<div dir="ltr">Could this also help you to better setup outh secured endpoints?<div><br></div><div><a href="http://docs.geonode.org/en/master/tutorials/admin/geoserver_geonode_security/index.html#how-to-setup-https-secured-endpoints">http://docs.geonode.org/en/master/tutorials/admin/geoserver_geonode_security/index.html#how-to-setup-https-secured-endpoints</a><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div style="font-size:12.8px">Best Regards,</div><div style="font-size:12.8px">Alessio Fabiani.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>==</div><div>GeoServer Professional Services from the experts!</div><div>Visit <a href="http://goo.gl/it488V" target="_blank">http://goo.gl/it488V</a> for more information.</div><div>==</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Ing. Alessio Fabiani</div><div style="font-size:12.8px">@alfa7691</div><div style="font-size:12.8px"><a href="https://github.com/afabiani?tab=overview" style="font-size:12.8px" target="_blank">github</a><br></div><div style="font-size:12.8px">Founder/Technical Lead</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>GeoSolutions S.A.S.</div><div>Via di Montramito 3/A</div><div>55054 Massarosa (LU)</div><div>Italy</div><div>phone: +39 0584 962313</div><div>fax: +39 0584 1660272</div><div>mob: +39 <span style="font-size:12.8px">331 6233686</span></div><div><br></div><div><a href="http://www.geo-solutions.it/" target="_blank">http://www.geo-solutions.it</a></div><div><a href="http://twitter.com/geosolutions_it" target="_blank">http://twitter.com/geosolutions_it</a></div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">-------------------------------------------------------</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><p><span lang="IT"><font size="1"><b>AVVERTENZE AI SENSI DEL D.Lgs. 196/2003</b></font></span></p><p><span lang="IT"><font size="1">Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.</font></span></p><p><span lang="IT"><font size="1"> </font></span></p><p><font size="1">The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.</font></p><p><font size="1">---------------------------------------------------------------------</font></p></div></div></div></div>
<br><div class="gmail_quote">On Wed, May 31, 2017 at 2:35 AM, Jonathan Doig <span dir="ltr"><<a href="mailto:j.doig@unsw.edu.au" target="_blank">j.doig@unsw.edu.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-AU" link="blue" vlink="purple">
<div class="m_-8032661217188743616WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Yes, no more SSL errors, or even mixed content warnings in the dev console (that I’ve noticed).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fixed the latter by changing http to https wherever needed, but later switched to default-protocol URLs (starting with //) so the current protocol
is used, whether http or https. That would be worth adding to master imho, to reduce the work in adding SSL. Apparently there are some issues with obscure clients though, so may need to weigh that up.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Jonathan<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Patrick Dufour [mailto:<a href="mailto:pjdufour.dev@gmail.com" target="_blank">pjdufour.dev@gmail.com</a><wbr>]
<br>
<b>Sent:</b> Wednesday, 31 May 2017 8:45 AM<br>
<b>To:</b> Jonathan Doig <<a href="mailto:j.doig@unsw.edu.au" target="_blank">j.doig@unsw.edu.au</a>><br>
<b>Cc:</b> geonode-devel <<a href="mailto:geonode-devel@lists.osgeo.org" target="_blank">geonode-devel@lists.osgeo.org</a><wbr>>; Cezary Statkiewicz <<a href="mailto:cezary.statkiewicz@geo-solutions.it" target="_blank">cezary.statkiewicz@geo-<wbr>solutions.it</a>>; Vaughan Allan <<a href="mailto:v.allan@unsw.edu.au" target="_blank">v.allan@unsw.edu.au</a>>; Graham Hannah <<a href="mailto:g.hannah@unsw.edu.au" target="_blank">g.hannah@unsw.edu.au</a>></span></p><div><div class="h5"><br>
<b>Subject:</b> Re: [GeoNode-devel] SSL error on upload and saving metadata<u></u><u></u></div></div><p></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Nice!<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is the whole upload shapefile to GeoNode layer workflow end-to-end secure and working now (setting aside http basemaps or unrelated ui issues.)?<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Patrick<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On May 30, 2017 6:30 PM, "Jonathan Doig" <<a href="mailto:j.doig@unsw.edu.au" target="_blank">j.doig@unsw.edu.au</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal">Hi all<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Following this up with the solution for posterity.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Turns out I couldn’t get a signed certificate with the actual hostname included in the subjectAltName, as our signing authority doesn’t cover the actual host domain. Anyway that
wasn’t the problem. The problem (thanks Vaughan!) was missing root and intermediate certificates.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">The full solution was to:<u></u><u></u></p>
<ol start="1" type="1">
<li class="MsoNormal" style="margin-left:0cm">
Add our (QuoVadis) root and intermediate certificates to /etc/ssl/certs/geonode-chain.<wbr>crt<u></u><u></u></li><li class="MsoNormal" style="margin-left:0cm">
Point to this file from /etc/apache2/sites-available/<wbr>geonode.conf by adding this line:<u></u><u></u></li></ol>
<p class="MsoNormal" style="text-indent:36.0pt">
SSLCertificateChainFile /etc/ssl/certs/geonode-chain.<wbr>crt<u></u><u></u></p>
<ol start="3" type="1">
<li class="MsoNormal" style="margin-left:0cm">
Add the root certificate to /usr/local/lib/python2.7/dist-<wbr>packages/httplib2/cacerts.txt<u></u><u></u></li><li class="MsoNormal" style="margin-left:0cm">
In local_settings.py, set OGC_SERVER default LOCATION to <a href="https://fully.qualified.domain.name/geoserver" target="_blank">
https://fully.qualified.<wbr>domain.name/geoserver</a><u></u><u></u></li></ol>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Words to this effect should probably be added to
<a href="http://docs.geonode.org/en/master/tutorials/advanced/geonode_production/ssl.html" target="_blank">
http://docs.geonode.org/en/<wbr>master/tutorials/advanced/<wbr>geonode_production/ssl.html</a><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I’ve added it to our own (tested) Ansible playbook at
<a href="https://github.com/UNSW-CFRC/geonode_install/tree/master/roles/install_ssl" target="_blank">
https://github.com/UNSW-CFRC/<wbr>geonode_install/tree/master/<wbr>roles/install_ssl</a><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Regards<u></u><u></u></p>
<p class="MsoNormal">Jonathan<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> geonode-devel [mailto:<a href="mailto:geonode-devel-bounces@lists.osgeo.org" target="_blank">geonode-devel-bounces@<wbr>lists.osgeo.org</a>]
<b>On Behalf Of </b>Jonathan Doig<br>
<b>Sent:</b> Wednesday, 10 May 2017 5:12 PM<br>
<b>To:</b> Cezary Statkiewicz <<a href="mailto:cezary.statkiewicz@geo-solutions.it" target="_blank">cezary.statkiewicz@geo-<wbr>solutions.it</a>>;
<a href="mailto:geonode-devel@lists.osgeo.org" target="_blank">geonode-devel@lists.osgeo.org</a></span><u></u><u></u></p>
<div>
<p class="MsoNormal"><br>
<b>Subject:</b> Re: [GeoNode-devel] SSL error on upload and saving metadata<u></u><u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">Thanks for your response Cezary.<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">We have created an alias to our actual host. I think the problem might be that while the python running these functions is using https, it is still calling the actual hostname rather than the alias. It fails to verify
the certificate because the hostname doesn't match the alias. So I’ve requested new certificates based on a config in which I’ve added the actual hostname to subjectAltName. I’ll let you know how it goes.<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">Curl output shows no problem with <my-alias>:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">curl -vvv <a href="https://%3cmy-alias%3e/geoserver/" target="_blank">
https://<my-alias>/geoserver/</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* Trying <my-host-IP>...<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* Connected to <my-alias> (<my-host-IP>) port 443 (#0)<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* found 173 certificates in /etc/ssl/certs/ca-<wbr>certificates.crt<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* found 697 certificates in /etc/ssl/certs<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* ALPN, offering http/1.1<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* server certificate verification OK<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* server certificate status verification SKIPPED<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* common name: <my-alias> (matched)<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* server certificate expiration date OK<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* server certificate activation date OK<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* certificate public key: RSA<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* certificate version: #3<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* subject: C=AU,ST=New South Wales,L=Kensington,O=<wbr>University of New South Wales,OU=City Futures Research Centre,CN=<my-alias><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* start date: Mon, 08 May 2017 01:05:25 GMT<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* expire date: Fri, 08 May 2020 01:05:21 GMT<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* issuer: C=BM,O=QuoVadis Limited,CN=QuoVadis Global SSL ICA G2<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* compression: NULL<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* ALPN, server accepted to use http/1.1<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">> GET /geoserver/ HTTP/1.1<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">> Host: <my-alias><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">> User-Agent: curl/7.47.0<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">> Accept: */*<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< HTTP/1.1 302 Found<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< Date: Tue, 09 May 2017 23:48:37 GMT<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< Server: Apache-Coyote/1.1<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< Location: /geoserver/index.html<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< Content-Length: 0<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< Set-Cookie: JSESSIONID=<wbr>5797370732D26CAD77DC9ABB69E89D<wbr>C7; Path=/geoserver/; HttpOnly<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">< <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* Connection #0 to host <my-alias> left intact<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">But it fails on <my-actual-host>:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">curl -vvv <a href="https://%3cmy-actual-host%3e/geoserver/" target="_blank">
https://<my-actual-host>/<wbr>geoserver/</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* Trying <my-host-ip>...<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* Connected to <my-actual-host> (<my-host-ip>) port 443 (#0)<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* found 173 certificates in /etc/ssl/certs/ca-<wbr>certificates.crt<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* found 697 certificates in /etc/ssl/certs<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* ALPN, offering http/1.1<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* server certificate verification OK<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* server certificate status verification SKIPPED<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* SSL: certificate subject name (<my-alias>) does not match target host name '<my-actual-host>'<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">* Closing connection 0<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext" style="margin-left:36.0pt">curl: (51) SSL: certificate subject name (<my-alias>) does not match target host name '<my-actual-host>'<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"><span lang="EN-US">-----Original Message-----<br>
From: geonode-devel [<a href="mailto:geonode-devel-bounces@lists.osgeo.org" target="_blank">mailto:geonode-devel-bounces@<wbr>lists.osgeo.org</a>] On Behalf Of Cezary Statkiewicz<br>
Sent: Tuesday, 9 May 2017 5:27 PM<br>
To: <a href="mailto:geonode-devel@lists.osgeo.org" target="_blank">geonode-devel@lists.osgeo.org</a><br>
Subject: Re: [GeoNode-devel] SSL error on upload and saving metadata</span><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">On Tuesday, May 9, 2017 8:27:50 AM CEST Jonathan Doig wrote:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Hi devs<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> I'm putting our Geonode 2.4 behind SSL to protect the passwords over
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> the net.<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Based on the<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> doco<<a href="http://docs.geonode.org/en/master/tutorials/advanced/geonode_prod" target="_blank">http://docs.geonode.org/<wbr>en/master/tutorials/advanced/<wbr>geonode_prod</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> uctio n/ssl.html> I've written two ansible scripts,
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> one<<a href="https://github.com/UNSW-CFRC/geonode_install/blob/master/install_g" target="_blank">https://github.com/UNSW-<wbr>CFRC/geonode_install/blob/<wbr>master/install_g</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> eonod e/10_generate_ssl_csr.yml> to generate the key and CSR, the
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> other<<a href="https://github.com/UNSW-CFRC/geonode_install/blob/master/install" target="_blank">https://github.com/UNSW-<wbr>CFRC/geonode_install/blob/<wbr>master/install</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> _ssl_ cert.yml> to install the certificate supplied by our university
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> IT. I included the step to add the certificate to httplib2/cacerts.txt
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> for python.<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> This works OK in general - the site itself shows as secure in Chrome.<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> However, I get errors when uploading a layer and saving metadata:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> SSLHandshakeError at /layers/geonode:test_<wbr>issue086a/metadata<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> (_ssl.c:590)<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">Could you run<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">curl -vvv <a href="https://your.private.geoserver/geoserver/" target="_blank">
<span style="color:windowtext;text-decoration:none">https://your.private.<wbr>geoserver/geoserver/</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">curl -vvv <a href="https://your.public.geoserver/geoserver/" target="_blank">
<span style="color:windowtext;text-decoration:none">https://your.public.geoserver/<wbr>geoserver/</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">and put outputs from those commands?<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Any thoughts?<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> This is similar but not identical to the issue reported last year by
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Antoine Rolland (below).<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Regards<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Jonathan<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Jun 06, 2016; 11:20pm [Antoine ROLLAND]
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <<a href="http://osgeo-org.1560.x6.nabble.com/template/NamlServlet.jtp?macro=us" target="_blank">http://osgeo-org.1560.x6.<wbr>nabble.com/template/<wbr>NamlServlet.jtp?macro=us</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> er_no<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> des&user=379386> Antoine<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> ROLLAND<<a href="http://osgeo-org.1560.x6.nabble.com/template/NamlServlet.jtp?m" target="_blank">http://osgeo-org.1560.<wbr>x6.nabble.com/template/<wbr>NamlServlet.jtp?m</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> acro= user_nodes&user=379386> SSL HandshakeError Hello everyone,<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> I'm using Geonode 2.4 stable version, and it's now running under SSL.
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> After this change, part of the website is still working well, but I
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> meet errors while editing metada (when I save), and also when I try to
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> upload a new layer. This is the error I meet :<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> SSLHandshakeError at /layers/geonode:communes/<wbr>metadata [Errno 1]
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> _ssl.c:510: error:140770FC:SSL routines:SSL23_GET_SERVER_<wbr>HELLO:unknown
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> protocol Request Method: POST Request URL:
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <a href="https://aware.cirad.fr/layers/geonode:communes/metadata" target="_blank">
<span style="color:windowtext;text-decoration:none">https://aware.cirad.fr/layers/<wbr>geonode:communes/metadata</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Django Version: 1.6.11<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Exception Type: SSLHandshakeError<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Exception Value:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> [Errno 1] _ssl.c:510: error:140770FC:SSL
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> routines:SSL23_GET_SERVER_<wbr>HELLO:unknown protocol Exception Location:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> /usr/lib/python2.7/dist-<wbr>packages/httplib2/__init__.py in connect, line
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> 1043 Python Executable: /usr/bin/python Python Version: 2.7.6 Python
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Path:<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> ['/usr/lib/python2.7',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/python2.7/plat-x86_<wbr>64-linux-gnu',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/python2.7/lib-tk',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/python2.7/lib-old',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/python2.7/lib-<wbr>dynload',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/local/lib/python2.7/<wbr>dist-packages',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/python2.7/dist-<wbr>packages',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/python2.7/dist-<wbr>packages/PILcompat',<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/usr/lib/pymodules/python2.7'<wbr>,<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> '/var/www']<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Server time: lun, 6 Jui 2016 09:09:43 -0400<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Also, it seems that the url of the website generated is wrong : a "/"
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> is missing between "websitename" and "uploaded/thumbs" (for instance).
<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> I suppose it is a consequence of the error i meet.<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Any help would be really appreciated<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Thanks<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> Antoine Rolland<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> ______________________________<wbr>_________________<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> geonode-devel mailing list<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> [hidden<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> email]<<a href="http://osgeo-org.1560.x6.nabble.com/user/SendEmail.jtp?type=nod" target="_blank">http://osgeo-org.1560.<wbr>x6.nabble.com/user/SendEmail.<wbr>jtp?type=nod</a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> e&nod e=5270129&i=0> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">> <a href="http://lists.osgeo.org/mailman/listinfo/geonode-devel" target="_blank">
<span style="color:windowtext;text-decoration:none">http://lists.osgeo.org/<wbr>mailman/listinfo/geonode-devel</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">--<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">Cezary Statkiewicz<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">mailto: <a href="mailto:cezio@thelirium.net" target="_blank">
<span style="color:windowtext;text-decoration:none">cezio@thelirium.net</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">xmpp: <a href="mailto:cezio@jabber.org" target="_blank">
<span style="color:windowtext;text-decoration:none">cezio@jabber.org</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">pgp: <a href="https://thelirium.net/cezio@thelirium.net.pub.key" target="_blank">
<span style="color:windowtext;text-decoration:none">https://thelirium.net/cezio@<wbr>thelirium.net.pub.key</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"> <u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">______________________________<wbr>_________________<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext">geonode-devel mailing list<u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"><a href="mailto:geonode-devel@lists.osgeo.org" target="_blank"><span style="color:windowtext;text-decoration:none">geonode-devel@lists.osgeo.org</span></a><u></u><u></u></p>
<p class="m_-8032661217188743616m4123148902878193719msoplaintext"><a href="https://lists.osgeo.org/mailman/listinfo/geonode-devel" target="_blank"><span style="color:windowtext;text-decoration:none">https://lists.osgeo.org/<wbr>mailman/listinfo/geonode-devel</span></a><u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>_________________<br>
geonode-devel mailing list<br>
<a href="mailto:geonode-devel@lists.osgeo.org" target="_blank">geonode-devel@lists.osgeo.org</a><br>
<a href="https://lists.osgeo.org/mailman/listinfo/geonode-devel" target="_blank">https://lists.osgeo.org/<wbr>mailman/listinfo/geonode-devel</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div></div></div>
</div>
<br>______________________________<wbr>_________________<br>
geonode-devel mailing list<br>
<a href="mailto:geonode-devel@lists.osgeo.org">geonode-devel@lists.osgeo.org</a><br>
<a href="https://lists.osgeo.org/mailman/listinfo/geonode-devel" rel="noreferrer" target="_blank">https://lists.osgeo.org/<wbr>mailman/listinfo/geonode-devel</a><br>
<br></blockquote></div><br></div>