Changeset 32477 for main/trunk

Timestamp:

2018-09-21T19:08:14+12:00 (6 years ago)

Author:

ak19

Message:

HTTPS certification on windows: Using openSSL for generating the account and domain keys, rather than letting zeroSSL do this for us.

File:

• main/trunk/greenstone3/build.xml (modified) (2 diffs)

main/trunk/greenstone3/build.xml

@@ -1646 +1646 @@
                NOTE TO OBTAINING A TLS (SSL) CERTIFICATE FOR HTTPS
       *********************************************************************
-      A certificate is needed for your GS server to serve pages over https.
+      A signed certificate is needed for your GS server to serve pages over https.
       This target will attempt to obtain a certificate for you from the official and free Certificate Authority Let's Encrypt.
-      However, a certificate can only be obtained if you have sudo permissions on this machine that you're installing Greenstone on.
+      However, a certificate can only be obtained if you have admin/sudo permissions on this machine that you're installing Greenstone on.
 
       Note that:
@@ -1727 +1727 @@
     <mkdir dir="${packages.home}/tomcat/webapps/ROOT/.well-known/acme-challenge"/>
     <mkdir dir="${packages.home}/tomcat/conf/https_cert"/>
+  
+    <!--
+        For Windows, Greenstone can generate the account and domain keys with the openSSL we compiled up ourselves
+        and put on SVN (at GS3/bin/windows/openssl) rather than let ZeroSSL generate these keys for the user.
+        Letting Greenstone generate the keys may be considered more trustworthy by the user than letting a 3rd
+        party do so. See https://zerossl.com/usage.html#First_time_run_and_regular_use for OpenSSL commands
+        If we don't generate the keys ourselves with our OpenSSL, then ZeroSSL will do so automatically in the
+        call to le64/32.exe further below, as it's passed in the flag generate-missing.
+    -->
+    <!-- We generate the account key named "privkey.key" in ${packages.home}\tomcat\conf\https_cert -->
+    <exec executable="cmd" osfamily="windows" dir="${basedir}/bin/${os.bin.dir}/openssl/bin" spawn="false">
+      <arg value="/c" />
+      <arg value="openssl.exe" />
+      <arg value="genrsa" />
+      <arg value="-out" /><arg value="${packages.home}\tomcat\conf\https_cert\privkey.key" /><arg value="4096" />
+    </exec>
+  
+    <!-- Also generate the domain key (for csr-key parameter to zeroSSL's le.exe)
+        ${packages.home}\tomcat\conf\https_cert\${tomcat.server}.key
+        Using 2048 instead of 4096 bits for this. See https://zerossl.com/usage.html#First_time_run_and_regular_use
+    -->
+    <exec executable="cmd" osfamily="windows" dir="${basedir}/bin/${os.bin.dir}/openssl/bin" spawn="false">
+      <arg value="/c" />
+      <arg value="openssl.exe" />
+      <arg value="genrsa" />
+      <arg value="-out" /><arg value="${packages.home}\tomcat\conf\https_cert\${tomcat.server}.key" /><arg value="2048" />
+    </exec>
   
     <!-- stop the included tomcat (also stopping derby and solr) -->