You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@ofbiz.apache.org by 雷咩咩 <67...@qq.com.INVALID> on 2024/08/29 01:22:35 UTC
回复： configured jks certificate but browser said insecure
Hi Jacques,
I finally managed to serve it and now can access:
https://leiyang.icu:8443/catalog/control/login
There's nothing needed from letsencrypt.org because as I said, i have valid certificated from my vendor.
The root cause was
1. i was misconfiguring <container name="catalina-container-test" section, and should be <container name="catalina-container"
2. certificateKeyAlias was also important which i wasn't aware of(quite newbie in x509)
I think I can add my steps to set it up in the confluence wiki, if you'd like Apache OFBiz Technical Production Setup Guide - OFBiz Project Open Wiki - Apache Software Foundation
Regards,
Yang
------------------ 原始邮件 ------------------
发件人: "user" <jacques.le.roux@les7arts.com>;
发送时间: 2024年8月29日(星期四) 凌晨2:43
收件人: "user"<user@ofbiz.apache.org>;
主题: Re: configured jks certificate but browser said insecure
Hi Yang,
You should have a look at https://letsencrypt.org/zh-cn/
HTH
Jacques
Le 28/08/2024 à 17:30, 雷咩咩 a écrit :
> hi ofbiz users,
>
>
>
>
> I've successfully started ofbiz and reverse proxied by nginx, can visit by&nbsp;https://leiyang.icu/accounting/control/login.
>
> However, as I also have other websites using this domain(on some other locations), I'd like to configure ssl certificate for ofbiz on port 8443,
>
> and want to visit it by&nbsp;https://leiyang.icu:8443/accounting/control/login
>
> is it possible?
>
>
>
>
> I read the docs which says:
>
>
>
>
> ...omitted previous steps since my jks cert can be directly downloaded from my vendor, also has a password file containing the plain text password.
>
> 5. Import the Certificate into the keystore by running:
> "keytool -import -alias ssl -trustcacerts -file mysignedcert.cer -keystore [keystore name]"
> 6. Configure the framework\catalina\ofbiz-component.xml file to point to your new keystore and password:
> If using Tomcat (Catalina), which is the default, find the "catalina-container" -&gt; "https-connector" -&gt; "keystoreFile" and "keystorePass" properties
> and set them.
>
>
>
>
>
>
> I have configured&nbsp;framework\catalina\ofbiz-component.xml to be like this:
>
> &nbsp; &nbsp; &nbsp; &nbsp; <property name="https-connector" value="connector"&gt;
> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="default" value="certificate"&gt;
> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="certificateKeystoreFile" value="/home/ecs-user/certs/leiyang.icu.jks"/&gt;
> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="certificateKeystorePassword" value="mypassword"/&gt;
>
>
>
>
>
>
> but accessing 8443 url got insecure error.
>
>
>
>
> Could anyone tell me why, and how to investigate?
>
> My certificate is valid(otherwise my main site on 443 port cannot work).
>
>
>
>
> Must I run the keytool command? i see 8443 cert is still the apache one, seems my settings not work at all.
>
> My vendor provides following cert formats:
>
>
>
>
> Nginx pem/key,&nbsp;Tomcat pfx,&nbsp;Apache crt/key,&nbsp;IIS pfx,&nbsp;JKS jks,&nbsp;pem/key,&nbsp;root crt/cer
>
>
>
>
> Regards,
>
> Yang
Re: 回复： configured jks certificate but browser said insecure
Posted by Jacques Le Roux <ja...@les7arts.com>.
Hi Yang,
Yes please, are you already a Confluence contributor? https://cwiki.apache.org/confluence/display/OFBIZ/Apache+OFBiz+Contributors
Jacques
Le 29/08/2024 à 03:22, 雷咩咩 a écrit :
> I think I can add my steps to set it up in the confluence wiki, if you'd
> like Apache OFBiz Technical Production Setup Guide - OFBiz
> Project Open Wiki - Apache Software Foundation
>