Moving already existing Kaltura CE 6 install to ssl

papadakis_george · October 4, 2017, 11:01am

Good day to you all, i currently have and old Kaltura CE6 server with tons of videos running on http.
I have bought an ssl certificate for the server and i want to make the switch to SSL how it is possible and what is the most common and safe way to do it. My server is running on CENTOS 6.5.

jess · October 4, 2017, 2:35pm

Hello @papadakis_george

CE 6 is very old and is no longer officially supported [current stable version is 13.4.0]. That said, the Kaltura Server was always configured on top of Apache in it’s own VHost so the SSL configuration is the same as with any Apache VHost.

Find out which file contains the Kaltura Apache VHost config with:
# apachectl -t -DDUMP_VHOSTS

Then edit that file and add the needed SSL directives. You can look at https://github.com/kaltura/server/blob/Mercury-13.4.0/configurations/apache/kaltura.ssl.conf.template as reference.
Next, you’ll need to edit /opt/kaltura/app/configurations/local.ini and /opt/kaltura/app/configurations/admin.ini so that instead of http://$SERVICE_URL, https://$SERVICE_URL is used and reload your Apache.

I’m assuming here that you are running an all in one instances of Kaltura, as opposed to a clustered ENV. If running a cluster of CE nodes, you are better off using a load balancer and SSL offloading, i.e: LB is configured to accept HTTPs requests and then makes HTTP requests to the different nodes.
Any LB that’s capable of sticky sessions can be used for that, you can see some configuration templates for Apache mod proxy and HA Proxy here:

github.com

kaltura/platform-install-packages/blob/master/doc/rpm-cluster-deployment-instructions.md#apache-load-balancer

# Deploying Kaltura Clusters

Below are **RPM** based instructions for deploying Kaltura Clusters.    
Refer to the [All-In-One Kaltura Server Installation Guide](install-kaltura-redhat-based.md) for more notes about deploying Kaltura in RPM supported environments.    
Refer to the [Deploying Kaltura Clusters Using Chef](rpm-chef-cluster-deployment.md) for automated Chef based deployments.

### Before You Get Started Notes
* If you see a `#` at the beginning of a line, this line should be run as `root`.
* Please review the [frequently answered questions](kaltura-packages-faq.md) document for general help before posting to the forums or issue queue.
* All post-install scripts accept answers-file as parameter, this can used for silent-automatic installs.
* For a cluster install, it is very important to pass an [answer file](kaltura.template.ans) to each script because otherwise, the MySQL 'kaltura' passwd is autogenerated by the installer. This is fine for a standalone server but for a cluster, passwd must be the same on all. 
* [Kaltura Inc.](http://corp.kaltura.com) also provides commercial solutions and services including pro-active platform monitoring, applications, SLA, 24/7 support and professional services. If you're looking for a commercially supported video platform  with integrations to commercial encoders, streaming servers, eCDN, DRM and more - Start a [Free Trial of the Kaltura.com Hosted Platform](http://corp.kaltura.com/free-trial) or learn more about [Kaltura' Commercial OnPrem Edition™](http://corp.kaltura.com/Deployment-Options/Kaltura-On-Prem-Edition). For existing RPM based users, Kaltura offers commercial upgrade options.

### Instructions here are for a cluster with the following members:

* [Load Balancer](#apache-load-balancer)
* [NFS server](#the-nfs-server)
* [MySQL Database](#the-mysql-database)
* [Sphinx Indexing Nodes](#the-sphinx-indexing-server)
* [Front Nodes](#the-first-front-node)

This file has been truncated. show original

papadakis_george · October 10, 2017, 1:10pm

Hi I managed to set up sll correctly apache is working and setup the virtual host within my_kaltura.conf

The problem is that when I visit the KMC in https I get the dreaded application error like the one you get when sphinx is not running.

I did change all http:// to https:// in both local and admin.ini

Any clues

jess · October 10, 2017, 1:16pm

Hi @papadakis_george,

Start by checking for errors in /opt/kaltura/log/kaltura_api_v3.log, the Apache error log and /opt/kaltura/log/kaltura_prod.log
You can use grep with this pattern:
# grep -A 1 -B 1 --color “ERR:|PHP|trace|CRIT|[error]” /opt/kaltura/log/kaltura_api_v3.log /opt/kaltura/log/kaltura_prod.log /path/to/apache/error.log

In addition, open your browser’s dev tools and check for errors in the “Console” and “Network” tabs.

papadakis_george · October 10, 2017, 6:43pm

Hi and thx for your reply, i have managed to set it up now both htttp and https are served.

When using flash no issues but when we use iframe we get the following error cause the script is loaded in http

https://..gr/article/sport/1500045/***/’ was loaded over HTTPS, but requested an insecure script 'http://.****.gr/html5/html5lib/v1.7.0/load.php?
debug=false&lang=en&modules=jquery%2Cmediawiki%2CSpinner%7Cmw.MwEmbedSupport%7Cjquery.triggerQueueCallback%2CloadingSpinner&only=scripts&skin=kaltura-dark&version=20130918T130935Z’. This request has been blocked; the content must be served over HTTPS.