Combination View Flat View Tree View
Threads [ Previous | Next ]
toggle
Warren McCann
6.0.5 CE: Tomcat 6 and SSL "Unencrypted Information"
February 11, 2011 7:31 AM
Answer

Warren McCann

Rank: Junior Member

Posts: 36

Join Date: November 19, 2010

Recent Posts

Hi All:

Setup: 6.0.5 CE, Tomcat 6.0.18, SSL enabled with applicable identity cert, server.xml updated appropriately, ROOT/WEB-INF/web.xml includes confidential transport, all other webapps have confidentital transport, even set conf/web.xml to confidentital.

Also configured portal-ext.properties and tried both:
main.servlet.https.required=true
company.sercurity.auth.requires.https=true

Receiving browser security warning when hitting the "landing" page. The landing page has no portlets included and just has navigatiog, a logo, and the dockbar. I reduced the page to being as minimal as possible:
"You have requested an encrypted page that contains some unencrypted information..."

I'm well aware I can uncheck "alert me", but that doesn't solve the problem ;-)

Using firebug, I see all the resourcs are pulled in via https. At this point, I have a suspicion that it is internal portlet communication that is causing this, beyond that, I'm at a loss. I figured that I would ask here before I start pulling things apart even further. I have not seen any mention of this in the forums or on the Wiki.

Anyone else hit this and have advice?

Thanks in advance,
Warren
Warren McCann
RE: 6.0.5 CE: Tomcat 6 and SSL "Unencrypted Information"
February 16, 2011 9:32 AM
Answer

Warren McCann

Rank: Junior Member

Posts: 36

Join Date: November 19, 2010

Recent Posts

Hi All:

Still stuck. I've tried a few things with no luck. I don't see any HTTP related content coming back.

Additionally, when I first load the landing page I receive the error. After that, the communication is fully secure. If I close the browser and attempt again, same outcome.

Thanks,
Warren
Olaf Kock
RE: 6.0.5 CE: Tomcat 6 and SSL "Unencrypted Information"
February 17, 2011 12:34 PM
Answer

Olaf Kock

LIFERAY STAFF

Rank: Liferay Legend

Posts: 3431

Join Date: September 23, 2008

Recent Posts

Try "Live HTTP Headers", a firefox plugin. This will also show you all headers etc. in a protocol way, separate from the DOM - it will also include all js loads etc.

Also, set Firefox to only warn you, but make sure that it doesn't block the resources it warns you about - otherwise there would naturally be only https content when the rest is blocked.

On Firefox, Strg-I, the page information, gives a nice opportunity to double check the Media tab for all the embedded content and how it's loaded.
Warren McCann
RE: 6.0.5 CE: Tomcat 6 and SSL "Unencrypted Information"
February 18, 2011 5:52 AM
Answer

Warren McCann

Rank: Junior Member

Posts: 36

Join Date: November 19, 2010

Recent Posts

Thank for the reply. I actually made some progress yesterday.

I removed liferay from the equation and just created a ping web application and secured it. I was receiving the same issue. I probably should have done that sooner.

I was also solely working in Firefox because of IE bugs currently in 605CE and because I was working on some design aspects and reliant on firebug. Anyway, I switched to IE just to check and found that I was NOT receiving the unencrypted issue.

That led me down the path of, is there something wrong with Firefox. Sure enough, there are reported bugs on Mozilla:
https://bugzilla.mozilla.org/show_bug.cgi?id=506008
https://bugzilla.mozilla.org/show_bug.cgi?id=550691

and some random blogs:
http://getsatisfaction.com/facebook/topics/major_issues_with_ssl_not_engaging_in_firefox_3_6_3


While I don't feel it's resolved, I feel better knowing that I've set everything up appropriately and that there isn't anything within Liferay causing this...
Olaf Kock
RE: 6.0.5 CE: Tomcat 6 and SSL "Unencrypted Information"
February 18, 2011 6:33 AM
Answer

Olaf Kock

LIFERAY STAFF

Rank: Liferay Legend

Posts: 3431

Join Date: September 23, 2008

Recent Posts

Thanks for reporting this information back. Might be helpful for others as well.