Cryptographic stores in Alfresco

cancel
Showing results for 
Search instead for 
Did you mean: 

Cryptographic stores in Alfresco

Alfresco Employee
1 0 369

This information is coming from an internal session on mTLS configuration and other cryptographic related tasks.

You can find the slides in https://www.slideshare.net/angelborroy/alfresco-certificates and the sample project used during the presentation is available in https://github.com/aborroy/alfresco-mtls-tutorial

Additionally, there were some questions during the session that we are replying below.

1 - How to integrate Let's Encrypt and do the certificate update automatically in alfresco it change every 3 month?

Let's Encrypt is not suppored by Alfresco, as this software doesn't support java keystores. It's required to renew the certificates with Let's Encrypt tools and to feed them into the Alfresco keystores and truststores using keytool or an equivalent program.

2 - Related to SOLR Jetty startup props, is there precedence in how these are consumed?

Settings in solr.in.sh | solr.in.cmd will override settings in existing env vars or in bin/solr.

3 - If Jetty props are misconfigured, how does that present as error?

Not able to Search from Alfresco Share or Alfresco Content App. Forbidden 403 messages should appear in Alfresco Repository log.

4 - Is the Http11Nio2Protocol supported in Tomcat Connector configuration?

This configuration is supported, but you need to declare the Connector with a different syntax.

    <Connector port="8443" 
            protocol="org.apache.coyote.http11.Http11Nio2Protocol"
            sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
            SSLEnabled="true">
        <SSLHostConfig certificateVerification="none" 
            truststoreFile="<CATALINA_BASE>/alf_data/keystore/ssl.truststore" 
            truststorePassword="kT9X6oe68t" 
            truststoreType="JCEKS" >
        <Certificate certificateKeystoreFile="<CATALINA_BASE>/alf_data/keystore/ssl.keystore"
            certificateKeystorePassword="kT9X6oe68t"
            certificateKeystoreType="JCEKS" />
        </SSLHostConfig>
    </Connector>


5 - Is Alfresco supporting certificates stored in HSM modules?

HSM modules are not supported.

6 - As we allow trusted certificates with TLS also from browser: do we do another level of authentication?

We don't distinguish between two different admins or 2 shards of SOLR, as we are relying only in trusted certificates present in truststore file.

About the Author
Angel Borroy is Senior Software Engineer in Alfresco. Over the last 15 years, he has been working as a software architect on Java, BPM, document management and electronic signatures. He has been working with Alfresco during the last years to customize several implementations in large organizations and to provide add-ons to the Community based on Record Management and Electronic Signature. He writes (sometimes) on his personal blog http://angelborroy.wordpress.com. He is (proud) member of the Order of the Bee. Angel Borroy is Engineer at Alfresco.