# Problems securing OOD

**URL:** <https://discourse.openondemand.org/t/problems-securing-ood/2981>\
**Category:** Get Help\
**Created:** [September 26, 2023, 1:17pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981 "2023-09-26T13:17:16Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [September 26, 2023, 1:17pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/1 "2023-09-26T13:17:16Z")

</div>

Hi, I have been performing several OOD installations in different environments, but so far only over HTTP(without SSL) protocol. I’ve been testing for a few days to secure the installation in a test environment according to the : [3. Secure Apache httpd — Open OnDemand 3.0.0 documentation](https://osc.github.io/ood-documentation/latest/installation/add-ssl.html).

I am not getting it to work, I am using self signed certificates, but as far as I understand this should not be a problem, my configuration file looks like this:

* * *

port: 80  
listen\_addr\_port: 80  
servername: [www.ood.com](http://www.ood.com)  
host\_regex: “[^/]+”  
node\_uri: ‘/node’  
rnode\_uri: '/rnode  
#ssl: null  
ssl:

- ‘SSLCertificateFile “/etc/pki/tls/certs/certs/ood/ood.crt”’
- ‘SSLCertificateKeyFile “/etc/pki/tls/certs/ood/ood/ood.key”’
- ‘SSLCertificateChainFile “/etc/pki/tls/certs/ood/ood/ood.crt”’  
dex:  
connectors:
- type: ldap  
id: ldap  
name: OOD  
config:  
host: [www.ood.com:389](http://www.ood.com:389)  
…

But when I try to connect with https it redirects to the index page located in /var/www/html instead of accessing the OOD portal.

Any idea what could be happening?  
Thank you very much in advance

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 26, 2023, 1:41pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/2 "2023-09-26T13:41:43Z")

</div>

Seems like apache doesn’t know how to route the request. Hopefully this page will help. Seems like you need to set `servername` for apache to correctly route your request to the OOD virtual host.

[https://osc.github.io/ood-documentation/latest/how-tos/debug/debug-apache.html#show-virtualhosts](https://osc.github.io/ood-documentation/latest/how-tos/debug/debug-apache.html#show-virtualhosts)

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [September 26, 2023, 2:08pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/3 "2023-09-26T14:08:24Z")

</div>

Hello! and thank you very much for your prompt reply !!!  
It looks like you are right Jeff, the redirect is not performing correctly and communicating with the local Apache server (which makes sense to me due to the testing I have done on the page shown).

 ![Screenshot from 2023-09-26 16-02-19](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/2/20774730a530ba37bad2aa773017661ab87a1f4c.png)

I am modifying the file : /etc/httpd/conf.d/ssl.conf to indicate what will be the correct redirection.  
I am testing with the section that I think is necessary:

## 

## SSL Virtual Host Context

## 

# General setup for the virtual host, inherited from global configuration

DocumentRoot “/var/www/ood”  
ServerName [www.ood.com:443](http://www.ood.com:443)  
But I can not get it to work, still waiting for an index.html (in fact if I generate it in this path is the page I get), I’m doing wrong redirection? Should I indicate a different way?

Best regards

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 26, 2023, 2:13pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/4 "2023-09-26T14:13:55Z")

</div>

I’m not sure if you need to set any other `conf` file for this to behave the way you expect.

2 things:

- first is settting `servername` in the `ood_portal.yml`. Bouncing httpd so that this servername writes out to the resulting conf file.
- secondly is that you have to access this instance through the `servername` you’ve provided (`www.ood.com`). This is what you should be supplying in your browsers URL bar. Are you accessing through a different hostname or just using the ip?

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [September 26, 2023, 2:17pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/5 "2023-09-26T14:17:02Z")

</div>

Everything works correctly with the address “[www.ood.com](http://www.ood.com)” or “[http://www.ood.com](http://www.ood.com)” when the configuration file has the section

ssl: null

This problem occurs when I add the lines with the SSL certificates so that HTTPS can be used.

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [September 26, 2023, 2:23pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/6 "2023-09-26T14:23:46Z")

</div>

Is it possible that the virtual host on port 443 needs to be configured by copying the one declared in “/etc/httpd/conf.d/ood-portal.conf” but using the corresponding port instead of port 80?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 26, 2023, 2:27pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/7 "2023-09-26T14:27:10Z")

</div>

Hmmm… Maybe get rid of the port configurations. You should be able to just use defaults here.

> [@Christian-bustelo](#):
>
> Is it possible that the virtual host on port 443 needs to be configured by copying the one declared in “/etc/httpd/conf.d/ood-portal.conf” but using the corresponding port instead of port 80?

No manual editing of `ood-portal.conf` or derivatives of it should be required. Indeed it’s not recommended to edit this file by hand and it’s definitely not required to duplicate it.

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [September 26, 2023, 2:40pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/8 "2023-09-26T14:40:18Z")

</div>

With this configuration, as I was saying, I am able to perform the access.

 ![Screenshot from 2023-09-26 16-34-16](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/f/f00d82368c3db7431a1fb2923c32e2734d49e624.png)

The problem comes when uncommenting the SSL lines and commenting out the one that says “ssl:null”. When I do that and generate again using the command “/opt/ood/ood-portal-generator/sbin/update\_ood\_portal -f”, I can see that port 443 is not configured automatically:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/3/3d389b22d17c2a283433cb2d9e4273f4d820e6f0.png)

So I understand that my mistake is in how I am configuring the VirtualHost 443, I don’t know if you have any idea or advice on how I should do it?

Thank you for your hep Jeff!

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 26, 2023, 2:46pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/9 "2023-09-26T14:46:30Z")

</div>

OK - looking at the template maybe you do need to specify `port`.

So if you specify `ssl` then you also need to specify the port to be 443.

```yaml
port: 443

```

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [September 26, 2023, 2:52pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/10 "2023-09-26T14:52:55Z")

</div>

Yes now something changed, I seem to have some errors, but the redirection seems to do it right. I’ll keep working on this these days and see if can fix it. I will keep updating this thread if need more help related to the topic, or post the final solution in case it works. Thanks!

---

<div class="post-metadata">

**Author:** ![alainvanhoof](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/alainvanhoof/32/1724_2.png) [@alainvanhoof](https://discourse.openondemand.org/u/alainvanhoof)\
**Post date:** [September 28, 2023, 5:47pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/11 "2023-09-28T17:47:50Z")

</div>

I don’t see any mention in this threat of this command to update the apache conf when ood\_portal.yaml changes:

You would then build and install the new Apache configuration file with:

sudo /opt/ood/ood-portal-generator/sbin/update\_ood\_portal

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 28, 2023, 6:15pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/12 "2023-09-28T18:15:56Z")

</div>

Hi and welcome @alainvanhoof!

In more recent versions of OpenOnDemand bouncing httpd (or apache2 as the case may be) through systemd will execute this command before it restarts.

```auto
# httpd given here, but could be different for different platforms
systemctl restart httpd 

```

---

<div class="post-metadata">

**Author:** ![alainvanhoof](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/alainvanhoof/32/1724_2.png) [@alainvanhoof](https://discourse.openondemand.org/u/alainvanhoof)\
**Post date:** [September 28, 2023, 6:41pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/13 "2023-09-28T18:41:20Z")

</div>

Aha, that’s not it then.

---

<div class="post-metadata">

**Author:** ![alainvanhoof](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/alainvanhoof/32/1724_2.png) [@alainvanhoof](https://discourse.openondemand.org/u/alainvanhoof)\
**Post date:** [September 28, 2023, 6:43pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/14 "2023-09-28T18:43:29Z")

</div>

Or ood\_porttal.yml does not contain any port number or listen\_addr just the ssl directives and that works for us.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 28, 2023, 6:59pm UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/15 "2023-09-28T18:59:21Z")

</div>

This was my assumption as well - that it should _just work_ when ssl is enabled. Good to hear it confirmed!

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [October 16, 2023, 8:39am UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/16 "2023-10-16T08:39:58Z")

</div>

Hi Guys! and sorry for the delay. I have been busy with other projects instead of OOD. I seem to have made progress with the configurations proposed by Jeff and Alainvanhoof but now I’m having a problem with the self signed certificates, onces I aced to the https version of OOD I see an internal error and once I check the log what I see is :

[Mon Oct 16 08:37:30.079549 2023] [auth\_openidc:error] [pid 35320:tid 140074855429888] [client 10.3.0.1:60014] oidc\_util\_http\_call: curl\_easy\_perform() failed on: [Telepathy - Powering Successful Brands](https://www.ood.com/dex/.well-known/openid-configuration) (SSL certificate problem: self signed certificate)  
[Mon Oct 16 08:37:30.079578 2023] [auth\_openidc:error] [pid 35320:tid 140074855429888] [client 10.3.0.1:60014] oidc\_provider\_static\_config: could not retrieve metadata from url: [Telepathy - Powering Successful Brands](https://www.ood.com/dex/.well-known/openid-configuration)

Are self-signed certificates no valid for this?  
Once again thank you for your help

---

<div class="post-metadata">

**Author:** ![Christian-bustelo](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/christian-bustelo/32/2685_2.png) [@Christian-bustelo](https://discourse.openondemand.org/u/Christian-bustelo)\
**Post date:** [October 18, 2023, 10:15am UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/17 "2023-10-18T10:15:23Z")

</div>

Hello everyone again, I have just solved the problem I was having and I would like to leave it here in case anyone else has the same problem.

If I do the configuration as indicated in the thread (no port configuration in the ood\_portal.yml) the problem I was having is because of the certificate. The idea was to test this on a virtual cluster to be able to see that everything was working correctly, for this reason I have not been able to get a real certificate or using the Let’s Encrypt tool. In the end I managed to solve it by creating my own Certificate Authority and signing my own certificates. I think that for testing environments this can be very useful for anyone who wants to try it.

Best regards and thanks to all!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [April 15, 2024, 10:16am UTC](https://discourse.openondemand.org/t/problems-securing-ood/2981/18 "2024-04-15T10:16:05Z")

</div>

Closed on April 15, 2024, 10:16am UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.