How to use EPrints with HTTPS - Revision history

Drn@ecs.soton.ac.uk at 10:10, 30 September 2025

2025-09-30T10:10:53Z

← Older revision		Revision as of 10:10, 30 September 2025
Line 3:		Line 3:
	[[Category:Authentication]]		[[Category:Authentication]]

	'''This guide is intended for EPrints 3.3 or later,<br/> but the [[Simplified_HTTPS_Configuration \| Update]] may be more appropriate for ~~the~~ current version!'''		'''This guide is intended for EPrints 3.3 or later,<br/> but the [[Simplified_HTTPS_Configuration \| Update]] may be more appropriate for this current version!'''

	'''N.B.''' Setting up your Apache Web server is beyond the scope of this document. Please see your operating system documentation and the Apache documentation for assistance in setting up Apache in your environment.'''		'''N.B.''' Setting up your Apache Web server is beyond the scope of this document. Please see your operating system documentation and the Apache documentation for assistance in setting up Apache in your environment.'''

Th.lauke@arcor.de: linking/formatting improved

2019-08-06T13:31:00Z

linking/formatting improved

← Older revision		Revision as of 13:31, 6 August 2019
Line 3:		Line 3:
	[[Category:Authentication]]		[[Category:Authentication]]

	'''This guide is intended for EPrints 3.3 or later.'''		'''This guide is intended for EPrints 3.3 or later,<br/> but the [[Simplified_HTTPS_Configuration \| Update]] may be more appropriate for the current version!'''

	'''N.B.''' Setting up your Apache Web server is beyond the scope of this document. Please see your operating system documentation and the Apache documentation for assistance in setting up Apache in your environment.'''		'''N.B.''' Setting up your Apache Web server is beyond the scope of this document. Please see your operating system documentation and the Apache documentation for assistance in setting up Apache in your environment.'''


	== Configuration ==		== Configuration ==
Line 25:		Line 24:
	\|}		\|}

	To start setting up your existing archive to work under HTTPS, you must first edit <tt>EPRINTS_PATH/archives/REPOID/cfg/cfg.d/10_core.pl</tt>. Initially it will probably look something like the configuration directly below, which is the basic 10_core.pl configuration file after you have run <tt>EPRINTS_PATH/bin/epadmin create</tt> to ~~setup~~ your archive. Alternatively you could run <tt>/opt/eprints3/bin/epadmin config_core REPOID</tt> that will prompt you for the following information. It is suggested that you make a backup of the 10_core.pl file regardless before proceeding.		To start setting up your existing archive to work under HTTPS, you must first edit <code>EPRINTS_PATH/archives/REPOID/cfg/cfg.d/10_core.pl</code>. Initially it will probably look something like the configuration directly below, which is the basic <code>10_core.pl</code> configuration file after you have run <code>EPRINTS_PATH/bin/epadmin create</code> to set up your archive. Alternatively you could run <code>/opt/eprints3/bin/epadmin config_core REPOID</code> that will prompt you for the following information. It is suggested that you make a backup of the <code>10_core.pl</code> file regardless before proceeding.

	$c->{host} = 'YOUR-REPOSITORY-DOMAIN';		$c->{host} = 'YOUR-REPOSITORY-DOMAIN';
Line 34:		Line 33:
	$c->{http_root} = undef;		$c->{http_root} = undef;

	Update the file to define the secure host and modify ports as needed. If your Apache web server is not using the standard ports (80,443) you can adjust the <tt>port</tt> and <tt>secureport</tt> parameters in the config file accordingly.		Update the file to define the secure host and modify ports as needed. If your Apache web server is not using the standard ports (80,443) you can adjust the <code>port</code> and <code>secureport</code> parameters in the config file accordingly.

	$c->{host} = 'YOUR-REPOSITORY-DOMAIN';		$c->{host} = 'YOUR-REPOSITORY-DOMAIN';
Line 43:		Line 42:
	$c->{http_root} = undef;		$c->{http_root} = undef;

	Now, you need to create the directory <tt>EPRINTS_PATH/archives/REPOID/ssl/</tt> and then edit the file <tt>REPOID/ssl/securevhost.conf</tt>. This file should look something like below. If you are installing EPrints on Debian/Ubuntu based ~~systens~~ you will need to create a symlink <tt>logs</tt> in <tt>/etc/apache2/</tt> to point at <tt>/var/log/apache2/</tt>.		Now, you need to create the directory <code>EPRINTS_PATH/archives/REPOID/ssl/</code> and then edit the file <code>REPOID/ssl/securevhost.conf</code>. This file should look something like below. If you are installing EPrints on Debian/Ubuntu based systems you will need to create a symlink <code>logs</code> in <code>/etc/apache2/</code> to point at <code>/var/log/apache2/</code>.
	{{Securevhost.conf}}		{{Securevhost.conf}}

	It is advised that you keep the SSL key, certificate and chain files in the same directory as securevhost.conf, as this will make it easy if you need to migrate you EPrints repository to a new server in the future.		It is advised that you keep the SSL key, certificate and chain files in the same directory as <code>securevhost.conf</code>, as this will make it easy if you need to migrate you EPrints repository to a new server in the future.

	== Generate the Apache Configuration File for HTTPS ==		== Generate the Apache Configuration File for HTTPS ==
	Run <tt>EPRINTS_PATH/bin/generate_apacheconf --system --replace</tt> to generate the secure Apache configuration files. This will ~~setup~~ the repository configuration file located in the <tt>EPRINTS_PATH/cfg/apache_ssl/</tt> directory named <tt>REPOID.conf</tt>.		Run <code>EPRINTS_PATH/bin/generate_apacheconf --system --replace</code> to generate the secure Apache configuration files. This will set up the repository configuration file located in the <code>EPRINTS_PATH/cfg/apache_ssl/</code> directory named <code>REPOID.conf</code>.


	== Add the Main Apache Config File to SSL Config ==		== Add the Main Apache Config File to SSL Config ==
	Depending upon the version of EPrints you are running there are a couple files that may be involved. It is recommended to run <tt>EPRINTS_PATH/bin/generate_apacheconf --man</tt> or view the source of <tt>EPRINTS_PATH/bin/generate_apacheconf</tt> file to understand what file(s) need to be ~~setup~~. Apache will not yet have been ~~setup~~ to include <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt>.		Depending upon the version of EPrints you are running there are a couple files that may be involved. It is recommended to run <code>EPRINTS_PATH/bin/generate_apacheconf --man</code> or view the source of <code>EPRINTS_PATH/bin/generate_apacheconf</code> file to understand what file(s) need to be set up. Apache will not yet have been set up to include <code>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</code>.

	To include this, you will need to find the file that already includes <tt>cfg/apache.conf</tt>. (For Red Hat/Fedora/CentOS Linux you will need to look in <tt>/etc/httpd/</tt>. For Debian/Ubuntu Linux you will need to look in <tt>/etc/apache2/</tt>). Then add the following line ~~after~~		To include this, you will need to find the file that already includes <code>cfg/apache.conf</code>. (For Red Hat/Fedora/CentOS Linux you will need to look in <code>/etc/httpd/</code>. For Debian/Ubuntu Linux you will need to look in <code>/etc/apache2/</code>). Then add the following line afterwards

	Include EPRINTS_PATH/archives/*/ssl/securevhost.conf		Include EPRINTS_PATH/archives/*/ssl/securevhost.conf

	== Restart Apache to pick up the changes to the Apache configuration ==		== Restart Apache to pick up the changes to the Apache configuration ==
	Consult your operating system documentation on how to restart service processes but in general you need to run one of the following commands either as <tt>root</tt> or using <tt>sudo</tt>:		Consult your operating system documentation on how to restart service processes but in general you need to run one of the following commands either as <code>root</code> or using <code>sudo</code>:

	=== For Red Hat/Fedora/CentOS Linux ===		=== For Red Hat/Fedora/CentOS Linux ===
Line 66:		Line 65:

	=== For Debian/Ubuntu Linux ===		=== For Debian/Ubuntu Linux ===
	Before restarting Apache make sure <tt>mod_ssl</tt> is enabled:		Before restarting Apache make sure <code>mod_ssl</code> is enabled:
	a2enmod ssl		a2enmod ssl
	Then restart Apache:		Then restart Apache:
Line 72:		Line 71:

	== Confirmation ==		== Confirmation ==
	Open your web browser and access your repository via its URL, this should be done over HTTP. When you click to login you should notice that you will be redirected to an HTTPS connection. N.B. Any ~~tasks~~ that require you to be logged in will be redirected to an HTTPS connection otherwise an HTTP request will be used by default.		Open your web browser and access your repository via its URL, this should be done over HTTP. When you click to login you should notice that you will be redirected to an HTTPS connection.<br/>N.B. Any task that require you to be logged in will be redirected to an HTTPS connection otherwise an HTTP request will be used by default.

	== HTTPS Only ==		== HTTPS Only ==
	EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.		EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.

	It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP. This can be done by adding the following line to <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt> after the <tt>ServerName</tt> line and then restarting Apache again:		It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP. This can be done by adding the following line to <code>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</code> after the <code>ServerName</code> line and then restarting Apache again:

	Header set Strict-Transport-Security "max-age=15780000"		Header set Strict-Transport-Security "max-age=15780000"

Drn@ecs.soton.ac.uk at 01:08, 21 February 2018

2018-02-21T01:08:05Z

← Older revision		Revision as of 01:08, 21 February 2018
Line 77:		Line 77:
	EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.		EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.

	It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP. This can be done by adding the following line to <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt> after the <tt>ServerName<//tt> line and then restarting Apache again:		It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP. This can be done by adding the following line to <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt> after the <tt>ServerName</tt> line and then restarting Apache again:

	Header set Strict-Transport-Security "max-age=15780000"		Header set Strict-Transport-Security "max-age=15780000"

Drn@ecs.soton.ac.uk at 01:07, 21 February 2018

2018-02-21T01:07:40Z

← Older revision		Revision as of 01:07, 21 February 2018
Line 74:		Line 74:
	Open your web browser and access your repository via its URL, this should be done over HTTP. When you click to login you should notice that you will be redirected to an HTTPS connection. N.B. Any tasks that require you to be logged in will be redirected to an HTTPS connection otherwise an HTTP request will be used by default.		Open your web browser and access your repository via its URL, this should be done over HTTP. When you click to login you should notice that you will be redirected to an HTTPS connection. N.B. Any tasks that require you to be logged in will be redirected to an HTTPS connection otherwise an HTTP request will be used by default.

	== ~~Site-wide~~ HTTPS ==		== HTTPS Only ==
	EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.		EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.

Drn@ecs.soton.ac.uk at 01:06, 21 February 2018

2018-02-21T01:06:22Z

← Older revision		Revision as of 01:06, 21 February 2018
Line 72:		Line 72:

	== Confirmation ==		== Confirmation ==
	Open your web browser and access your repository via its URL, this should be done over HTTP. When you click to login you should notice that you will be redirected to an HTTPS connection. N.B. Any tasks that require you to be logged in will be redirected to an HTTPS connection otherwise an HTTP request will be used by default.		Open your web browser and access your repository via its URL, this should be done over HTTP. When you click to login you should notice that you will be redirected to an HTTPS connection. N.B. Any tasks that require you to be logged in will be redirected to an HTTPS connection otherwise an HTTP request will be used by default.

	EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no ~~real~~ need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.		== Site-wide HTTPS ==
			EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research. However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]]. HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request. Meaning you will never send any un-encrypted traffic to EPrints. It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.

	It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP. This can be done by adding the following line to <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt> after the <tt>ServerName<//tt> line and then restarting Apache again:		It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP. This can be done by adding the following line to <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt> after the <tt>ServerName<//tt> line and then restarting Apache again:

	Header set Strict-Transport-Security "max-age=15780000"		Header set Strict-Transport-Security "max-age=15780000"

Drn@ecs.soton.ac.uk at 00:53, 21 February 2018

2018-02-21T00:53:00Z

← Older revision		Revision as of 00:53, 21 February 2018
Line 53:		Line 53:

	== Add the Main Apache Config File to SSL Config ==		== Add the Main Apache Config File to SSL Config ==
	Depending upon the version of EPrints you are running there are a couple files that may be involved. It is recommended to run <tt>EPRINTS_PATH/bin/generate_apacheconf --man</tt> or view the source of <tt>EPRINTS_PATH/bin/generate_apacheconf</tt> file to understand what file(s) need to be setup. Apache will not yet have been setup to include <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt>. ~~To include this, you will need to find the file that already includes <tt>cfg/apache.conf</tt>.~~		Depending upon the version of EPrints you are running there are a couple files that may be involved. It is recommended to run <tt>EPRINTS_PATH/bin/generate_apacheconf --man</tt> or view the source of <tt>EPRINTS_PATH/bin/generate_apacheconf</tt> file to understand what file(s) need to be setup. Apache will not yet have been setup to include <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt>.

	~~===~~ For Red Hat/Fedora/CentOS Linux ~~===~~		To include this, you will need to find the file that already includes <tt>cfg/apache.conf</tt>. (For Red Hat/Fedora/CentOS Linux you will need to look in <tt>/etc/httpd/</tt>. For Debian/Ubuntu Linux you will need to look in <tt>/etc/apache2/</tt>). Then add the following line after
	cd /etc/httpd/
	~~grep -r "cfg~~/~~apache~~.conf" *

	~~Include EPRINTS_PATH/archives/*/ssl/securevhost.conf~~

	~~===~~ For Debian/Ubuntu Linux ~~===~~
	~~First make sure the SSL Apache module is enabled, by running the following (as root):~~
	~~/usr/sbin/a2enmod ssl~~

	~~Then doing the following~~ to ~~find~~ <tt>~~cfg~~/~~apache.conf~~</tt>.
	~~cd /etc/apache2/~~
	grep -r "cfg/apache.conf" *

	Include EPRINTS_PATH/archives/*/ssl/securevhost.conf		Include EPRINTS_PATH/archives/*/ssl/securevhost.conf
Line 78:		Line 66:

	=== For Debian/Ubuntu Linux ===		=== For Debian/Ubuntu Linux ===
			Before restarting Apache make sure <tt>mod_ssl</tt> is enabled:
			a2enmod ssl
			Then restart Apache:
	/etc/init.d/apache2 restart		/etc/init.d/apache2 restart

Drn@ecs.soton.ac.uk: Few tweaks to tidy things up.

2018-02-21T00:47:19Z

Few tweaks to tidy things up.

← Older revision		Revision as of 00:47, 21 February 2018
Line 53:		Line 53:

	== Add the Main Apache Config File to SSL Config ==		== Add the Main Apache Config File to SSL Config ==
	Depending upon the version of EPrints you are running there are a couple files that may be involved. It is recommended to run <tt>EPRINTS_PATH/bin/generate_apacheconf --man</tt> or view the source of <tt>EPRINTS_PATH/bin/generate_apacheconf</tt> file to understand what file(s) need to be setup. ~~In general you~~ will ~~need~~ to ~~place a line like either of the following inside your Apache SSL Virtual Host declaration (most likely found in~~ <tt>/~~etc~~/~~httpd~~/~~conf.d~~/~~mod_ssl~~.conf</tt> or <tt>/~~etc/httpd/conf.d/ssl~~.conf</tt>). ~~Make sure that these lines are placed inside the <VirtualHost> Apache directive~~.		Depending upon the version of EPrints you are running there are a couple files that may be involved. It is recommended to run <tt>EPRINTS_PATH/bin/generate_apacheconf --man</tt> or view the source of <tt>EPRINTS_PATH/bin/generate_apacheconf</tt> file to understand what file(s) need to be setup. Apache will not yet have been setup to include <tt>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</tt>. To include this, you will need to find the file that already includes <tt>cfg/apache.conf</tt>.

			=== For Red Hat/Fedora/CentOS Linux ===
			cd /etc/httpd/
			grep -r "cfg/apache.conf" *

	Include EPRINTS_PATH/archives/*/ssl/securevhost.conf		Include EPRINTS_PATH/archives/*/ssl/securevhost.conf

	~~=== For Red Hat/Fedora/CentOS Linux ===~~
	~~Add then add the appropriate Include line above, to the end of <tt>/etc/httpd/conf.d/ssl.conf</tt>~~

	=== For Debian/Ubuntu Linux ===		=== For Debian/Ubuntu Linux ===
	~~Make~~ sure the SSL Apache module is enabled, by running the following (as root):		First make sure the SSL Apache module is enabled, by running the following (as root):
	/usr/sbin/a2enmod ssl		/usr/sbin/a2enmod ssl
	~~Add then add the appropriate <tt>Include</tt> line above, just before the <tt></IfModule></tt> line in <tt>/etc/apache2/mods-enabled/ssl.conf</tt>~~
	~~Alternatively, if you already have either a file named <tt>eprints.conf</tt> or <tt>eprints</tt> in <tt>/etc/apache2/sites-enabled/</tt> this <tt>Include</tt> line can be added there instead.~~

			Then doing the following to find <tt>cfg/apache.conf</tt>.
			cd /etc/apache2/
			grep -r "cfg/apache.conf" *

			Include EPRINTS_PATH/archives/*/ssl/securevhost.conf

	== Restart Apache to pick up the changes to the Apache configuration ==		== Restart Apache to pick up the changes to the Apache configuration ==

Drn@ecs.soton.ac.uk at 00:28, 21 February 2018

2018-02-21T00:28:03Z

← Older revision		Revision as of 00:28, 21 February 2018
Line 44:		Line 44:

	Now, you need to create the directory <tt>EPRINTS_PATH/archives/REPOID/ssl/</tt> and then edit the file <tt>REPOID/ssl/securevhost.conf</tt>. This file should look something like below. If you are installing EPrints on Debian/Ubuntu based systens you will need to create a symlink <tt>logs</tt> in <tt>/etc/apache2/</tt> to point at <tt>/var/log/apache2/</tt>.		Now, you need to create the directory <tt>EPRINTS_PATH/archives/REPOID/ssl/</tt> and then edit the file <tt>REPOID/ssl/securevhost.conf</tt>. This file should look something like below. If you are installing EPrints on Debian/Ubuntu based systens you will need to create a symlink <tt>logs</tt> in <tt>/etc/apache2/</tt> to point at <tt>/var/log/apache2/</tt>.

	{{Securevhost.conf}}		{{Securevhost.conf}}

Line 50:		Line 49:

	== Generate the Apache Configuration File for HTTPS ==		== Generate the Apache Configuration File for HTTPS ==
	Run <tt>EPRINTS_PATH/bin/generate_apacheconf --system --replace</tt> to generate the secure Apache configuration files. Depending upon the version of EPrints you are using, it may copy the default template <tt>EPRINTS_PATH/archives/REPOID/cfg/lang/en/templates/default.xml</tt> to the template used for HTTPS <tt>EPRINTS_PATH/archives/REPOID/cfg/lang/en/templates/secure.xml</tt>. This will ~~also~~ setup the repository configuration file located in the <tt>EPRINTS_PATH/cfg/apache_ssl/</tt> directory named <tt>REPOID.conf</tt>.		Run <tt>EPRINTS_PATH/bin/generate_apacheconf --system --replace</tt> to generate the secure Apache configuration files. This will setup the repository configuration file located in the <tt>EPRINTS_PATH/cfg/apache_ssl/</tt> directory named <tt>REPOID.conf</tt>.

Drn@ecs.soton.ac.uk: couple more tweaks.

2018-02-21T00:25:39Z

couple more tweaks.

← Older revision		Revision as of 00:25, 21 February 2018
Line 25:		Line 25:
	\|}		\|}

	To start setting up your existing archive to work under HTTPS, you must first edit <tt>EPRINTS_PATH/archives/REPOID/cfg/cfg.d/10_core.pl</tt>. Initially it will probably look something like the configuration directly below, which is the basic 10_core.pl configuration file after you have run <tt>EPRINTS_PATH/bin/epadmin create</tt> to setup your archive. Alternatively you could run <tt>/opt/eprints3/bin/epadmin config_core ~~[repoid]~~</tt> that will prompt you for the following information. It is suggested that you make a backup of the 10_core.pl file regardless before proceeding.		To start setting up your existing archive to work under HTTPS, you must first edit <tt>EPRINTS_PATH/archives/REPOID/cfg/cfg.d/10_core.pl</tt>. Initially it will probably look something like the configuration directly below, which is the basic 10_core.pl configuration file after you have run <tt>EPRINTS_PATH/bin/epadmin create</tt> to setup your archive. Alternatively you could run <tt>/opt/eprints3/bin/epadmin config_core REPOID</tt> that will prompt you for the following information. It is suggested that you make a backup of the 10_core.pl file regardless before proceeding.

	$c->{host} = 'YOUR-REPOSITORY-DOMAIN';		$c->{host} = 'YOUR-REPOSITORY-DOMAIN';
Line 34:		Line 34:
	$c->{http_root} = undef;		$c->{http_root} = undef;

	Update the file to define the secure host and modify ports as needed. If your Apache web server is not using the standard ports (80,443) you can adjust the 'port' and 'secureport' parameters in the config file accordingly.		Update the file to define the secure host and modify ports as needed. If your Apache web server is not using the standard ports (80,443) you can adjust the <tt>port</tt> and <tt>secureport</tt> parameters in the config file accordingly.

	$c->{host} = 'YOUR-REPOSITORY-DOMAIN';		$c->{host} = 'YOUR-REPOSITORY-DOMAIN';
Line 50:		Line 50:

	== Generate the Apache Configuration File for HTTPS ==		== Generate the Apache Configuration File for HTTPS ==
	Run <tt>EPRINTS_PATH/bin/generate_apacheconf --system --replace</tt> to generate the secure Apache configuration files. Depending upon the version of EPrints you are using, it may copy the default template <tt>EPRINTS_PATH/archives/REPOID/cfg/lang/en/templates/default.xml</tt> to the template used for HTTPS <tt>~~/opt/eprints3~~/archives/~~[repoid]~~/cfg/lang/en/templates/secure.xml</tt>. This will also setup the repository configuration file located in the <tt>EPRINTS_PATH/cfg/apache_ssl/</tt> directory named <tt>REPOID.conf</tt>.		Run <tt>EPRINTS_PATH/bin/generate_apacheconf --system --replace</tt> to generate the secure Apache configuration files. Depending upon the version of EPrints you are using, it may copy the default template <tt>EPRINTS_PATH/archives/REPOID/cfg/lang/en/templates/default.xml</tt> to the template used for HTTPS <tt>EPRINTS_PATH/archives/REPOID/cfg/lang/en/templates/secure.xml</tt>. This will also setup the repository configuration file located in the <tt>EPRINTS_PATH/cfg/apache_ssl/</tt> directory named <tt>REPOID.conf</tt>.

Drn@ecs.soton.ac.uk: Updated instructions to use Template:Securevhost.conf

2018-02-21T00:10:11Z

Updated instructions to use Template:Securevhost.conf

Show changes