https for cantaloupe

[matthewbrutonall]

Hi there,
I'm trying to set up https for my cantaloupe server, and I keep getting "Error code: SSL_ERROR_RX_RECORD_TOO_LONG" etc. etc.
I have tried both pkcs12 and jks as formats, and it is always the same error.

I tried the reverse proxy option also, but that's not working.

If anyone has any ideas, I would be really grateful. :)

[DiegoPino]

Hi @matthewbrutonall without seeing your setup it is hard to guess what is wrong there, but maybe it is related to JDK version you are using, see https://stackoverflow.com/questions/57679669/ssl-error-rx-record-too-long-with-custom-server. If that is the case it seems to have been fixed on JDK 13+

We have been using NGINX as SSL terminator in front of Cantaloupe for a few years without any issues. The setup is quite easy

NGINX with Certbot (via Docker).
Cantaloupe via Docker running in the internal Docker Network and being upstreamed by NGINX
Here is the snippet (this is our basic Repository Live Deployment Setup)

https://github.com/esmero/archipelago-deployment-live/blob/7a1d1d24549be0d1d61d91a308a35479a9def673/config_storage/nginxconfig/template/nginx.conf.template#L26-L35

No changes whatsoever on the Cantaloupe side of things but we did build our Cantaloupe (6.x Snapshot) custom. That said we used to run official release in the past also without any changes.

This is our complete ensemble of services in case you want/see that
https://github.com/esmero/archipelago-deployment-live/blob/1.0.0/deploy/ec2-docker/docker-compose-aws-s3.yml

Note: we have also a few running via http 1.1. This has the benefit that connections are kept open/reused but also we have seen less "temporary response to file" caching which is a thing that NGINX will do to serve slower clients.

# Cantaloupe proxypass
    location /cantaloupe/ {
       proxy_http_version 1.1;
       proxy_set_header   "Connection" "";
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_set_header X-Forwarded-Host $host;
       proxy_set_header X-Forwarded-Port $server_port;
       proxy_set_header X-Forwarded-Path /cantaloupe/;
       proxy_read_timeout 120s; 
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       if ($request_uri ~* "/cantaloupe/(.*)") {
         proxy_pass http://cantaloupe/$1;
       }
    }

[matthewbrutonall]

Hi Diego,
Thanks for that. I'm on apache.

The strange thing is that I had it working already, but I had to get a new cert, then when I went to set up https I must have forgotten which method I used, and can't replicate it. So it can't be the Java version then.

At the moment I'm trying to look at how I am creating my keystore. Something perhaps I'm leaving out along the way.

Also, do you think it could have anything to do with my server config file?

I should add to all of this that I do manage to get the server to work when I go to it on port 8183. I just put :8183 after the web domain. And "admin" after that to get into the admin panel.

It's just getting it up on the 443 port which is the problem.

[DiegoPino]

Hi, oh, for Apache read this one. Pretty sure it is related to the "default" setting in the Virtualhost

https://stackoverflow.com/questions/119336/ssl-error-rx-record-too-long-and-apache-ssl

[DiegoPino]

<VirtualHost _default_:443>
  SSLEngine On
  ...
</VirtualHost>

[matthewbrutonall]

Thanks for all that help.
Just getting to it now.

Anyway, it helped somewhat. The solution you linked to suggested not having your web domain in the server header before :443. Instead they said change it to "default". I didn't have it anyway on my web domain, and when I tried putting to that, apache just wouldnt start.

So with either "default" , "default" and what I had already which was "*", I was able to get it to go to go directly to the index file linked to in document root /var/www/html. That's fine to a certain extent, except obviously it's not going to cantaloupe.

So my question is now: Is there something I should change the document root to?

Because I thought it might pick up that it's suppose to go to cantaloupe somehow through the certs? Or cantaloupe should pick it up.

[matthewbrutonall]

Here are my Cantaloupe properties file and my website config file. Have hashed out the work I was doing on the reverse proxy, but if anyone want to point out things on that too, feel free. Neither are working anyway. I'll take whatever I can get to get this to work. Have a huge number of web links depending on getting this secure server back up and running, so any help is a life saver.