Cryptographic stores in Alfresco

[angelborroy]

This information is coming from an internal session on mTLS configuration and other cryptographic related tasks.

You can find the slides in https://www.slideshare.net/angelborroy/alfresco-certificates and the sample project used during the presentation is available in https://github.com/aborroy/alfresco-mtls-tutorial

Additionally, there were some questions during the session that we are replying below.

1 - How to integrate Let's Encrypt and do the certificate update automatically in alfresco it change every 3 month?

Let's Encrypt is not suppored by Alfresco, as this software doesn't support java keystores. It's required to renew the certificates with Let's Encrypt tools and to feed them into the Alfresco keystores and truststores using keytool or an equivalent program.

2 - Related to SOLR Jetty startup props, is there precedence in how these are consumed?

Settings in solr.in.sh | solr.in.cmd will override settings in existing env vars or in bin/solr.

3 - If Jetty props are misconfigured, how does that present as error?

Not able to Search from Alfresco Share or Alfresco Content App. Forbidden 403 messages should appear in Alfresco Repository log.

4 - Is the Http11Nio2Protocol supported in Tomcat Connector configuration?

This configuration is supported, but you need to declare the Connector with a different syntax.

    <Connector port="8443" 
            protocol="org.apache.coyote.http11.Http11Nio2Protocol"
            sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
            SSLEnabled="true">
        <SSLHostConfig certificateVerification="none" 
            truststoreFile="<CATALINA_BASE>/alf_data/keystore/ssl.truststore" 
            truststorePassword="kT9X6oe68t" 
            truststoreType="JCEKS" >
        <Certificate certificateKeystoreFile="<CATALINA_BASE>/alf_data/keystore/ssl.keystore"
            certificateKeystorePassword="kT9X6oe68t"
            certificateKeystoreType="JCEKS" />
        </SSLHostConfig>
    </Connector>

5 - Is Alfresco supporting certificates stored in HSM modules?

HSM modules are not supported.

6 - As we allow trusted certificates with TLS also from browser: do we do another level of authentication?

We don't distinguish between two different admins or 2 shards of SOLR, as we are relying only in trusted certificates present in truststore file.