Apache + SSL

[Gunnar]

I want to run Etherpad with an Apache server as a proxy in between. Apache is needed because we want to use Kerberos authentication so only our users may access the website.
We also want to run Etherpad over HTTPS, but it won't work yet.

I can access the site, but changes in a pad don't arrive at the server. After a few seconds I get:

Disconnected.

Lost connection with the EtherPad synchronization server.


Here is my Apache configuration. Any advice? I'm not so very experienced with Apache yet, so I might be missing something obious.

<VirtualHost _default_:443>

ServerName etherpad.cs.uni-paderborn.de
ServerAlias etherpad.cs.upb.de
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/etherpad.cs.uni-paderborn.de.pem
SSLCertificateKeyFile /etc/apache2/ssl/etherpad.cs.uni-paderborn.de.key
SSLCertificateChainFile /etc/apache2/ssl/certchain.pem

<IfModule mod_proxy_http.c>

        ProxyRequests Off
        ProxyPass / http://localhost:9000/
        ProxyPassReverse / http://localhost:9000/
        ProxyPreserveHost on
        <Proxy http://localhost:9000/>
                Options FollowSymLinks MultiViews
                AllowOverride All
                Order Allow,Deny
                Allow from all
       
                AuthType Kerberos
                <authentication stuff>
        </Proxy>

</IfModule>
</VirtualHost>

[John McLear]

I have run etherpad behind mod_proxy a bunch of times and had no problems...  Are you getting anything in apache logs?  I assume everything works fine on port 9000?

[Gunnar]

Nothing useful in the logs. Port 9000 works perfectly fine as well as Port 80 using the Apache proxy. It's just https. 

It's probably a problem with the streaming engine. As far as I know, it runs under <somenumber>.comet.etherpad.etc, right? It might be, that those requests are blocked, since the certificate is only valid for etherpad.cs.upb/uni-paderborn.de 

I hacked around a bit and tried to exlude the streaming engine from SSL encryption but had no success yet.

[John McLear]

Are you using etherpad or etherpad lite?

[Gunnar]

I think it's just Etherpad.

Should I try Etherpad Lite?

[John McLear]

yep

[Gunnar]

Tried Etherpad Lite now and it worked like a charm... but we need definitely need at least password protected pads, if not teamsites as in Etherpad Legacy. I see that you can achieve this with the HTTP API. Is there anything out yet, that provides an easy to use webinterface without a big CMS around?

[John McLear]

https://github.com/Pita/etherpad-lite/issues/192 

http://paullockaby.com/projects/project/etherpad-user-interface