I've gotten this question several times so I figured it was time to blog about it. While I don't recommend this for a production environment, some customers have asked for instructions on how to disable SSL for Lotus Connections. This can be more convenient than using a self-signed certificate which may cause some annoying pop-ups.
Here's the simple procedure:
- Disable SSL in the config file
- Go to <WAS_ROOT>/profiles/AppSrv01/config/cells/<cellName>/LotusConnections-Config
- Save a copy of LotusConnections-Config.xml
- Open LotusConnections-Config.xml with your favorite text editor
- Set all the SSL_ENABLED flags to false
- Save and close the file
- Modify the login page to go over port 80 (HTTP) instead of 443 (HTTPS)
- Go to <WAS_ROOT>/profiles/AppSrv01/config/cells/<cellName>/applications/<featureEAR>/deployments/<featureName>/<featureWAR>/WEB-INF
- Save a copy of web.xml
- Open web.xml with your favorite text editor
- Look for the following section:
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
- Change the transport-guarantee from CONFIDENTIAL to NONE
- Save and close the file
That's it! Now, if you are wondering what <featureEAR>, <featureName>, and <featureWAR> mean, take a look at the table below.
Note: You are at your own risk here 
| FeatureEAR | Feature Name | FeatureWAR |
|---|---|---|
| Activities.ear | Activities | oawebui.war |
| Blogs.ear | Blogs | Blogs.war |
| Communities.ear | Communities | tango.web.ui.war |
| Dogear.ear | Dogear | dogear.webui.war |
| Homepage.ear | Homepage | dboard.war |
| Profiles.ear | Profiles | peoplepages.war |
Enjoy!
Does this definitely work for HomePage as well? I understood that SSL was almost impossible to remove from the HomePage feature...
ReplyDeleteWould be very glad to hear that this is not the case!
It should work fine for Home Page. HP only uses SSL for login by default, same as the rest of the Connections features.
ReplyDeleteHmm, that last comment was from me. I don't know why my OpenID provider doesn't identify me...
ReplyDeleteKeep in mind that any update to the service components will over write this change. Especially to the <featureEAR>, <featureName>, and <featureWAR> files.
ReplyDeleteI had to restart the Enterprise Application for this change to take effect.
ReplyDeleteHi Stuart,
ReplyDeleteYes, I tested this on my v2 deployment and it works like a charm!
@Mac, thanks for reminding me, yes this configuration may be overwritten when you upgrade to a later release.
@Luis, yes, I forgot to mention you had to restart the server for the changes to go into effect, thanks!!
I tested this in last week and work very well.
ReplyDeleteTks for information Luis.
FYI... home page search requires SSL to work, so if you have the Home page deployed, do NOT make the changes to the LotusConnections-config.xml file, only to the web.xml (maybe that's what Stuart was referring to).
ReplyDeleteI followed the described steps and restarted the server, but the log in pages such as those for Profiles and Dogear still go to the SSL version. I am using 2.0.1 with the latest fixes. Is this a new bug in 2.0.1 with the latest fixes ?
ReplyDeleteHi Michael,
ReplyDeleteMake sure you clear your browser's cache too just in case. Also, make sure that there are no redirects specified in the httpd.conf file (specially if you are migrating from v1).
Hope this helps.
Thanks for the config tips.
ReplyDeleteAnyone use this config to configure SSL offloading to a hardware SSL accelerator? Having problems with backend servers making calls to HTTP and the JS libraries not being able to redirect to HTTPS.
Most stuff works, but the JS that calls the forum topics in Communities is 404'ing because it's failing to redirect to HTTPS. Any ideas for a Connections n00b?
Hi Andrew,
ReplyDeleteI think you'll still want to enable SSL at the Connections level (i.e. leave the settings as-is in web.xml and LotusConnections-config.xml). This is important because this controls the URL redirection and how the URLs are generated.
I've never used an SSL hardware accelerator, but I think you'll enable SSL at that level (as opposed to the HTTP server...).
Hope this helps.
Thanks Luis, will give that a try.
ReplyDeleteWe've used SSL accelerators (Netscalers) a lot and tend to use them where we can configure SSL on the accelerator and leave everything else as plain text (less SSL handshakes, less resources on the app server, more performant, etc.)
Having SSL enabled on Connections was causing problems for the Netscalers when Connections redirected from HTTP to HTTPS at the backend. Will see if our infrastructure bods can do some Netscaler "voodoo" to make things work with the redirects.
Cheers,
Andrew.
FYI this description made it to the InfoCenter Lotus Connections InfoCenter: Disabling SSL
ReplyDeleteBut seems they forgot to put an entry in the toc (should be under LC25 -> Security -> Disable SSL)