Re: [VuFind-General] SSL question

[Sweeney, M. J <msw...@al...>]

Hi Tod,
Thank you very much for clarifying that.  I plan on working with the university technology department to request the certificates, my concern was that when I ask them for assistance with setting up the security of the VuFind web server they would say no because the server can only support SSL.  Since the term SSL is used loosely to imply TLS on the vufind site, I can confidently let them know we have more options for security encryption.
Thanks again,
Mike

Michael Sweeney
Head of Library Systems
University Library, LI-B35A
University at Albany
1400 Washington Avenue
Albany, NY 12222
Phone: 518-442-3638
Fax: 518-442-3088
Email: msw...@al...<mailto:msw...@al...>
http://library.albany.edu/

From: Tod Olson [mailto:to...@uc...]
Sent: Tuesday, March 17, 2015 6:40 AM
To: Sweeney, Michael J
Cc: Tod Olson; vuf...@li...
Subject: Re: [VuFind-General] SSL question

Hi Mike,

HTTPS relies on SSL/TLS certificates (people sometimes speak loosely of SSL even when they technically mean TLS) and that is all set up at the web server level. So this is an Apache configuration issue, assuming you run on Linux. Getting the certificates installed will vary somewhat depending on the OS distribution and even version. Searching for something like:

  installing ssl certificate ubuntu

may point you in the right direction. Ubuntu has some good documentation up, as do some of the certificate signing agencies.

Also, you probably want to talk to whoever runs the your university’s Web site to see how they purchase certificates. Different universities have different arrangements, so you may not need to buy a cert or run self-signed. For example, if the institution is a member of the InCommon Federation, you can get certs by virtue of being a member. There is a process for requesting a cert. You university web people would know how this works, and may even be able help with the installation details.

Best,

-Tod

Tod Olson <to...@uc...<mailto:to...@uc...>>
Systems Librarian
University of Chicago Library

On Mar 17, 2015, at 5:00 AM, Sweeney, Michael J <msw...@al...<mailto:msw...@al...>> wrote:



I am new to VuFind, and I would like to offer VuFind via https​ and I've searched the vufind site but only find references to SSL, and TLS for LDAP.

I recently had to check and patch other servers for the SSLV3 Poodle Exploit, so I don't want to use SSL.  Can I provide a secure VuFind environment using another security protocol, like TLS?

Is there any additional documentation relating to the security of VuFind besides https://vufind.org/wiki/security​

Thanks for taking the time to read my question.

Mike


Michael Sweeney
Head of Library Systems
University Library, LI-208
University at Albany
1400 Washington Avenue
Albany, NY 12222
Phone: 518-442-3638
Fax: 518-442-3088
Email: msw...@al...<mailto:msw...@al...>
http://library.albany.edu/
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/_______________________________________________
VuFind-General mailing list
VuF...@li...<mailto:VuF...@li...>
https://lists.sourceforge.net/lists/listinfo/vufind-general