configure SSL and https in Liferay

[17年前 に Marios Chatzi によって更新されました。]

Hello Liferay people,

Can someone describe the steps for enabling ssl in Liferay portal? Will it be enough to create certificate and enable ssl in Tomcat (I am using Liferay 4.2 on Tomcat)? I suppose that somehow I have to declare that all liferay pages should be accessed by https instead of http. How can this be done?

Also I would like to know if I can secure only some portlets (for example the login portlet). Can this be done in Liferay?

[17年前 に Code Klopper によって更新されました。]

Hi Marios,

For enabeling ssl for Liferay (Tomcat servlet container) you can just follow the steps in enabeling ssl for Tomcat. When you're done you should be able to use ssl for your Liferay application. I did this myself too and works like a charm.

The only additional web.xml configuration change i made was the following. This change will take care of redirecting all http requests to https requests.

<security-constraint>
		<web-resource-collection>
		<web-resource-name>Secret Stuff</web-resource-name>
		<url-pattern>/*</url-pattern>
	</web-resource-collection>
	<user-data-constraint>
		<transport-guarantee>CONFIDENTIAL</transport-guarantee>
	</user-data-constraint>
</security-constraint>

To configure Tomcat for ssl you could use the following resource to help you out:
CSR Creation
SSL Certificate installation

[17年前 に David Atkins によって更新されました。]

I have the same question...but how do we enable SSL only for certain portlets. For example, we want login and profile pages to be secure, but not the rest of the site.

[17年前 に Code Klopper によって更新されました。]

I'm sorry, i don't have the answer for that.

[17年前 に David Atkins によって更新されました。]

Does anyone use SSL in Liferay? I would think it would be a pretty typical requirement to seucre the login and profile portals. We are concerned that making the entire site SSL would have performance and user experience implications.

[17年前 に Marios Chatzi によって更新されました。]

Thanks Code,

actually I am interested in what David wants also, but I guessed that it would be easier to find answers in how to secure whole portal first as I need this functionality quickly

Securing only specific portlets is more reasonable but I have not find anywhere how to do this

[17年前 に Code Klopper によって更新されました。]

Sorry, i don't know the answer to this yet. I haven't needed this functionality yet but can't it be configured in the web.xml of the liferay installation? Because this is also the place for configuring portions to require secure connections for url strings...

[17年前 に Patrick Victorio によって更新されました。]

If you are using an Apache HTTP Server front-end to Tomcat you can do it with some Apache HTTP Server configuration. With just a Tomcat server, SSL will encrypt all traffic not just your login page... I'd like to see how to do this also for the Liferay public Guest community. Would be a nice capability... for security though I would prefer that all traffic is SSL. In that scenario Tomcat SSL does the job well.

[16年前 に soori n によって更新されました。]

Any one knows how to configure in JBOSS+JETTY ?

one morething if we have multipleportals, we dont expect all the portals are https right , how we handle this ?

[16年前 に soori n によって更新されました。]

i find the link here from the site jetty.mortby.org, it is helped to test the ssl in jboss+jetty successfully.

[10年前 に Chandrakant Mahalle によって更新されました。]

Hi David ,
Simply made one change in "portal-setup-wizard.properties" file add below entry in this file will server your perporse.
" company.security.auth.requires.https=true"