"Session has timed out." when ushing EJBCA over HTTP #876
|
I want to use EJBCA with nginx over https, but i need TLS certificate for this. I setup nginx configuration to have access by HTTP, to prepare whole env, generate certificate and use it for nginx. |
Replies: 1 comment 5 replies
|
Did you look at any of the configuration guides for using a front-end proxy? Are you using container of from-the-scratch software installation? |
|
Yes. Reverse proxy work for me, but as I said i want to use certificate generated by this instance. I use PROXY_HTTP_BIND in my docker compose, and then i pass to ports 8081 and 8082 in reverse proxy configuration. And that work, but i have to create container without PROXY_HTTP_BIND and without reverse proxy firstly, then configure my instance(create SU certificate, remove public access, create my whole PKI Hierarchy, generate certificate for my host) and then, recreate ejbca container wiht PROXY_HTTP_BIND, create reverse proxy. I am curious if its possible to set up container with reverse proxy, and then perform whole configuration using HTTP access, and then send generated cert to host and open 443 port listening. What i see, in http mode, i don't have JSESSIONID coockie |
|
TLS_SETUP=simple always works, without client certificate. But plain http without TLS at all I don't know if anyone is using, not that I've heard about at least. It sounds like you are after more automation? In that case you should consider using some other sort of automation instead of doing basic operations over an insecure channel. There is always the CLI (or ConfigDump in Enterprise) where you can do these things instead quickly and easily. |
|
I try to prepare deployment workflow as simple as possible. It's not big problem if i have some more steps. I was just curious if http problem, i have because of my configuration, or maybe something else. Everything is clear. We can close that discussion |
|
Great! |
|
I face the same probelm,how to config?@primetomas |
TLS_SETUP=simple always works, without client certificate. But plain http without TLS at all I don't know if anyone is using, not that I've heard about at least. It sounds like you are after more automation? In that case you should consider using some other sort of automation instead of doing basic operations over an insecure channel. There is always the CLI (or ConfigDump in Enterprise) where you can do these things instead quickly and easily.