liferay SSL port redirecting without port number - ssl

I am facing a problem trying to setup SSL for Liferay which seems straight forward but I am not able to crack it.
I am using Liferay 6.2 with MySQL 5.5 and trying to setup SSL on the server.
As I am experimenting I have followed http://java.dzone.com/articles/setting-ssl-tomcat-5-minutes (other sites too giving similar suggestions)
Now I am able to see the login page with https:liferay001:8443 and when I login the redirected url loses the port number and no page is shown after that(https://liferay001/web/guest/welcome?p_p_auth=PlbcFdOI&p_p_id=49&p_p_lifecycle=1&p_p_state=normal&p_p_mode=view&_49_struts_action=%2Fmy_sites%2Fview&_49_groupId=10204&_49_privateLayout=false)
But if I login via non SSL ie. liferay001:8080 the logged in page come in fine. I checked via developer tool and the 8080 is not losing the port when showing the :8080/web/guest/welcome?
I tried to login via 8080 port and then switch to 8443(SSL) port and the page shows up in SSL without issues.
So any navigation from SSL is making the port to be lost in url.
I have tried this in Windows and Ubuntu and both are showing the same behavior.
Is there changes I have to make on the Liferay side to get this running? I am not able to figure out which file changes I have to do along with server.xml.
Right now I am using .keystore in the server.xml file and not using anything complicated.
I have also experimented by adding the following to the portal-ext.properties
company.security.auth.requires.https=true
session.enable.phishing.protection=false
web.server.protocol=https
This has caused the server to not return any response now ie no login page as response too.

Posting the answer as there will be folks who will be not able to proceed without this knowledge.
I have tried to engage few folks in my team and all of them came to the same point where they could not proceed.
the answer is to have all the following entries in your portal-ext.properties
company.security.auth.requires.https=true
session.enable.phishing.protection=false
web.server.protocol=https
web.server.https.port=8443

Related

Apache Admin/Manager page lost after adding Virtual Hosts

I wanted to host a couple of websites (and apps) on the same VPS, so my idea was to have it like this:
Site 1
- HTML content only
Site 2
- PHP and HTML content
Site 3
- Java / SpringBoot app
Site 4
- Python app
Site 5
- Java / SpringBoot app
So I got the smallest pack on DigitalOcean, and thought I would start with Apache. Note: I configured the OS already, and tested basic functionality (see more info below)
I installed Apache, configured it to work with my domain (an actual one, not from hosts) and it loaded the basic HTML page. Before I did this, I tested my-domain.com:8080 and it showed the Apache Admin page, all fine. Unfortunately, now after adding my first VirtualHost (and deleting the default one), my Admin page is not accessible anymore (getting a timeout). I also used Let's Encrypt to test how SSL works.
The current state of sites-enabled:
000-default: NOT ENABLED, doesn't work even if enabled
my-domain.com: ENABLED, working with SSL, redirects to SSL by default
my-domain2-from-hosts-file.com: ENABLED, not working, redirects to the default domain
Ideally, I'd like to have a different VirtualHost/domain for each WAR deployed, but let's get the admin/manager page working first.
What could I be doing wrong? I can post logs and config if needed.
Turns out firewall was the one to blame. Port 8080 became blocked after I added Let's Encrypt SSL using their script, so... that's weird.

Firebase Hosting: Needs Setup For Cloudflare DNS

I am trying to set custom domain for my Firebase app.
Firebase hosted url : https://inventory-app-726af.firebaseapp.com/
Custom Domain: inv.agsft.com
I have followed all instructions as part of setting custom domain but after verification step when I click on finish button, status will always be "Needs Setup".
I am managing DNS through cloudflare (https://www.cloudflare.com/) and I am following Quick setup option.
Any pointers to resolve it?
I had the same problem, I was able to resolve it by toggling the DNS Status on cloudflare from DNS and HTTP Proxy (CDN) to just DNS on the two A records
It started working right away.
The proper solution, ie without disabling Cloudflare for the site, is to use Full SSL for your domain/subdomain.
You can either choose Full SSL for all your domain entries, or set up a Page Rule for a specific subdomain, in your case, use "inv.agsft.com/*"
Source: https://community.cloudflare.com/t/flexible-ssl-redirect-loop-with-google-firebase/2063/3, which in turn points to https://support.cloudflare.com/hc/en-us/articles/115000219871-Why-does-Flexible-SSL-cause-a-redirect-loop-
Had the same issue and this solved the redirect issue. Firebase will however still report the domain as "Needs setup", for that I have no solution, but it does not affect the functionality of the hosting.
For the people that is using Namecheap, This configuration worked for me.
To avoid any kind of ssl issues when using firebase hosting and cloudflare you have to check to following points:
You don't need to toggling the DNS Status on cloudflare from DNS and HTTP Proxy (CDN) to just DNS on the two A records unless you don't want the cloudflare ssl certificates and want to just use the firebase ssl certificates (look to this carefully because you will loose the protection that cloudflare provides to your site in case you decide to use only the clouflare DNS)
If you "keep the cloud orange" it will not causes any problem to your firebase hosting.
Add the firebase IP's to cloudflare following the instructions provided by firebase hosting and remove any other A record from your domain/subdomain that you are setting up
To ensure you have a end-to-end encryption (using both firebase ssl as well as cloudflare ssl), make sure that your cloudflare crypto options is set to "Full":
Use a page rule likes in case that you want your root domain to receive all trafic:
In your firebase hosting setup, do the same:
p.s: Look that the message "Needs setup" is still there but the app is running without any problem.
p.s2: the majority problems regarding cloudflare and firebase is that firebase ssl can take several hours to start to work and you keep seeing a message like "your connection is not private". It happens not beucase cloudflare is messing our proxy out but because firebase ssl is still not fully propagated.
I hope it help others :)
In my case I did the same that Brennen did:
toggling the DNS Status on cloudflare from DNS and HTTP Proxy (CDN) to just DNS on the two A records.
But just start working when I:
Delete the domain from firebase. (click on the : points select delete domain)
refresh the firebase site
Added again in Quick Setup. I already had the A record added in Cloudflare so I didn't added again.
After that automatically the status added was connected.
Remember: Before testing, clean your browser cache.
When I run dig -t txt +noall +answer inv.agsft.com there are no TXT records showing. Since those are required to verify your ownership of the domain, Firebase Hosting will not continue the setup beyond step one.
Update: since the next step requires you to map A records to the IP addresses of Firebase hosting, I ran the relevant dig too:
$ dig -t a +noall +answer inv.agsft.com
inv.agsft.com. 299 IN A 104.18.56.240
inv.agsft.com. 299 IN A 104.18.57.240
Those are not the addresses I'd expect for Firebase Hosting, so it looks like either you haven't correctly entered the A records, or they have't propagated yet.
When I change my setting like below, it started to work again.
Redirect loop fixed:
For GoDaddy this adding the following solved it for me:
TYPE:A
NAME:#
VALUE: your ip_1
TYPE:A
NAME:#
VALUE: your ip_2
June 2020
Just wanted to share what was successful for me. It was a combination Brennen and Lisbel's answer.
Step 1: Toggle off your DNS status to get a grey cloud (as shown in the earlier answer)
Step 2: Delete the domain from firebase
Step 3: Add it back with Quick Steup
It should be connected after these steps!
I had the same issue. Here's how I fixed it:
1) Cick the View button on the problematic domain (in the Hosting section next to where it says Needs Setup).
2) Change the 'Setup mode' from Quick Setup to Advanced and follow the 3 steps
2a) Open your domain provider's settings (I'm using Google Domains) and add the TXT record it's giving you.
2b) Wait about 4-12 hours for verification
2c) Add the provided A records into your domain provider's settings
This is not a quick process, but it should be working about 5 minutes after you complete step 2c.
Toggling DNS mode didn't work for me. So I tried following approach and it worked for me.
Add CNAME record pointing to {firebase-project}.firebaseapp.com or {firebase-project}.web.app, you could add A record and try.
ADD TXT record as firebase ask you
Verify from firebase (this will show as needs setup, also it didn't go away although this worked)
If new domain/subdomain doesn't works check your browser developer tools network tab. If there are lots of 301 happening then go to cloudflare page rules. Add newdomain.com/* or subdomain.newdomain.com/* then add settings select SSL and set it to full as follows.
Then it will work as expected.
Working as of 11st May 2022 without need to toggle DNS and HTTP Proxy (CDN).
Steps:
Go to Cloudflare Dashboard.
Select SSL/TLS.
Select Overview.
Select Full option for SSL/TLS encryption mode.
After that, refresh your website that previously have issue to access.
Now the website can access successfully.

Changing the hostname/domain for Sylius-Shop

I've just installed Sylius to test it for possible production use and integrated Paypal through the payum-gateway.
I'm running Sylius with the included webserver on 127.0.0.1:8080 through a nginx reverse SSL proxy for security reasons and so that it is accessible through a regular URI.
After the PayPal-Payment, I'm forwarded back to the page as it should but instead of the origin-page it sends to 127.0.0.1:8080.
The "Show Shop"-link from the admin-menu did this as well until I changed the server name in the "channel settings".
I figured I have to set the public hostname somewhere else, too, but I cannot figure out where I have to do so.
Grepping for '127.0.0.1' yields a lot of results. For example vendor/sensio/distribution-bundle/Resources/skeleton/web/config.php, but that doesn't seem to be the right place.
I don't know the answer to the original question so I won't delete it in case someone else wants to answer.
I solved this specific problem by not using nginx as a proxy but as the webserver itself and deacitivating the webserver that is shipped with Sylius.

SQUID3 SSL (I built with --enable-ssl)

Right, so the issue i have is this. (I installed my certificate) whenever i try to access a HTTPS page when i have the SECURE proxy settings plumbed into advanced settings on windows.
I am greeted with a lovely message saying ERR_CONNECTION_RESET (on all HTTPS sites, im still fine for non HTTPS). I figured I would try to be helpful by posting my config & log.
Config here: http://pastebin.com/sGpNk4d0
Log here: http://pastebin.com/jDYbqtTh
Thanks for your time.

Bad request error in Apache2 when accessing http instead of https

I am a noob and I have recently started playing with my apache2 installation and trying to see how things are working. Also this exercise helps me figure out more things about apache2 than just reading some manual online.
But I am unable to figure out what I did now ?
So, here is my question: I enabled default-ssl (and have disabled default, i.e., have closed port 80, so that you can only connect the server with https)> I remember previously (say couple of days back) when i did the same and tried to access my website using http, it was giving me some error in the browser saying the web page could not be found or something. But today, doing the same thing give a nice error page saying one should use https instead of http.
Bad Request
Your browser sent a request that this server could not understand.
Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.
Hint: https: // 127.0.1.1/
And, I actually like this. But, I am trying to remember what things I might have done in between to activate such nice error page which was previously not shown.
I know I did something and I cannot remember what I did and asking you to figure that out. I feel bit stupid out there. But, it would be great if any Apache Sherlock out there who could help me. BTW, I am using Ubuntu 12.10.
Thanks