Bug 21044 - Error 400 'broken link' when enabling SSL from end to end
Summary: Error 400 'broken link' when enabling SSL from end to end
Status: CLOSED INVALID
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-07-06 09:26 UTC by Henri Jacob
Modified: 2019-10-14 19:56 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Henri Jacob 2018-07-06 09:26:25 UTC
Our Koha services (v16.05) are hosted on a CentOS server behind a http reverse-proxy (Apache) in mod_cgi mode.
We plan to offer SSL access "from end to end" to both staff and opac clients.
For this  purpose, we configured the Apache Koha server like this:

Apache configuration file /etc/httpd/conf.d/ssl.conf (with auto-certified certificate):

       SSLEngine               on
       SSLProtocol             all -SSLv3
       SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-......
       SSLHonorCipherOrder     on
       SSLCompression          off
       SSLCertificateFile          /etc/certificats/auto-signes/<koha-server>.crt
       SSLCertificateKeyFile       /etc/certificats/auto-signes/<koha-server>.key

And the http reverse-proxy is configured like that :

<VirtualHost xxx.yyy.zzz.www:443>
    ServerName xxxxxxxx   
    Use SSL sssssss.univ-rennes1.fr  
    Include conf/SSLProxy-authentifie.conf
    SSLProxyCACertificateFile /etc/certificats/auto-signes/<koha-server>.crt
    ProxyPass / http://<koha-server>:8880/ min=0 max=100 smax=50 ttl=10 timeout=900
    ProxyPassReverse / http://<koha-server>:8880/
</VirtualHost>

Why do the 'broken link' error occur ? We have seen some hard-coded references like 'http://localhost' and 'http://localhost:8080' .
Should we modify all these references to 'http://localhost' and 'https://localhost:8443' ?
Does-it works with an auto-certified certificate ?

We read these pages about this subject:
    Enabling SSL for Koha staff view : https://lists.katipo.co.nz/public/koha/2011-May/029006.html
    Access Koha via SSL :  https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5576

Thank you for any suggestion,

best regards,
Henri Jacob
Comment 1 Katrin Fischer 2018-07-14 12:08:58 UTC
Hi Henri,
Koha works well with https, we have always been running it with https on both staff and opac since 3.2. And there should be no hardcoded http. Sadly I can't tell you what went wrong for you - please bring this to the mailing list where many more people will read it and be able to offer suggestions.