SSL configuration

Create a certificate for your system.

Update your application server configuration to enable SSL.

Update the Bonita web application to add the security definition.

Go to the BUNDLE_HOME/conf directory and create a directory called ssl to store certificate files.

Create the self-signed certificate and its private key using openssl:
openssl req -new -x509 -days 365 -nodes -out conf/ssl/test.bonitasoft.net.pem -keyout conf/ssl/test.bonitasoft.net.key

Provide the information about your system that openssl requires.

Edit conf/server.xml and add the following definition for the Connector:

<Connector port="8443"
    protocol="HTTP/1.1"
    SSLEnabled="true"
    maxThreads="150"
    scheme="https"
    secure="true"
    URIEncoding="UTF-8"
    SSLCertificateFile="${catalina.base}/conf/ssl/test.bonitasoft.net.pem"
    SSLCertificateKeyFile="${catalina.base}
    /conf/ssl/test.bonitasoft.net.key"
    SSLVerifyClient="optional"
    SSLProtocol="TLSv1.2">
</Connector>

Install the Tomcat native library, which contains APR: sudo apt install libtcnative-1

Edit BUNDLE_HOME/webapps/bonita/WEB-INF/web.xml and add the following security definition:

<web-app>
   ...
   <security-constraint>
      <web-resource-collection>
         <web-resource-name>Bonita Applications Secure URLs</web-resource-name>
         <url-pattern>/*</url-pattern>
      </web-resource-collection>
      <user-data-constraint>
         <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
   </security-constraint>
</web-app>

Start Tomcat: ./bin/startup.sh

Check that everything is correctly configured, by opening https://127.0.0.1:8443/bonita in your browser. Your browser should warn you about the self-signed certificate used to perform the HTTPS connection. You can safely add this self-signed certificate to the exceptions allowed.

Run the Java keytool to create a certificate and store it in the keystore. (Note: if you are using Windows, you need to run keytool as administrator.) keytool -genkey -alias tomcat -keyalg RSA -keystore conf/ssl/keystore

Answer the questions that keytool asks. When asked for your first name and last name, provide the hostname of your system.

Edit conf/server.xml and include the following configuration for the Connector:

<Connector port="8443"
protocol="org.apache.coyote.http11.Http11NioProtocol"
SSLEnabled="true"
maxThreads="150"
scheme="https"
secure="true"
URIEncoding="UTF-8"
keystoreFile="${catalina.base}/conf/ssl/keystore"
keystorePass="password!"
SSLVerifyClient="optional"
SSLProtocol="TLSv1.2"></Connector>

Edit BUNDLE_HOME/webapps/bonita/WEB-INF/web.xml and add the following security definition:

<web-app>
   ...
   <security-constraint>
      <web-resource-collection>
         <web-resource-name>Bonita Applications Secure URLs</web-resource-name>
         <url-pattern>/*</url-pattern>
      </web-resource-collection>
      <user-data-constraint>
         <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
   </security-constraint>
</web-app>

Start Tomcat: ./bin/startup.sh

Check that everything is correctly configured, by opening https://127.0.0.1:8443/bonita in your browser. Your browser should warn you about the certificate used to perform the HTTPS connection. You can safely add this certificate to the exceptions allowed.

Make sure that your load balancer adds X-Forwarded-Proto and X-Forwarded-For headers. If you use HAProxy you can add following lines into your HAProxy configuration :

option forwardfor
reqadd X-Forwarded-Proto:\ https

Edit conf/server.xml and include the RemoteIpValve configuration for the host:

<Host name="localhost"  appBase="webapps" unpackWARs="true" autoDeploy="true">

<Valve
 className="org.apache.catalina.valves.RemoteIpValve"
 internalProxies="172\.31\.\d{1,3}\.\d{1,3}"
 remoteIpHeader="X-Forwarded-For"
 protocolHeader="X-Forwarded-Proto"
 />

If you use the AccessLogValve, edit conf/server.xml and set requestAttributesEnabled="true":

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
              prefix="localhost_access_log." suffix=".txt" requestAttributesEnabled="true"
              pattern="%a %{X-Forwarded-Proto}i %l %u %t "%r" %s %b" />