<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.gmail-hoenzb
{mso-style-name:gmail-hoenzb;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Brain,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">For our deployment, we have F5 load-balancers. I configured an F5 virtual server object, that listens on port 443 (SSL/HTTPS) for the public interface and additional virtual
servers for each respective port for each interface Staff, Backend, Solr. I elected to use 443 for the public interface for ease of use for customers using AS.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">https://<AS_URL>/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">vs<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">http:// <AS_URL>:8081/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The F5 NATs the “Client” connection to the “AS server”, with the connection between the “F5” and the “AS server” still being unencrypted (F5 acting as a HTTPS proxy).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I modified the config.rb to configure the application to use a different set of ports for the F5 connections to the server, while the client connections to the F5 use AS default
ports (with the exception of 443 for the public interface), then I wrote a HTTP URI rewrite rule (called an iRule in F5 land) to re-write HTTP requests as HTTPS while maintaining the original requested URI string.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The path is:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Client
</span><span style="font-size:11.0pt;font-family:Wingdings">ß</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> HTTPS
</span><span style="font-size:11.0pt;font-family:Wingdings">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> F5
</span><span style="font-size:11.0pt;font-family:Wingdings">ß</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> HTTP
</span><span style="font-size:11.0pt;font-family:Wingdings">à</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> AS Server<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">For the traffic between the F5 and the AS Server, the server is postured on our network in a way that we aren’t concerned about unencrypted traffic on the wire.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Referring back to AS documentation; if you use the Apache or some other method, you can install the proxy application on the same host as the AS server, and unencrypted traffic
is never put onto the wire or leaves the server hosting the AS application, which is always preferred.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-Robbie<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Robert Cook<br>
Systems Engineer</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><span style="font-size:10.0pt;font-family:"Courier New";color:black">Dept. of Technology Services</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><span style="font-size:10.0pt;font-family:"Courier New";color:black">Seattle Public Schools</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><span style="font-size:10.0pt;font-family:"Courier New";color:black">E: <a href="mailto:rocook@seattleschools.org">
rocook@seattleschools.org</a></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><br>
</span><span style="font-size:10.0pt;font-family:"Courier New";color:black">P: 206-252-0352 (Forwards to my cellphone)<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> archivesspace_users_group-bounces@lyralists.lyrasis.org [mailto:archivesspace_users_group-bounces@lyralists.lyrasis.org]
<b>On Behalf Of </b>Jason Loeffler<br>
<b>Sent:</b> Wednesday, December 13, 2017 12:38 PM<br>
<b>To:</b> Archivesspace Users Group <archivesspace_users_group@lyralists.lyrasis.org><br>
<b>Subject:</b> Re: [Archivesspace_Users_Group] installing wildcard SSL cert, redirect http to https<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid #9C0006 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt;margin-bottom:2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFC7CE"><b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#9C0006">WARNING:</span></b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black"> The sender of
this email could not be validated and may not match the person in the "From" field. This
<b>might</b> be a fake e-mail<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal">Brian, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There is limited documentation in the README_HTTPS.md file. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="goog_1397951669"><br>
</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://github.com/archivesspace/archivesspace/blob/bf7849472b0fcb91961c91764f757681670dc204/README_HTTPS.md">https://github.com/archivesspace/archivesspace/blob/bf7849472b0fcb91961c91764f757681670dc204/README_HTTPS.md<br>
</a><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The technical documentation team has plans for enhancing this documentation in 2018. You might reach out to one of its members if you're having trouble with the configuration. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://archivesspace.atlassian.net/wiki/spaces/AC/pages/141197319/Tech+Docs+Workplan+for+2017-2018">https://archivesspace.atlassian.net/wiki/spaces/AC/pages/141197319/Tech+Docs+Workplan+for+2017-2018</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards, Jason<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white">Jason Loeffler</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white">Technology Consultant | </span><span style="font-family:"Garamond",serif;color:#666666">The American Academy in Rome</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white">Minor Science | Application Development & Metadata Strategy</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white">Brooklyn, New York</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white"><a href="mailto:jason@minorscience.com" target="_blank">jason@minorscience.com</a></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white">(347) 405-0826</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Garamond",serif;color:#666666;background:white">minorscience (Skype)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Dec 12, 2017 at 3:57 PM, Brian Slenk <<a href="mailto:slenkb@hope.edu" target="_blank">slenkb@hope.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Hello, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have a new installation of an archives space server. Is there a way with the Apache Solr web server to add an SSL wildcard certificate, and then redirect http to https for the the public interface ? I am not finding documentation if
this is possible.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888">Brian<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"> <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Archivesspace_Users_Group mailing list<br>
<a href="mailto:Archivesspace_Users_Group@lyralists.lyrasis.org">Archivesspace_Users_Group@lyralists.lyrasis.org</a><br>
<a href="http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group" target="_blank">http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#9C6500">CAUTION:</span></b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black"> This email originated
from outside of the organization. Please don't click links, open attachments, or reply with confidential details unless you are certain you know the sender and are expecting the content.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>