Fop2 over HTTPS

Hi,

We are using Fop2 on multiple servers on http but now want to use a SSL Cert for it. We have been using SSL Certs on our PBX for years but not for Fop2 as its never worked.

Here is some of our config:

In the file /usr/local/fop2/fop2.cfg

ssl_certificate_file=/etc/httpd/pki/webserver.crt
ssl_certificate_key_file=/etc/httpd/pki/webserver.key

In the file /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/httpd/pki/webserver.crt
SSLCertificateKeyFile /etc/httpd/pki/webserver.key

This works: http://xxxx.xxxx.com:7866/fop2/
This doesnt work: https://xxxx.xxxx.com:10000/fop2/
But access to the server via https and port 10000 works: https://xxxx.xxxx.com:10000/

FreePBX version 14.0.13.28
Asterisk Version 13.18.4

Any suggestions?

https://www.fop2.com/docs/faq.php#WhenItrytodownloadvoicemailorrecordingsIgeta"noway"message?

Section:
I cannot connect to FOP2 while using HTTPS/SSL

How is your webserver configured to serve the (presumably /var/www/html/fop2) directory ?

You will need to know the port and it’s relative location with respect to the ‘webroot’ , these data these are likely sonewhere in /etc/httpd/sites-enabled/*

Thanks Comtech but we have already tried that on a few servers

Hi Dicko, yes its at /var/www/html/fop2

Server is using Apache but im not sure where to check what your asking as there is no /etc/httpd/sites-enabled/*

If debian based then probably look in /etc/apache2/sites-enabled/* but that is purely a convention and would depend on how the webserver was installed, a blunt search for a tell-tail words here

grep -r fop2 /etc/httpd/

(Edit; you are using apache2 aliased as httpd on a redhat based system so everything will be in /etc/httpd/*)

Hi Dicko,

Thanks for your reply.

Nothing comes up when we do grep -r fop2 /etc/httpd/

In the file /etc/httpd/conf.d/ssl.cert there is this:

++++++++++++++++++++++++

ServerName vtkhost8.com:10000
LogLevel warn
SSLEngine on
SSLCertificateFile /etc/httpd/pki/webserver.crt
SSLCertificateKeyFile /etc/httpd/pki/webserver.key
SSLCertificateChainFile /etc/httpd/pki/ca-bundle.crt
DocumentRoot /var/www/html
SetEnvIf User-Agent ‘.MSIE.’ nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
Alias /.well-known /var/www/html/.well-known
Alias /.freepbx-known /var/www/html/.freepbx-known
RewriteEngine on
RewriteRule ^/.(well-known|freepbx-known)/ - [H=text/plain,L]
RewriteRule (^.|/.) - [F]

++++++++++++++++++++++++

Maybe we need to duplicate this for the fop2

Then can we assume that https://yourwebsite.com:nnnn comes up with the ssl green bit good ?

can we further assume that your fop2 is installed under your webroot (by default, /var/www/html/fop2)

If those are both true, then https://yourwebsite.com/fop2:nnnn should equally work if fop2 and your website are sharing the same cert.

(why are you mapping your web service ports all over the place? )

Hi Dicko,

Yes to https://yourwebsite.com:10000 works

Yes fop2 is installed at /var/www/html/fop2

The config file for fop2 is at /usr/local/fop2/fop2.conf and we have put the correct below certificates in that:

ssl_certificate_file=/etc/httpd/pki/webserver.crt
ssl_certificate_key_file=/etc/httpd/pki/webserver.key

No https://yourwebsite.com:10000/fop2 stil doesnt work for some reason

What do you mean by (why are you mapping your web service ports all over the place? )

I expect https to be on 443 and I would hope that 80 is re-written to 443 with a 301, , other than that It has always worked for me, do your log files (error and access) show connections connecting to https:nnn:/10000 at all? what are the 4nn error codes when they fail

With this config what i have done is you can access fop2 with port 80 and 443 and also i secure fop2 admin interface to allow only from specific ip and freepbx admin interface with port 882 with https or with port 8080 without https so go to Freepbx Port Management change Admin port to 8080 than go to /etc/httpd/conf/httpd.conf and add this:

Listen 80
Listen 882

<VirtualHost *:443>
DocumentRoot “/var/www/html/fop2/”
ServerName yourdomain.com
ServerAlias www.yourdomain.com

<Files index.php>
    Order deny,allow
    Deny from all
    Allow from x.x.x.x (IP ADDRESS TO ALLOW TO ADMIN INTERFACE ONLY)
</Files>

SSLEngine on
SSLCertificateFile /etc/ssl/yourssl.crt
SSLCertificateKeyFile /etc/ssl/yourssl.key

<VirtualHost *:80>
ServerName yourdomain.com
ServerAlias www.yourdomain.com

 <Files index.php>
    Order deny,allow
    Deny from all
    Allow from x.x.x.x (IP ADDRESS TO ALLOW TO ADMIN INTERFACE ONLY)
 </Files>

    RewriteEngine on
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [NC,R=301,L]

<VirtualHost *:882>
DocumentRoot “/var/www/html/”
ServerName yourdomain.com
SSLEngine on
SSLCertificateFile /etc/ssl/yourssl.crt
SSLCertificateKeyFile /etc/ssl/yourssl.key

Dont forget to restart apache.
And keep in mind that if you restore a backup, the freepbx will comment the Listen Ports to something like this #Listen 80 #Listen 882 but you just remove the comment and restart apache.

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.