Quartz Scheduler
> (v2.3.2) 'org.springframework.scheduling.quartz.SchedulerFactoryBean#0'
> with instanceId 'NON_CLUSTERED'
>
> Scheduler class: 'org.quartz.core.QuartzScheduler' - running locally.
>
> NOT STARTED.
>
> Currently in standby mode.
>
> Number of jobs executed: 0
>
> Using thread pool 'org.quartz.simpl.SimpleThreadPool' - with 10 threads.
>
> Using job-store 'org.quartz.simpl.RAMJobStore' - which does not support
> persistence. and is not clustered.
>
>
>
> 2020-06-12 12:47:04,196 [Loader:/openmeetings] INFO
> org.quartz.impl.StdSchedulerFactory - Quartz scheduler
> 'org.springframework.scheduling.quartz.SchedulerFactoryBean#0' initialized
> from an externally provided properties instance.
>
> 2020-06-12 12:47:04,196 [Loader:/openmeetings] INFO
> org.quartz.impl.StdSchedulerFactory - Quartz scheduler version: 2.3.2
>
> 2020-06-12 12:47:04,197 [Loader:/openmeetings] INFO
> org.quartz.core.QuartzScheduler - JobFactory set to:
> org.springframework.scheduling.quartz.AdaptableJobFactory@7058b729
>
> 2020-06-12 12:47:04,214 [Loader:/openmeetings] INFO
> org.quartz.core.QuartzScheduler - Scheduler
> org.springframework.scheduling.quartz.SchedulerFactoryBean#0_$_NON_CLUSTERED
> started.
>
>
>
> *Von:* Ninnig, Alexander <Al...@rechnungshof.rlp.de>
> *Gesendet:* Freitag, 12. Juni 2020 13:05
> *An:* user@openmeetings.apache.org
> *Betreff:* WG: HTTPS with OpenMeetings 4 (4.0.10)
>
>
>
> Hello again,
>
>
>
> as I said before: if that was a way, *I would prefer to use PEM-files and
> configure the path to these pem-files in a config-file*.
>
> *That works in OpenMeetings 5, where I can just edit the server.xml*
> (section: *<Connector port="5443">*)
>
>
>
> *In case that DOESN’T work in OpenMeetings 4*: I repeated all the steps
> from the official instructions (shipped with my OM,
> docs/RTMPSAndHTTPS.html).
>
> Just to be sure, I did all these steps on a fresh and INTERNAL
> OpenMeetings4-server, so there is no way, our central firewall would be the
> problem.
> I also used the default-password (changeit) and the url „red5“ (I created
> an entry in my Windows-hosts-file).
>
> I was really thorough, I can find no error.
>
>
>
> Here is what I did:
>
>
>
> cd /opt/red54010/conf
>
> sudo mv keystore.jmx keystore.bak
>
> sudo mv truststore.jmx truststore.bak
>
>
>
> sudo keytool -keysize 2048 -genkey -alias red5 -keyalg RSA -keystore
> /opt/red54010/conf/keystore.jks
>
> # changeit
>
> # changeit
>
> # red5
>
> # IT
>
> # Organization
>
> # City
>
> # State
>
> # DE
>
> # yes
>
>
>
> sudo keytool -certreq -keyalg RSA -alias red5 -file red5.csr -keystore
> /opt/red54010/conf/keystore.jks
>
> # changeit
>
>
>
> sudo cp red5.csr /media/netshare/
>
> # https://myissuingca/certsrv - This is a Microsoft
> Windows Server 2012 R2 Server with an intermediate CA
>
> # "Request a certificate"
>
> # "Submit an advanced certificate request"
>
> # "Submit a certificate request that uses a Base64-encoded CMD
> or PKCS10 file, or a renewal request that uses a Base64-encoded PKCS7 file"
>
> # I open the CSR-File I copied on my Windows-Server-Netshare
> with notepad.exe, I copy & paste the whole text into the input-field of my
> CA-website
>
> # "Choose certificate-template": I choose "Webserver" which is
> a default-template (I normally would use a template I created
> ("webserveradvanced"), which allows me to export the private key)
>
> # Field "Additional Attributes" stays empty - send in request
>
> # Certificate is created, I have 4 download-options:
> DER-certificate [cer], DER-certificate with complete chain [p7b],
> BASE64-certificate [cer], BASE64-certificate with complete chain [p7b]. I
> download them all:
>
> # red5_DER.cer, red5_DER.p7b, red5_Base64.cer, red5_Base64.p7b
>
> # I copy the files in my netshare-folder
>
>
>
> sudo cp /media/netshare/red5*.cer /opt/red54010/conf/
>
> sudo cp /media/netshare/red5*.p7b /opt/red54010/conf/
>
>
>
> # I copy the certificates of my root-CA and my issuing-CA
> (intermediate CA) onto my Windows-Server-Netshare. I double-check the
> files, so I can be sure, those are the right ones
>
>
>
> sudo cp /media/netshare/root.crt /opt/red54010/conf/
>
> sudo cp /media/netshare/intermediate.crt /opt/red54010/conf/
>
>
>
> # I check with: ls. Yes, everything is there.
>
>
>
> cd /opt/red54010/conf
>
> sudo keytool -import -alias root -keystore /opt/red54010/conf/keystore.jks
> -trustcacerts -file root.crt
>
> # changeit
>
> # Trust this certificate: yes [I checked: yes, it is the
> certificate of my root-CA]
>
> # certificate was added to keystore
>
> sudo keytool -import -alias intermed -keystore
> /opt/red54010/conf/keystore.jks -trustcacerts -file intermediate.crt
>
> # changeit
>
> # certificate was added to keystore
>
> sudo keytool -import -alias red5 -keystore /opt/red54010/conf/keystore.jks
> -trustcacerts -file red5_Base64.cer
>
> # I chose the Base64-certificate without chain
>
> # changeit
>
> # Certificate reply was installed in keystore
>
>
>
> sudo cp keystore.jks truststore.jks
>
> sudo cp keystore.jks keystore.screen
>
>
>
> sudo cp jee-container.xml jee-container.bak
>
> sudo vi jee-container.xml
>
> # search for <!-- Tomcat without SSL enabled -->
>
> # and comment-out the whole section, so:
>
> # <!-- <bean id="tomcat.server" (...)
>
> # </bean> -->
>
> # search for <! Tomcat with SSL enabled -->
>
> # and remove the comment for the whole section, so
>
> # remove <!-- before <bean id="tomcat.server" (...)
>
> # and remove --> right after </bean> but before </beans>
>
> # save file with :w! and quit with :q
>
>
>
> # Open my openmeetings-website: http://red5:5080/openmeetings,
> login as admin
>
> # Go to administration / configuration an set
> flash.secure="true" and flash.secure.proxy="none" (already set). Save
> configuration
>
>
>
> sudo /etc/init.d/red5-ubdeb2 restart
>
>
>
> # Open: https://red5:5443/openmeetings
>
> # --> result: No access to page/site
>
>
>
> # I double-checked the connection:
>
> # I can ping the server, so I can resolve the name/url
>
> # I checked my proxy-settings: don't use a proxy for this site
>
> # I also created a special rule in my central firewall: allow
> 5443 TCP from my network to the openmeetings-server
>
> # http://red5:5080/openmeetings still works
>
>
>
>
>
> Best wishes,
>
> Alex
>
>
>
> *Von:* Ninnig, Alexander <Al...@rechnungshof.rlp.de>
> *Gesendet:* Freitag, 12. Juni 2020 11:08
> *An:* user@openmeetings.apache.org
> *Betreff:* AW: HTTPS with OpenMeetings 4 (4.0.10)
>
>
>
> Hi Maxim,
>
>
>
> thanks for your quick response.
>
>
>
> Yes, I tried those.
>
> Didn’t work.
>
> So before I tell you everything I tried so far: can I use a config-file
> instead of the keystore?
>
> Just like in OM5, where I can alter the server.xml and edit the path to
> the certificates?
>
>
>
>
>
>
>
> Best wishes,
>
> Alex
>
>
>
> *Von:* Maxim Solodovnik <so...@gmail.com>
> *Gesendet:* Freitag, 12. Juni 2020 10:41
> *An:* Openmeetings user-list <us...@openmeetings.apache.org>
> *Betreff:* Re: HTTPS with OpenMeetings 4 (4.0.10)
>
>
>
> The instructions are shipped with every OM release
>
> And can be found for ex. here
> https://om.alteametasoft.com/openmeetings/docs/RTMPSAndHTTPS.html
>
>
>
> On Fri, 12 Jun 2020 at 15:31, Ninnig, Alexander <
> Alexander.Ninnig@rechnungshof.rlp.de> wrote:
>
> Hello,
>
>
>
> I’m really sorry to bother, but I can’t get HTTPS working with
> OpenMeetings 4. The site (https/5443) cannot be displayed.
>
>
>
> I had the same problem with OpenMeetings 5, until someone told me not to
> use the keystore, but to alter the server.xml instead and change the lines
> into something like that:
>
> <Connector port="5443"
>
> SSLEnabled="true">
>
> <SSLHostConfig>
>
> <Certificate certificateFile="/etc/mycertfolder/server.pem"
>
> certificateKeyFile="/etc/mycertfolder/key.pem"
>
> certificateChainFile="/etc/mycertfolder/chain.pem"
>
> sslProtocol="TLS"/>
>
> </SSLHostConfig>
>
> </Connector>
>
> As I said, that worked with OpenMeetings 5.
>
> Unfortunately, OM5 is not production-ready yet, but I need a solution now.
>
> And unfortunately, there is no server.xml in OM4.
>
> I also searched the whole filesystem for strings like „Connector“, but I
> got no match.
>
>
>
> Before I tell you everything I tried in ordner to make the keystore work:
>
> Can you tell me, If there is a similar solution as the one, mentioned
> above, in OpenMeetings 4?
>
> Meaning: *can I simply edit a config-file and provide this config with
> the paths to my certificates?*
>
> *Or do I have to use the keystore?*
>
>
>
> If I have to use the keystore, I will describe to you what I tried so far.
>
>
>
> Best wishes,
>
> Alex
>
>
>
>
>
>
>
>
>
>
> --
>
> Best regards,
> Maxim
>
--
Best regards,
Maxim
AW: HTTPS with OpenMeetings 4 (4.0.10)
Posted by "Ninnig, Alexander" <Al...@rechnungshof.rlp.de>.
Hello,
I found it.
After I checked the log, I saw, that I still needed to change the password in the red5.properties-file.
I wouldn’t have thought this necessary, because this step is under „Self-Signed Certificate“ (in docs/RTMPSAndHTTPS.html), which I don’t use in this scenario.
That’s the mail, I was gonna send a few minutes ago, but since I was able to solve it, you can ignore that.
Best wishes,
Alex
Hello,
I also would like to add a log-file. But as I wrote before: If there was a way NOT to use the keystore (like there is in OM5), I would prefer that.
So, here is the red5.log (I changed the IP-address in this mail, because I don’t want to give out an internal IP):
2020-06-12 12:46:47,635 [main] INFO org.red5.server.Launcher - Red5 Server 1.1.0 (https://github.com/Red5)
2020-06-12 12:46:48,153 [main] INFO o.r.spring.Red5ApplicationContext - setApplicationContext: org.springframework.context.support.FileSystemXmlApplicationContext@7e0b85f9, started on Fri Jun 12 12:46:47 CEST 2020
2020-06-12 12:46:48,161 [main] INFO o.r.spring.Red5ApplicationContext - Red5ApplicationContext init
2020-06-12 12:46:48,864 [main] INFO o.r.spring.Red5ApplicationContext - setApplicationContext: org.springframework.context.support.FileSystemXmlApplicationContext@7e0b85f9, started on Fri Jun 12 12:46:47 CEST 2020
2020-06-12 12:46:48,865 [main] INFO o.r.spring.Red5ApplicationContext - Red5ApplicationContext init
2020-06-12 12:46:48,948 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport - RTMP will be bound to [0.0.0.0:1935]
2020-06-12 12:46:48,949 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport - RTMP Mina Transport Settings
Acceptor style: default I/O threads: 8
TCP no-delay: true keep-alive: false
2020-06-12 12:46:48,966 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport - Traffic class modification is disabled
2020-06-12 12:46:48,966 [main] INFO o.r.s.net.rtmp.RTMPMinaTransport - Send buffer size: 65536 recv buffer size: 65536 so linger: -1 traffic class: 0
2020-06-12 12:46:49,002 [main] INFO org.red5.server.ContextLoader - ContextLoader init
2020-06-12 12:46:49,004 [main] INFO org.red5.server.ContextLoader - Loading: default.context = ${red5.root}/webapps/red5-default.xml => /opt/red54010/webapps/red5-default.xml
2020-06-12 12:46:49,088 [main] INFO org.red5.server.Context - Setting parent bean factory as core
2020-06-12 12:46:49,093 [main] INFO o.r.net.websocket.WebSocketPlugin - Setting server scope listener
2020-06-12 12:46:49,094 [main] INFO o.r.net.websocket.WebSocketPlugin - Got global scope: default
2020-06-12 12:46:49,095 [main] INFO o.red5.server.plugin.PluginLauncher - Loaded plugin: org.red5.net.websocket.WebSocketPlugin
2020-06-12 12:46:49,166 [main] INFO org.red5.server.tomcat.TomcatLoader - Loading Tomcat
2020-06-12 12:46:49,166 [main] INFO org.red5.server.tomcat.TomcatLoader - Server root: /opt/red54010
2020-06-12 12:46:49,166 [main] INFO org.red5.server.tomcat.TomcatLoader - Config root: /opt/red54010/conf
2020-06-12 12:46:49,185 [main] INFO org.red5.server.tomcat.TomcatLoader - Application root: /opt/red54010/webapps
2020-06-12 12:46:49,234 [main] INFO org.red5.server.tomcat.TomcatLoader - Starting Tomcat servlet engine
2020-06-12 12:46:49,422 [main] INFO o.a.c.core.AprLifecycleListener - The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/opt/red54010/lib/native]
2020-06-12 12:46:49,427 [main] INFO o.a.c.http11.Http11Nio2Protocol - Initializing ProtocolHandler ["http-nio2-0.0.0.0-5080"]
2020-06-12 12:46:49,464 [main] INFO o.a.c.http11.Http11Nio2Protocol - Initializing ProtocolHandler ["https-jsse-nio2-0.0.0.0-5443"]
2020-06-12 12:46:55,045 [main] WARN o.a.tomcat.util.net.Nio2Endpoint - The executor associated with thread pool [https-jsse-nio2-0.0.0.0-5443] has not fully shutdown. Some application threads may still be running.
2020-06-12 12:46:55,053 [main] ERROR o.a.catalina.util.LifecycleBase - Failed to initialize component [Connector[org.apache.coyote.http11.Http11Nio2Protocol-5443]]
org.apache.catalina.LifecycleException: Protocol handler initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:983)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:533)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1057)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:173)
at org.apache.catalina.startup.Tomcat.start(Tomcat.java:459)
at org.red5.server.tomcat.TomcatLoader.start(TomcatLoader.java:381)
at org.red5.server.tomcat.TomcatLoader.afterPropertiesSet(TomcatLoader.java:177)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1855)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1792)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:595)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:517)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:323)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:321)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:227)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveNamedBean(DefaultListableBeanFactory.java:1155)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveBean(DefaultListableBeanFactory.java:416)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBean(DefaultListableBeanFactory.java:349)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBean(DefaultListableBeanFactory.java:342)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1126)
at org.red5.server.service.ShutdownServer.afterPropertiesSet(ShutdownServer.java:116)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1855)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1792)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:595)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:517)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:323)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:321)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:879)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:878)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550)
at org.red5.server.Launcher.launch(Launcher.java:73)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.red5.server.Bootstrap.bootStrap(Bootstrap.java:123)
at org.red5.server.Bootstrap.main(Bootstrap.java:51)
Caused by: java.lang.IllegalArgumentException: keystore password was incorrect
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:99)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
at org.apache.tomcat.util.net.Nio2Endpoint.bind(Nio2Endpoint.java:142)
at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1142)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1155)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:575)
at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:980)
... 41 common frames omitted
Caused by: java.io.IOException: keystore password was incorrect
at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2108)
at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243)
at java.base/java.security.KeyStore.load(KeyStore.java:1479)
at org.apache.tomcat.util.security.KeyStoreUtil.load(KeyStoreUtil.java:69)
at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:217)
at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:206)
at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:283)
at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:247)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:97)
... 48 common frames omitted
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
... 57 common frames omitted
2020-06-12 12:46:55,070 [main] INFO o.a.catalina.core.StandardService - Starting service [Tomcat]
2020-06-12 12:46:55,070 [main] INFO o.a.catalina.core.StandardEngine - Starting Servlet engine: [Apache Tomcat/9.0.29]
2020-06-12 12:46:55,199 [main] INFO o.a.catalina.startup.ContextConfig - No global web.xml found
2020-06-12 12:46:55,305 [main] INFO o.a.c.c.C.[.[0.0.0.0].[/] - No Spring WebApplicationInitializer types detected on classpath
2020-06-12 12:46:56,886 [main] INFO o.a.c.c.C.[.[.0.0.0.[/openmeetings] - No Spring WebApplicationInitializer types detected on classpath
2020-06-12 12:46:56,980 [main] INFO c.h.config.AbstractConfigLocator - Loading 'hazelcast.xml' from the classpath.
2020-06-12 12:46:57,047 [main] WARN c.h.config.AbstractXmlConfigHelper - Name of the hazelcast schema location is incorrect, using default
2020-06-12 12:46:57,251 [main] WARN c.h.i.HazelcastInstanceFactory - Hazelcast is starting in a Java modular environment (Java 9 and newer) but without proper access to required Java packages. Use additional Java arguments to provide Hazelcast access to Java internal API. The internal API access is used to get the best performance results. Arguments to be used:
--add-modules java.se --add-exports java.base/jdk.internal.ref=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.nio=ALL-UNNAMED --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens java.management/sun.management=ALL-UNNAMED --add-opens jdk.management/com.sun.management.internal=ALL-UNNAMED
2020-06-12 12:46:57,292 [main] INFO c.hazelcast.instance.AddressPicker - [LOCAL] [dev] [3.12] Prefer IPv4 stack is true, prefer IPv6 addresses is false
2020-06-12 12:46:57,296 [main] INFO c.hazelcast.instance.AddressPicker - [LOCAL] [dev] [3.12] Picked [192.168.0.50]:5701, using socket ServerSocket[addr=/0:0:0:0:0:0:0:0,localport=5701], bind any local is true
2020-06-12 12:46:57,307 [main] INFO com.hazelcast.system - [192.168.0.50]:5701 [dev] [3.12] Hazelcast 3.12 (20190409 - 915d83a) starting at [192.168.0.50]:5701
2020-06-12 12:46:57,308 [main] INFO com.hazelcast.system - [192.168.0.50]:5701 [dev] [3.12] Copyright (c) 2008-2019, Hazelcast, Inc. All Rights Reserved.
2020-06-12 12:46:57,631 [main] INFO c.h.s.i.o.i.BackpressureRegulator - [192.168.0.50]:5701 [dev] [3.12] Backpressure is disabled
2020-06-12 12:46:58,414 [main] INFO c.h.s.i.o.i.OperationExecutorImpl - [192.168.0.50]:5701 [dev] [3.12] Starting 4 partition threads and 3 generic threads (1 dedicated for priority tasks)
2020-06-12 12:46:58,421 [main] INFO c.h.i.diagnostics.Diagnostics - [192.168.0.50]:5701 [dev] [3.12] Diagnostics disabled. To enable add -Dhazelcast.diagnostics.enabled=true to the JVM arguments.
2020-06-12 12:46:58,432 [main] INFO com.hazelcast.core.LifecycleService - [192.168.0.50]:5701 [dev] [3.12] [192.168.0.50]:5701 is STARTING
2020-06-12 12:46:58,448 [main] WARN com.hazelcast.instance.Node - [192.168.0.50]:5701 [dev] [3.12] No join method is enabled! Starting standalone.
2020-06-12 12:46:58,470 [main] INFO com.hazelcast.core.LifecycleService - [192.168.0.50]:5701 [dev] [3.12] [192.168.0.50]:5701 is STARTED
2020-06-12 12:46:58,484 [main] INFO o.a.wicket.util.file.WebXmlFile - web.xml: url mapping found for filter with name OpenmeetingsApplication: [/*]
2020-06-12 12:46:58,582 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: org.wicketstuff.dashboard.DashboardContextInitializer@71637a85
2020-06-12 12:46:58,704 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: Wicket core library initializer
2020-06-12 12:46:58,705 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: DevUtils DebugBar Initializer
2020-06-12 12:46:58,706 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: Wicket extensions initializer
2020-06-12 12:46:58,715 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: Wicket Kendo UI initializer
2020-06-12 12:46:58,716 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: Wicket jQuery UI initializer (plugins)
2020-06-12 12:46:58,717 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: Wicket Kendo UI initializer (theme-default)
2020-06-12 12:46:58,719 [main] INFO org.apache.wicket.Application - [OpenmeetingsApplication] init: Wicket jQuery UI initializer
2020-06-12 12:46:58,765 [main] INFO o.a.w.protocol.http.WebApplication - [OpenmeetingsApplication] Started Wicket version 8.6.1 in DEPLOYMENT mode
2020-06-12 12:46:59,428 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /
2020-06-12 12:46:59,529 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.CalendarWebService from class org.apache.openmeetings.webservice.CalendarWebService
2020-06-12 12:47:00,162 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /CalendarService
2020-06-12 12:47:00,169 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.ErrorWebService from class org.apache.openmeetings.webservice.ErrorWebService
2020-06-12 12:47:00,195 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /ErrorService
2020-06-12 12:47:00,197 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.GroupWebService from class org.apache.openmeetings.webservice.GroupWebService
2020-06-12 12:47:00,299 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /GroupService
2020-06-12 12:47:00,301 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.InfoWebService from class org.apache.openmeetings.webservice.InfoWebService
2020-06-12 12:47:00,325 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /InfoService
2020-06-12 12:47:00,328 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.FileWebService from class org.apache.openmeetings.webservice.FileWebService
2020-06-12 12:47:00,420 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /FileService
2020-06-12 12:47:00,422 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.RecordingWebService from class org.apache.openmeetings.webservice.RecordingWebService
2020-06-12 12:47:00,468 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /RecordService
2020-06-12 12:47:00,472 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.RoomWebService from class org.apache.openmeetings.webservice.RoomWebService
2020-06-12 12:47:00,659 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /RoomService
2020-06-12 12:47:00,662 [main] INFO o.a.c.w.s.f.ReflectionServiceFactoryBean - Creating Service {http://webservice.openmeetings.apache.org/}org.apache.openmeetings.webservice.UserWebService from class org.apache.openmeetings.webservice.UserWebService
2020-06-12 12:47:00,740 [main] INFO org.apache.cxf.endpoint.ServerImpl - Setting the server's publish address to be /UserService
2020-06-12 12:47:00,781 [main] INFO o.a.c.http11.Http11Nio2Protocol - Starting ProtocolHandler ["http-nio2-0.0.0.0-5080"]
2020-06-12 12:47:00,784 [main] INFO org.red5.server.tomcat.TomcatLoader - Context initialized: path: /opt/red54010/webapps/root/
2020-06-12 12:47:00,789 [main] INFO org.red5.server.tomcat.TomcatLoader - Context initialized: /openmeetings path: /opt/red54010/webapps/openmeetings/
2020-06-12 12:47:00,789 [main] INFO org.red5.server.tomcat.TomcatLoader - Dedicated RTMPT server configuration was not specified
2020-06-12 12:47:00,796 [main] INFO o.r.server.service.ShutdownServer - JEE server was found: TomcatLoader [serviceEngineName=red5Engine]
2020-06-12 12:47:00,857 [Loader:] INFO org.red5.server.Context - Setting parent bean factory as core
2020-06-12 12:47:00,872 [Loader:] INFO org.red5.server.scope.WebScope - Set server [Server@4559116map[[empty]]]
2020-06-12 12:47:00,882 [Loader:] INFO org.red5.server.scope.Scope - Scope null name reset to: disallowed
2020-06-12 12:47:00,888 [Loader:] INFO org.red5.server.Server - Add mapping global: default host: context: null
2020-06-12 12:47:00,888 [Loader:] INFO org.red5.server.scope.Scope - Invalid scope name, null is not allowed
2020-06-12 12:47:00,888 [Loader:] WARN org.red5.server.scope.Scope - Invalid scope rejected: Scope [name=null, path=/default, type=APPLICATION, autoStart=true, creationTime=1591958820859, depth=1, enabled=true, running=false]
2020-06-12 12:47:00,888 [Loader:] WARN org.red5.server.scope.Scope - Scope not added to parent
2020-06-12 12:47:00,888 [Loader:] INFO org.red5.server.scope.WebScope - Webscope already registered; remove the 'init-method' from your 'web.scope' bean to prevent this message in the future.
2020-06-12 12:47:01,547 [Loader:/openmeetings] INFO org.red5.server.Context - Setting parent bean factory as core
2020-06-12 12:47:01,780 [Loader:/openmeetings] INFO o.s.o.j.LocalEntityManagerFactoryBean - Initialized JPA EntityManagerFactory for persistence unit 'openmeetings'
2020-06-12 12:47:01,890 [Loader:/openmeetings] INFO c.h.config.AbstractConfigLocator - Loading 'hazelcast.xml' from the classpath.
2020-06-12 12:47:01,913 [Loader:/openmeetings] WARN c.h.config.AbstractXmlConfigHelper - Name of the hazelcast schema location is incorrect, using default
2020-06-12 12:47:01,993 [Loader:/openmeetings] INFO c.h.i.p.impl.PartitionStateManager - [192.168.0.50]:5701 [dev] [3.12] Initializing cluster partition table arrangement...
2020-06-12 12:47:02,221 [Loader:/openmeetings] INFO org.red5.server.scope.WebScope - Set server [Server@4559116map['/' -> 'default']]
2020-06-12 12:47:02,233 [Loader:/openmeetings] INFO org.red5.server.Server - Add mapping global: default host: context: openmeetings
2020-06-12 12:47:02,233 [Loader:/openmeetings] INFO org.red5.server.Server - Add mapping global: default host: localhost context: openmeetings
2020-06-12 12:47:02,233 [Loader:/openmeetings] INFO org.red5.server.Server - Add mapping global: default host: 127.0.0.1 context: openmeetings
2020-06-12 12:47:03,883 [pool-1-thread-1] INFO o.r.net.websocket.WebSocketPlugin - Creating WebSocketScopeManager for org.apache.openmeetings.core.remote.ScopeApplicationAdapter@2d9bfee2
2020-06-12 12:47:03,883 [pool-1-thread-1] INFO o.r.net.websocket.WebSocketPlugin - WebSocketPlugin application: org.apache.openmeetings.core.remote.ScopeApplicationAdapter@2d9bfee2
2020-06-12 12:47:03,885 [pool-1-thread-1] INFO o.red5.net.websocket.WebSocketScope - Application scope: Scope [name=openmeetings, path=/default, type=APPLICATION, autoStart=true, creationTime=1591958821575, depth=1, enabled=true, running=true]
2020-06-12 12:47:03,886 [pool-1-thread-1] INFO o.r.n.w.WebSocketScopeManager - addWebSocketScope: WebSocketScope [path=/openmeetings, listeners=0, connections=0]
2020-06-12 12:47:03,888 [pool-1-thread-1] INFO o.red5.net.websocket.WebSocketScope - WebSocket scope added
2020-06-12 12:47:04,170 [Loader:/openmeetings] INFO org.quartz.impl.StdSchedulerFactory - Using default implementation for ThreadExecutor
2020-06-12 12:47:04,194 [Loader:/openmeetings] INFO o.quartz.core.SchedulerSignalerImpl - Initialized Scheduler Signaller of type: class org.quartz.core.SchedulerSignalerImpl
2020-06-12 12:47:04,194 [Loader:/openmeetings] INFO org.quartz.core.QuartzScheduler - Quartz Scheduler v.2.3.2 created.
2020-06-12 12:47:04,195 [Loader:/openmeetings] INFO org.quartz.simpl.RAMJobStore - RAMJobStore initialized.
2020-06-12 12:47:04,196 [Loader:/openmeetings] INFO org.quartz.core.QuartzScheduler - Scheduler meta-data: Quartz Scheduler (v2.3.2) 'org.springframework.scheduling.quartz.SchedulerFactoryBean#0' with instanceId 'NON_CLUSTERED'
Scheduler class: 'org.quartz.core.QuartzScheduler' - running locally.
NOT STARTED.
Currently in standby mode.
Number of jobs executed: 0
Using thread pool 'org.quartz.simpl.SimpleThreadPool' - with 10 threads.
Using job-store 'org.quartz.simpl.RAMJobStore' - which does not support persistence. and is not clustered.
2020-06-12 12:47:04,196 [Loader:/openmeetings] INFO org.quartz.impl.StdSchedulerFactory - Quartz scheduler 'org.springframework.scheduling.quartz.SchedulerFactoryBean#0' initialized from an externally provided properties instance.
2020-06-12 12:47:04,196 [Loader:/openmeetings] INFO org.quartz.impl.StdSchedulerFactory - Quartz scheduler version: 2.3.2
2020-06-12 12:47:04,197 [Loader:/openmeetings] INFO org.quartz.core.QuartzScheduler - JobFactory set to: org.springframework.scheduling.quartz.AdaptableJobFactory@7058b729
2020-06-12 12:47:04,214 [Loader:/openmeetings] INFO org.quartz.core.QuartzScheduler - Scheduler org.springframework.scheduling.quartz.SchedulerFactoryBean#0_$_NON_CLUSTERED started.
Von: Ninnig, Alexander <Al...@rechnungshof.rlp.de>
Gesendet: Freitag, 12. Juni 2020 13:05
An: user@openmeetings.apache.org
Betreff: WG: HTTPS with OpenMeetings 4 (4.0.10)
Hello again,
as I said before: if that was a way, I would prefer to use PEM-files and configure the path to these pem-files in a config-file.
That works in OpenMeetings 5, where I can just edit the server.xml (section: <Connector port="5443">)
In case that DOESN’T work in OpenMeetings 4: I repeated all the steps from the official instructions (shipped with my OM, docs/RTMPSAndHTTPS.html).
Just to be sure, I did all these steps on a fresh and INTERNAL OpenMeetings4-server, so there is no way, our central firewall would be the problem.
I also used the default-password (changeit) and the url „red5“ (I created an entry in my Windows-hosts-file).
I was really thorough, I can find no error.
Here is what I did:
cd /opt/red54010/conf
sudo mv keystore.jmx keystore.bak
sudo mv truststore.jmx truststore.bak
sudo keytool -keysize 2048 -genkey -alias red5 -keyalg RSA -keystore /opt/red54010/conf/keystore.jks
# changeit
# changeit
# red5
# IT
# Organization
# City
# State
# DE
# yes
sudo keytool -certreq -keyalg RSA -alias red5 -file red5.csr -keystore /opt/red54010/conf/keystore.jks
# changeit
sudo cp red5.csr /media/netshare/
# https://myissuingca/certsrv - This is a Microsoft Windows Server 2012 R2 Server with an intermediate CA
# "Request a certificate"
# "Submit an advanced certificate request"
# "Submit a certificate request that uses a Base64-encoded CMD or PKCS10 file, or a renewal request that uses a Base64-encoded PKCS7 file"
# I open the CSR-File I copied on my Windows-Server-Netshare with notepad.exe, I copy & paste the whole text into the input-field of my CA-website
# "Choose certificate-template": I choose "Webserver" which is a default-template (I normally would use a template I created ("webserveradvanced"), which allows me to export the private key)
# Field "Additional Attributes" stays empty - send in request
# Certificate is created, I have 4 download-options: DER-certificate [cer], DER-certificate with complete chain [p7b], BASE64-certificate [cer], BASE64-certificate with complete chain [p7b]. I download them all:
# red5_DER.cer, red5_DER.p7b, red5_Base64.cer, red5_Base64.p7b
# I copy the files in my netshare-folder
sudo cp /media/netshare/red5*.cer /opt/red54010/conf/
sudo cp /media/netshare/red5*.p7b /opt/red54010/conf/
# I copy the certificates of my root-CA and my issuing-CA (intermediate CA) onto my Windows-Server-Netshare. I double-check the files, so I can be sure, those are the right ones
sudo cp /media/netshare/root.crt /opt/red54010/conf/
sudo cp /media/netshare/intermediate.crt /opt/red54010/conf/
# I check with: ls. Yes, everything is there.
cd /opt/red54010/conf
sudo keytool -import -alias root -keystore /opt/red54010/conf/keystore.jks -trustcacerts -file root.crt
# changeit
# Trust this certificate: yes [I checked: yes, it is the certificate of my root-CA]
# certificate was added to keystore
sudo keytool -import -alias intermed -keystore /opt/red54010/conf/keystore.jks -trustcacerts -file intermediate.crt
# changeit
# certificate was added to keystore
sudo keytool -import -alias red5 -keystore /opt/red54010/conf/keystore.jks -trustcacerts -file red5_Base64.cer
# I chose the Base64-certificate without chain
# changeit
# Certificate reply was installed in keystore
sudo cp keystore.jks truststore.jks
sudo cp keystore.jks keystore.screen
sudo cp jee-container.xml jee-container.bak
sudo vi jee-container.xml
# search for <!-- Tomcat without SSL enabled -->
# and comment-out the whole section, so:
# <!-- <bean id="tomcat.server" (...)
# </bean> -->
# search for <! Tomcat with SSL enabled -->
# and remove the comment for the whole section, so
# remove <!-- before <bean id="tomcat.server" (...)
# and remove --> right after </bean> but before </beans>
# save file with :w! and quit with :q
# Open my openmeetings-website: http://red5:5080/openmeetings, login as admin
# Go to administration / configuration an set flash.secure="true" and flash.secure.proxy="none" (already set). Save configuration
sudo /etc/init.d/red5-ubdeb2 restart
# Open: https://red5:5443/openmeetings
# --> result: No access to page/site
# I double-checked the connection:
# I can ping the server, so I can resolve the name/url
# I checked my proxy-settings: don't use a proxy for this site
# I also created a special rule in my central firewall: allow 5443 TCP from my network to the openmeetings-server
# http://red5:5080/openmeetings still works
Best wishes,
Alex
Von: Ninnig, Alexander <Al...@rechnungshof.rlp.de>
Gesendet: Freitag, 12. Juni 2020 11:08
An: user@openmeetings.apache.org
Betreff: AW: HTTPS with OpenMeetings 4 (4.0.10)
Hi Maxim,
thanks for your quick response.
Yes, I tried those.
Didn’t work.
So before I tell you everything I tried so far: can I use a config-file instead of the keystore?
Just like in OM5, where I can alter the server.xml and edit the path to the certificates?
Best wishes,
Alex
Von: Maxim Solodovnik <so...@gmail.com>
Gesendet: Freitag, 12. Juni 2020 10:41
An: Openmeetings user-list <us...@openmeetings.apache.org>
Betreff: Re: HTTPS with OpenMeetings 4 (4.0.10)
The instructions are shipped with every OM release
And can be found for ex. here https://om.alteametasoft.com/openmeetings/docs/RTMPSAndHTTPS.html
On Fri, 12 Jun 2020 at 15:31, Ninnig, Alexander <Al...@rechnungshof.rlp.de>> wrote:
Hello,
I’m really sorry to bother, but I can’t get HTTPS working with OpenMeetings 4. The site (https/5443) cannot be displayed.
I had the same problem with OpenMeetings 5, until someone told me not to use the keystore, but to alter the server.xml instead and change the lines into something like that:
<Connector port="5443"
SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateFile="/etc/mycertfolder/server.pem"
certificateKeyFile="/etc/mycertfolder/key.pem"
certificateChainFile="/etc/mycertfolder/chain.pem"
sslProtocol="TLS"/>
</SSLHostConfig>
</Connector>
As I said, that worked with OpenMeetings 5.
Unfortunately, OM5 is not production-ready yet, but I need a solution now.
And unfortunately, there is no server.xml in OM4.
I also searched the whole filesystem for strings like „Connector“, but I got no match.
Before I tell you everything I tried in ordner to make the keystore work:
Can you tell me, If there is a similar solution as the one, mentioned above, in OpenMeetings 4?
Meaning: can I simply edit a config-file and provide this config with the paths to my certificates?
Or do I have to use the keystore?
If I have to use the keystore, I will describe to you what I tried so far.
Best wishes,
Alex
--
Best regards,
Maxim