Index: /main/trunk/greenstone3/bin/windows/zeroSSL_CryptLE_LICENSE.txt
===================================================================
--- /main/trunk/greenstone3/bin/windows/zeroSSL_CryptLE_LICENSE.txt	(revision 32412)
+++ /main/trunk/greenstone3/bin/windows/zeroSSL_CryptLE_LICENSE.txt	(revision 32412)
@@ -0,0 +1,211 @@
+On Windows, Greenstone uses the "Win32/Win64 Portable ZeroSSL client for Let's Encrypt (with ACME v2/v1 and Wildcards support)"
+binaries to acquire an SSL certificate for https support.
+
+The binaries were obtained from https://github.com/do-know/Crypt-LE/releases
+
+As per https://github.com/do-know/Crypt-LE/, these binaries and their use are licensed under the Artistic License (2.0) which is detailed at https://www.perlfoundation.org/artistic-license-20.html.
+
+The ZeroSSL client binaries license at https://github.com/do-know/Crypt-LE/blob/master/LICENSE follows.
+
+
+               The Artistic License 2.0
+
+           Copyright (c) 2016-2018 Alexander Yezhov
+
+     Everyone is permitted to copy and distribute verbatim copies
+      of this license document, but changing it is not allowed.
+
+Preamble
+
+This license establishes the terms under which a given free software
+Package may be copied, modified, distributed, and/or redistributed.
+The intent is that the Copyright Holder maintains some artistic
+control over the development of that Package while still keeping the
+Package available as open source and free software.
+
+You are always permitted to make arrangements wholly outside of this
+license directly with the Copyright Holder of a given Package.  If the
+terms of this license do not permit the full use that you propose to
+make of the Package, you should contact the Copyright Holder and seek
+a different licensing arrangement.
+
+Definitions
+
+    "Copyright Holder" means the individual(s) or organization(s)
+    named in the copyright notice for the entire Package.
+
+    "Contributor" means any party that has contributed code or other
+    material to the Package, in accordance with the Copyright Holder's
+    procedures.
+
+    "You" and "your" means any person who would like to copy,
+    distribute, or modify the Package.
+
+    "Package" means the collection of files distributed by the
+    Copyright Holder, and derivatives of that collection and/or of
+    those files. A given Package may consist of either the Standard
+    Version, or a Modified Version.
+
+    "Distribute" means providing a copy of the Package or making it
+    accessible to anyone else, or in the case of a company or
+    organization, to others outside of your company or organization.
+
+    "Distributor Fee" means any fee that you charge for Distributing
+    this Package or providing support for this Package to another
+    party.  It does not mean licensing fees.
+
+    "Standard Version" refers to the Package if it has not been
+    modified, or has been modified only in ways explicitly requested
+    by the Copyright Holder.
+
+    "Modified Version" means the Package, if it has been changed, and
+    such changes were not explicitly requested by the Copyright
+    Holder.
+
+    "Original License" means this Artistic License as Distributed with
+    the Standard Version of the Package, in its current version or as
+    it may be modified by The Perl Foundation in the future.
+
+    "Source" form means the source code, documentation source, and
+    configuration files for the Package.
+
+    "Compiled" form means the compiled bytecode, object code, binary,
+    or any other form resulting from mechanical transformation or
+    translation of the Source form.
+
+
+Permission for Use and Modification Without Distribution
+
+(1)  You are permitted to use the Standard Version and create and use
+Modified Versions for any purpose without restriction, provided that
+you do not Distribute the Modified Version.
+
+
+Permissions for Redistribution of the Standard Version
+
+(2)  You may Distribute verbatim copies of the Source form of the
+Standard Version of this Package in any medium without restriction,
+either gratis or for a Distributor Fee, provided that you duplicate
+all of the original copyright notices and associated disclaimers.  At
+your discretion, such verbatim copies may or may not include a
+Compiled form of the Package.
+
+(3)  You may apply any bug fixes, portability changes, and other
+modifications made available from the Copyright Holder.  The resulting
+Package will still be considered the Standard Version, and as such
+will be subject to the Original License.
+
+
+Distribution of Modified Versions of the Package as Source
+
+(4)  You may Distribute your Modified Version as Source (either gratis
+or for a Distributor Fee, and with or without a Compiled form of the
+Modified Version) provided that you clearly document how it differs
+from the Standard Version, including, but not limited to, documenting
+any non-standard features, executables, or modules, and provided that
+you do at least ONE of the following:
+
+    (a)  make the Modified Version available to the Copyright Holder
+    of the Standard Version, under the Original License, so that the
+    Copyright Holder may include your modifications in the Standard
+    Version.
+
+    (b)  ensure that installation of your Modified Version does not
+    prevent the user installing or running the Standard Version. In
+    addition, the Modified Version must bear a name that is different
+    from the name of the Standard Version.
+
+    (c)  allow anyone who receives a copy of the Modified Version to
+    make the Source form of the Modified Version available to others
+    under
+
+    (i)  the Original License or
+
+    (ii)  a license that permits the licensee to freely copy,
+    modify and redistribute the Modified Version using the same
+    licensing terms that apply to the copy that the licensee
+    received, and requires that the Source form of the Modified
+    Version, and of any works derived from it, be made freely
+    available in that license fees are prohibited but Distributor
+    Fees are allowed.
+
+
+Distribution of Compiled Forms of the Standard Version
+or Modified Versions without the Source
+
+(5)  You may Distribute Compiled forms of the Standard Version without
+the Source, provided that you include complete instructions on how to
+get the Source of the Standard Version.  Such instructions must be
+valid at the time of your distribution.  If these instructions, at any
+time while you are carrying out such distribution, become invalid, you
+must provide new instructions on demand or cease further distribution.
+If you provide valid instructions or cease distribution within thirty
+days after you become aware that the instructions are invalid, then
+you do not forfeit any of your rights under this license.
+
+(6)  You may Distribute a Modified Version in Compiled form without
+the Source, provided that you comply with Section 4 with respect to
+the Source of the Modified Version.
+
+
+Aggregating or Linking the Package
+
+(7)  You may aggregate the Package (either the Standard Version or
+Modified Version) with other packages and Distribute the resulting
+aggregation provided that you do not charge a licensing fee for the
+Package.  Distributor Fees are permitted, and licensing fees for other
+components in the aggregation are permitted. The terms of this license
+apply to the use and Distribution of the Standard or Modified Versions
+as included in the aggregation.
+
+(8) You are permitted to link Modified and Standard Versions with
+other works, to embed the Package in a larger work of your own, or to
+build stand-alone binary or bytecode versions of applications that
+include the Package, and Distribute the result without restriction,
+provided the result does not expose a direct interface to the Package.
+
+
+Items That are Not Considered Part of a Modified Version
+
+(9) Works (including, but not limited to, modules and scripts) that
+merely extend or make use of the Package, do not, by themselves, cause
+the Package to be a Modified Version.  In addition, such works are not
+considered parts of the Package itself, and are not subject to the
+terms of this license.
+
+
+General Provisions
+
+(10)  Any use, modification, and distribution of the Standard or
+Modified Versions is governed by this Artistic License. By using,
+modifying or distributing the Package, you accept this license. Do not
+use, modify, or distribute the Package, if you do not accept this
+license.
+
+(11)  If your Modified Version has been derived from a Modified
+Version made by someone other than you, you are nevertheless required
+to ensure that your Modified Version complies with the requirements of
+this license.
+
+(12)  This license does not grant you the right to use any trademark,
+service mark, tradename, or logo of the Copyright Holder.
+
+(13)  This license includes the non-exclusive, worldwide,
+free-of-charge patent license to make, have made, use, offer to sell,
+sell, import and otherwise transfer the Package with respect to any
+patent claims licensable by the Copyright Holder that are necessarily
+infringed by the Package. If you institute patent litigation
+(including a cross-claim or counterclaim) against any party alleging
+that the Package constitutes direct or contributory patent
+infringement, then this Artistic License to you shall terminate on the
+date that such litigation is filed.
+
+(14)  Disclaimer of Warranty:
+THE PACKAGE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS "AS
+IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES. THE IMPLIED
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
+NON-INFRINGEMENT ARE DISCLAIMED TO THE EXTENT PERMITTED BY YOUR LOCAL
+LAW. UNLESS REQUIRED BY LAW, NO COPYRIGHT HOLDER OR CONTRIBUTOR WILL
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THE PACKAGE, EVEN IF
+ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Index: /main/trunk/greenstone3/build.xml
===================================================================
--- /main/trunk/greenstone3/build.xml	(revision 32411)
+++ /main/trunk/greenstone3/build.xml	(revision 32412)
@@ -194,4 +194,9 @@
     </if>
 
+	<!-- Set the keystore file name for linux versus windows. Ultimately unused/inactive if HTTPS is not enabled and no certificate obtained. We don't have https certification on mac -->
+	<condition property="keystore.file" value="fullchain_and_prvtkey.pfx" else="fullchain_and_prvtkey.p12">
+		<istrue value="${current.os.iswindows}"/>
+	</condition>	
+	
     <!-- 
 	 1. Using the macrodef task from ant 1.6+ (https://ant.apache.org/manual/Tasks/macrodef.html)
@@ -1113,5 +1118,5 @@
     description="Startup the Tomcat server." >
     <echo>${app.name} (${app.version}) server running using Apache Tomcat and Java</echo> 
-    <echo>Tomcat: ${catalina.home}</echo> 
+    <echo>Tomcat: ${catalina.home}</echo>
     <echo>Java  : ${java.home}</echo>
     <if><bool><available file="${build.src.home}"/></bool>
@@ -1681,5 +1686,6 @@
     <input addproperty="https.conditions.ok" validargs="y,n">     
       To run this target, ensure you have:
-      * sudo permissions
+      * On Linux: sudo permissions
+	  * On Windows: sufficient privileges to run the included tomcat on port 80
       * nothing running on port 80 when you run this target
       * edited the build.properties file with
@@ -1725,4 +1731,80 @@
     <else>
       <echo>Proceeding...</echo>
+	 </else>
+  </if>
+  
+  	<if><bool><istrue value="${current.os.iswindows}"/></bool>
+		<antcall target="setup-https-cert-windows"/>
+	</if>
+	<if><bool><istrue value="${current.os.isunixnotmac}"/></bool>
+		<antcall target="setup-https-cert-linux"/>
+	</if>
+  </target>
+  
+  <target name="setup-https-cert-windows">
+	<echo>********** The included tomcat will be stopped, then restarted on port 80 and stopped again</echo>
+	
+	<!-- create folder packages\tomcat\webapps\ROOT\.well-known\acme-challenge -->
+	<mkdir dir="${packages.home}/tomcat/webapps/ROOT/.well-known/acme-challenge"/>
+	<mkdir dir="${packages.home}/tomcat/conf/https_cert"/>
+  
+	<!-- stop the included tomcat (also stopping derby and solr) -->
+	<antcall target="stop" />
+	
+	<!-- rerun tomcat on port 80
+		See https://ant.apache.org/manual/Tasks/antcall.html -->
+	<antcall target="start">
+		<param name="tomcat.port.http" value="80"/>
+		<param name="internal.tomcat.port" value="80"/>
+		<param name="http.comment.out.start" value=""/>
+		<param name="http.comment.out.end" value=""/>
+		<param name="https.comment.out.start" value="${comment.start}"/>
+		<param name="https.comment.out.end" value="${comment.end}"/>
+	</antcall>
+ 
+	<!-- get the certificate: use zerossl for windows
+		Download from https://github.com/do-know/Crypt-LE/releases,
+		For licence see https://github.com/do-know/Crypt-LE/
+		Usage instructions at https://zerossl.com/usage.html		
+		
+		le64 ==key "${packages.home}\tomcat\conf\https_cert\privkey.key" ==csr "${packages.home}\tomcat\conf\https_cert\${tomcat.server}.csr" ==csr-key "${packages.home}s\tomcat\conf\https_cert\${tomcat.server}.key" ==crt "${packages.home}\tomcat\conf\https_cert\${tomcat.server}.crt" ==domains "${https.cert.domains}" ==path "${packages.home}\tomcat\webapps\ROOT\.well-known\acme-challenge" ==generate-missing ==unlink ==live -export-pfx "${keystore.pass}"
+		
+		which generates a .pfx file with the same name as the PEM certificate (.crt)
+		.pfx vs .p12: https://stackoverflow.com/questions/6819079/convert-pfx-format-to-p12
+		
+		In this case "fullchain_and_prvtkey.pfx" is generated, which is the windows value of ${keystore.file} property
+		-->
+    <exec executable="cmd" osfamily="windows" dir="${basedir}/bin/${os.bin.dir}" spawn="false">
+      <arg value="/c" />
+	  <arg value="le64" />
+	  <arg value="--key" /><arg value="${packages.home}\tomcat\conf\https_cert\privkey.key" />
+	  <arg value="--csr" /><arg value="${packages.home}\tomcat\conf\https_cert\${tomcat.server}.csr" />
+	  <arg value="--csr-key" /><arg value="${packages.home}\tomcat\conf\https_cert\${tomcat.server}.key" />
+	  <!--<arg value="==crt" /><arg value="${packages.home}\tomcat\conf\https_cert\${tomcat.server}.crt" />-->	  
+	  <arg value="--crt" /><arg value="${packages.home}\tomcat\conf\https_cert\fullchain_and_prvtkey.crt" />
+	  <arg value="--domains" /><arg value="${https.cert.domains}" />
+	  <arg value="--path" /><arg value="${packages.home}\tomcat\webapps\ROOT\.well-known\acme-challenge" />
+	  <arg value="--generate-missing" />
+	  <arg value="--unlink" />
+	  <arg line="--live" /><!-- https://stackoverflow.com/questions/11840284/pass-arguments-to-apache-ant-exec-task-based-on-the-variables-value -->
+	  <arg value="--export-pfx" /><arg value="${keystore.pass}" />
+    </exec>  
+
+	<echo>KEYSTORE FILE: ${keystore.file}</echo>
+	
+	<!-- stop the tomcat running on port 80 -->
+	<antcall target="stop">
+		<param name="tomcat.port.http" value="80"/>
+		<param name="internal.tomcat.port" value="80"/>
+		<param name="http.comment.out.start" value=""/>
+		<param name="http.comment.out.end" value=""/>
+		<param name="https.comment.out.start" value="${comment.start}"/>
+		<param name="https.comment.out.end" value="${comment.end}"/>
+	</antcall>
+	
+	
+  </target>
+  
+  <target name="setup-https-cert-linux">
       <!-- Running as
 	   ./certbot-auto certonly ==standalone ==preferred-challenges http ==email EMAIL -d DOMAINS 
@@ -1777,14 +1859,11 @@
       <copy todir="${packages.home}/tomcat/conf/https_cert">
 	<fileset file="/tmp/${tomcat.server}_fullchain_and_key.p12"/>
-	<globmapper from="${tomcat.server}_fullchain_and_key.p12" to="fullchain_and_prvtkey.p12"/>
+	<globmapper from="${tomcat.server}_fullchain_and_key.p12" to="${keystore.file}"/>
       </copy>
 
       <exec executable="sudo" dir="/tmp" failonerror="true">
-	<arg line="rm -f /tmp/${tomcat.server}_fullchain_and_key.p12" />
-      </exec>      
+		<arg line="rm -f /tmp/${tomcat.server}_fullchain_and_key.p12" />
+      </exec>
       
-    </else>
-  </if>
-
   </target>
 
@@ -1876,5 +1955,7 @@
 	<filter token="tomcat.port.https" value="${tomcat.port.https}"/>
 	<!--<filter token="keystore.file" value="${packages.home}/tomcat/conf/https_cert/${tomcat.server}.jks" />-->
-	<filter token="keystore.file" value="${packages.home}/tomcat/conf/https_cert/fullchain_and_prvtkey.p12" />
+	<!--ON UNIX: <filter token="keystore.file" value="${packages.home}/tomcat/conf/https_cert/fullchain_and_prvtkey.p12" />-->
+	<!--ON WINDOWS: <filter token="keystore.file" value="conf/https_cert/fullchain_and_prvtkey.pfx" />-->
+	<filter token="keystore.file" value="conf/https_cert/${keystore.file}" />
 	<!-- tomcat Connector's keystoreType param defaults to JKS (Java keystore), see https://tomcat.apache.org/tomcat-7.0-doc/config/http.html
 	We'll follow the instructions at https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082,
