A simplified guide to enable ACS Mutual TLS with Search Services

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

michael_chen_ri

Mutual TLS between ACS and Search Services (Solr6) includes 2 distinctively different communication channels:

• TLS connection (https) from Alfresco (the client) to Solr6 (the server)
• TLS connection (https) from Solr6 (the client) to Alfresco (the server)

Therefore, we need these four distinct groups of configurations for the four parties (yes, not two):

1. Alfresco (as a server) listening port number and protocol:

    tomcat/conf/server.xml

	<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
	           maxThreads="150" SSLEnabled="true" scheme="https" secure="true">
	    <SSLHostConfig truststoreFile="../alf_data/keystore/ssl.truststore"
	                   truststorePassword="truststore" truststoreType="JCEKS"
	                   certificateVerification="required">
	        <Certificate certificateKeystoreFile="../alf_data/keystore/ssl.keystore"
	                     certificateKeystorePassword="keystore" certificateKeystoreType="JCEKS"
	                     certificateKeyAlias="ssl.repo" type="RSA" />
	    </SSLHostConfig>
	</Connector>

2. Solr (as a server) listening port number and protocol:

    search-services/solr.in.sh

SOLR_PORT=8983
SOLR_SSL_KEY_STORE=../../solrhome/keystore/ssl.repo.client.keystore
SOLR_SSL_KEY_STORE_PASSWORD=keystore
SOLR_SSL_KEY_STORE_TYPE=JCEKS
SOLR_SSL_TRUST_STORE=../../solrhome/keystore/ssl.repo.client.truststore
SOLR_SSL_TRUST_STORE_PASSWORD=truststore
SOLR_SSL_TRUST_STORE_TYPE=JCEKS
SOLR_SSL_NEED_CLIENT_AUTH=true
SOLR_SSL_WANT_CLIENT_AUTH=false
SOLR_OPTS="$SOLR_OPTS -Dalfresco.secureComms=https"

3. What host name, port number and protocol Alfresco (as a client) uses to connect to Solr:

    tomcat/shared/classes/alfresco-global.properties

index.subsystem.name=solr6
solr.secureComms=https
solr.host=localhost
solr.port.ssl=8983

4. What host name, port number and protocol Solr (as a client) uses to connect to Alfresco:

    search-services/solrhome/alfresco/conf/solrcore.properties
    search-services/solrhome/archive/conf/solrcore.properties

alfresco.secureComms=true
alfresco.host=localhost
alfresco.port.ssl=8443
alfresco.encryption.ssl.keystore.location=ssl.repo.client.keystore
alfresco.encryption.ssl.truststore.location=ssl.repo.client.truststore
alfresco.encryption.ssl.truststore.passwordFileLocation=ssl-truststore-passwords.properties
alfresco.encryption.ssl.keystore.passwordFileLocation=ssl-keystore-passwords.properties

Keystore and truststore files mentioned in these settings should be pre-created using alfresco-ssl-generator. Follow the README of that tool to copy generate files to the correct place. For examples,

cd ~/ssl-tool
./run.sh -keysize 2048 -alfrescoversion enterprise -alfrescoformat classic
cp -a keystores/alfresco/ssl* /opt/alfresco/alf_data/keystore/
cp -a keystores/solr /opt/alfresco/search-services/solrhome/keystore
for f in alfresco archive; do cp -a keystores/solr/* /opt/alfresco/search-services/solrhome/$f/; done

Here are a list of pull requests aimed to clarify the Alfresco online documentations of Search Services on this topic:

• Set mutual TLS solr.secureComms=https and port.ssl 
• Add critical system property to enable mutual TLS 
• Clarify how alfresco.secureComms actually works 

.