mirror of
https://github.com/Alfresco/alfresco-community-repo.git
synced 2025-08-07 17:49:17 +00:00
ec28251e45
40297: JAPANESE: Translation update based on EN 40202
40299: DUTCH: Translation update based on EN 40202
40300: CHINESE: Translation update based on EN 40202
40301: CHINESE: Translation update based on EN 40202 (file missed from r40300)
40302: Fixes: ALF-13712 - time format localisation issue
40321: ALF-15479: Alfresco linux installer should include tomcat native libraries
40340: Merged V4.1 to V4.1-BUG-FIX
40326: ALF-15283: IE8 error when sync folder via Sync to Cloud button from top menus
40328: CloudSync: minor - unit test updates (for simple move of directly synced nodes - file or folder)
40330: Fix for ALF-15470: "SSL cert shipped with 4.x will expire 16th Aug 2012"
- new SSL keys
40333: Probable fix for ALF-15430. sys:hidden aspect needs to be handled consistently by Hybrid Sync.
The OnCreateChildAssociation policy within a synced folder was changed so that it also excludes hidden nodes.
I couldn't use fileInfo.isHidden() as that checks which client is calling it (WebDAV, VIFS and Hybrid Sync is not a "client".
So I used a simpler hasAspect(sys:hidden)
I also had to change the behaviour's frequency so that it fires on transaction commit not on every event.
This is to prevent addChild(node); addAspect(sys:hidden) from erroneously adding the child to the syncset.
Test cases for the above.
Also, as a safety net, and just in case some hidden nodes do get into syncsets (e.g. by the sys:hidden aspect being added in a later transaction), we now transport the sys:hidden aspect and its property.
40334: Removing unused import - also want to trigger rebuild on this plan as I suspect it failed randomly.
40335: ALF-15470: Corrected SSL key store instructions plus updated browser.p12
40336: ALF-15470: Some missed keystores
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@40341 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
142 lines
6.1 KiB
Plaintext
142 lines
6.1 KiB
Plaintext
Instructions for Generating Repository SSL Keystores
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
<store password> is the keystore password. The file ${dir.keystore}/ssl-keystore-passwords.properties contains passwords for the SSL keystore,
|
|
${dir.keystore}/ssl-truststore-passwords.properties contains passwords for the SSL truststore.
|
|
|
|
These instructions will create an RSA public/private key pair for the repository with a certificate that has been signed by the Alfresco Certificate Authority (CA).
|
|
It will also create a truststore for the repository containing the CA certificate; this will be used to authenticate connections to specific repository
|
|
URLs from Solr. It assumes the existence of the Alfresco CA key and certificate to sign the repository certificate; for security reasons these are not generally available.
|
|
You can either generate your own CA key and certificate (see instructions below) or use a recognised Certificate Authority such as Verisign. For Alfresco employees the key
|
|
and certificate are available in svn.
|
|
|
|
(i) Generate the repository public/private key pair in a keystore:
|
|
|
|
$ keytool -genkey -alias ssl.repo -keyalg RSA -keystore ssl.keystore -storetype JCEKS -storepass <store password>
|
|
Enter keystore password:
|
|
Re-enter new password:
|
|
What is your first and last name?
|
|
[Unknown]: Alfresco Repository
|
|
What is the name of your organizational unit?
|
|
[Unknown]:
|
|
What is the name of your organization?
|
|
[Unknown]: Alfresco Software Ltd.
|
|
What is the name of your City or Locality?
|
|
[Unknown]: Maidenhead
|
|
What is the name of your State or Province?
|
|
[Unknown]: UK
|
|
What is the two-letter country code for this unit?
|
|
[Unknown]: GB
|
|
Is CN=Alfresco Repository, OU=Unknown, O=Alfresco Software Ltd., L=Maidenhead, ST=UK, C=GB correct?
|
|
[no]: yes
|
|
|
|
Enter key password for <ssl.repo>
|
|
(RETURN if same as keystore password):
|
|
|
|
(ii) Generate a certificate request for the repository key
|
|
|
|
$ keytool -keystore ssl.keystore -alias ssl.repo -certreq -file repo.csr -storetype JCEKS -storepass <store password>
|
|
|
|
(iii) Alfresco CA signs the certificate request, creating a certificate that is valid for 365 days.
|
|
|
|
$ openssl x509 -CA ca.crt -CAkey ca.key -CAcreateserial -req -in repo.csr -out repo.crt -days 365
|
|
Signature ok
|
|
subject=/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Alfresco Repository
|
|
Getting CA Private Key
|
|
Enter pass phrase for ca.key:
|
|
|
|
(iv) Import the Alfresco CA key into the repository key store
|
|
|
|
$ keytool -import -alias ssl.alfreco.ca -file ca.crt -keystore ssl.keystore -storetype JCEKS -storepass <store password>
|
|
Enter keystore password:
|
|
Owner: CN=Alfresco CA, O=Alfresco Software Ltd., L=Maidenhead, ST=UK, C=GB
|
|
Issuer: CN=Alfresco CA, O=Alfresco Software Ltd., L=Maidenhead, ST=UK, C=GB
|
|
Serial number: 805ba6dc8f62f8b8
|
|
Valid from: Fri Aug 12 13:28:58 BST 2011 until: Mon Aug 09 13:28:58 BST 2021
|
|
Certificate fingerprints:
|
|
MD5: 4B:45:94:2D:8E:98:E8:12:04:67:AD:AE:48:3C:F5:A0
|
|
SHA1: 74:42:22:D0:52:AD:82:7A:FD:37:46:37:91:91:F4:77:89:3A:C9:A3
|
|
Signature algorithm name: SHA1withRSA
|
|
Version: 3
|
|
|
|
Extensions:
|
|
|
|
#1: ObjectId: 2.5.29.14 Criticality=false
|
|
SubjectKeyIdentifier [
|
|
KeyIdentifier [
|
|
0000: 08 42 40 DC FE 4A 50 87 05 2B 38 4D 92 70 8E 51 .B@..JP..+8M.p.Q
|
|
0010: 4E 38 71 D6 N8q.
|
|
]
|
|
]
|
|
|
|
#2: ObjectId: 2.5.29.19 Criticality=false
|
|
BasicConstraints:[
|
|
CA:true
|
|
PathLen:2147483647
|
|
]
|
|
|
|
#3: ObjectId: 2.5.29.35 Criticality=false
|
|
AuthorityKeyIdentifier [
|
|
KeyIdentifier [
|
|
0000: 08 42 40 DC FE 4A 50 87 05 2B 38 4D 92 70 8E 51 .B@..JP..+8M.p.Q
|
|
0010: 4E 38 71 D6 N8q.
|
|
]
|
|
|
|
[CN=Alfresco CA, O=Alfresco Software Ltd., L=Maidenhead, ST=UK, C=GB]
|
|
SerialNumber: [ 805ba6dc 8f62f8b8]
|
|
]
|
|
|
|
Trust this certificate? [no]: yes
|
|
Certificate was added to keystore
|
|
|
|
(v) Import the CA-signed repository certificate into the repository keystore
|
|
|
|
$ keytool -import -alias ssl.repo -file repo.crt -keystore ssl.keystore -storetype JCEKS -storepass <store password>
|
|
Enter keystore password:
|
|
Certificate reply was installed in keystore
|
|
|
|
(vi) Convert the repository keystore to a pkcs12 keystore (for use in browsers such as Firefox). Give the pkcs12 key store the key store password 'alfresco'.
|
|
|
|
keytool -importkeystore -srckeystore ssl.keystore -srcstorepass <keystore password> -srcstoretype JCEKS -srcalias ssl.repo -srckeypass kT9X6oe68t -destkeystore firefox.p12 -deststoretype pkcs12 -deststorepass alfresco -destalias ssl.repo -destkeypass alfresco
|
|
|
|
(vi) Create a repository truststore containing the Alfresco CA certificate
|
|
|
|
keytool -import -alias ssl.alfreco.ca -file ca.crt -keystore ssl.keystore -storetype JCEKS -storepass <store password>
|
|
keytool -import -alias alfreco.ca -file ca.crt -keystore ssl.truststore -storetype JCEKS -storepass <store password>
|
|
|
|
(vii) Copy the keystore and truststore to the repository keystore location defined by the property 'dir.keystore'.
|
|
(viii) Update the SSL properties i.e. properties starting with the prefixes 'alfresco.encryption.ssl.keystore' and 'alfresco.encryption.ssl.truststore'.
|
|
|
|
Instructions for Generating a Certificate Authority (CA) Key and Certificate
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
(i) Generate the CA private key
|
|
|
|
$ openssl genrsa -des3 -out ca.key 1024
|
|
Generating RSA private key, 1024 bit long modulus
|
|
..........++++++
|
|
..++++++
|
|
e is 65537 (0x10001)
|
|
Enter pass phrase for ca.key:
|
|
Verifying - Enter pass phrase for ca.key:
|
|
|
|
(ii) Generate the CA self-signed certificate
|
|
|
|
$ openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
|
|
Enter pass phrase for ca.key:
|
|
You are about to be asked to enter information that will be incorporated
|
|
into your certificate request.
|
|
What you are about to enter is what is called a Distinguished Name or a DN.
|
|
There are quite a few fields but you can leave some blank
|
|
For some fields there will be a default value,
|
|
If you enter '.', the field will be left blank.
|
|
-----
|
|
Country Name (2 letter code) [AU]:GB
|
|
State or Province Name (full name) [Some-State]:UK
|
|
Locality Name (eg, city) []:Maidenhead
|
|
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Alfresco Software Ltd.
|
|
Organizational Unit Name (eg, section) []:
|
|
Common Name (eg, YOUR name) []:Alfresco CA
|
|
Email Address []:
|
|
|