Configuring HTTPS Support for ALM - Configuring HTTPS Support for ALM - Previously, ALM supported HTTP protocol only. However, for enhanced security and data protection, ALM now supports HTTPS protocol as default behavior. This protocol encrypts communications between the client and the server. It is highly recommended to use HTTPS as the default protocol to ensure data privacy and integrity. This topic explains the steps to configure HTTPS in ALM hosted on Apache Tomcat. - Brainware - ALE Learnset Manager - Brainware/ALE-Learnset-Manager/25.1/ALE-Learnset-Manager-Installation-and-Upgrade-Guide/Configuring-HTTPS-Support-for-ALM - 25.1 - 25.1

Previously, ALM supported HTTP protocol only. However, for enhanced security and data protection, ALM now supports HTTPS protocol as default behavior. This protocol encrypts communications between the client and the server. It is highly recommended to use HTTPS as the default protocol to ensure data privacy and integrity. This topic explains the steps to configure HTTPS in ALM hosted on Apache Tomcat.

```bash
keytool -genkeypair -alias almssl -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore almcert.p12 -validity 365
- almssl: Alias for the certificate.
- almcert.p12: The name of the generated .p12 file.
- validity 365: Number of days the certificate will be valid for.

1. Locate the server.xml file. This file is usually located in the <TOMCAT_HOME>/conf/ directory.
2. Open the server.xml file in a text editor, and locate the <Connector> element for HTTP.
3. Add or modify the following HTTPS configuration:

   <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 -->
      <Connector 
         protocol="org.apache.coyote.http11.Http11NioProtocol"
         port="8443"
         maxThreads="150"
         SSLEnabled="true"
          scheme="https"
           secure="true">
         
         <SSLHostConfig>
            <Certificate certificateKeystoreFile="conf/almcert.p12"
                         certificateKeystoreType="PKCS12"
                        certificateKeystorePassword "your_keystore_password"
                        certificateKeyAlias="<Alias for the certificate>"
                         sslProtocol="TLS"
    />
         </SSLHostConfig>
      </Connector>
   
      - port: Set to `8443`, which is the default HTTPS port.
      - certificateKeystoreFile: The path to your .p12 certificate.
      - certificateKeystorePassword: The password you set when generating the certificate.
      - sslProtocol: This should be set to `TLS` (Transport Layer Security), the successor to SSL.
   

   Note: In SSLHostConfig, the "alias" which user had given while generating .p12 certificate should match the certificateKeyAlias in server.xml file. For example: If "alias" for the .p12 certificate is given as "almssl" , then certificateKeyAlias="almssl".
4. Save and close the server.xml file.
5. Ensure that the firewall is configured to allow traffic through port 8443.
6. Restart the Tomcat service for the changes to take effect. This can be done by executing the following command:

   ./bin/shutdown.bat
   ./bin/startup.bat
   

   Or, you can also start and stop the Tomcat service from Services.

7. Test HTTPS Access.
   1. Open a browser and navigate to the ALM instance using the HTTPS URL.
      https://<servername>8443/ALM
      Note: A security warning is displayed in case of a self-signed certificate. This can be bypassed for testing purposes. However, for production, you must use a certificate from a trusted CA.
   2. Confirm that ALM is now accessible over HTTPS.
8. (Optional) Redirect HTTP to HTTPS to ensure that all users access ALM through the secure HTTPS protocol. To configure a redirection from HTTP to HTTPS:
   1. Open the server.xml file.
   2. Add a redirection rule in the HTTP <Connector> element:

      <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
                    redirectPort="8443" />
         ```
      

      This will automatically redirect any HTTP traffic on port 8080 to HTTPS on port 8443.

      Note: If there are other applications (HTTP) hosted on 8080 port make sure those are running fine after the tomcat configuration change.