Lizmap-web-client: [Question] Does Lizmap web client can run with https url?

[Cec78]

Hi,

We would like to provide to the web users of our Lizmap maps a https url.
I was wondering if there is something to configure on Lizmap side.

Thank you in advance for your answers.

Céc.

[rldhont]

Yes of course: https://demo.lizmap.com/lizmap_3_0/

[Cec78]

Yes I saw this!
Is there any configuration to do on Lizmap side?

[rldhont]

The configuration has to be done server software side not Lizmap side.

[josemvm]

hi @Cec78

you can see here: https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04

i already tested and it works well
this issue solves the problem of geolocation in browsers that require https for this purpose, such as google chrome

[Cec78]

Fine, thank you very much for your these informations!
Have a good WE.

[aeduard]

Hi! I'm experimenting with lizmap. I currently have the following installation environment hosted on digitalocean: Ubuntu 16, Qgis server 2.18, PostgreSQL + PostGIS, PHP7, Lizmap 3.1 master. I did the installation procedure following Paul J. Shapley's blog, and the official documentations/tutorials. All went well until I decided to add geolocation, which needed secure protocol. I than followed the digitalocean's tutorial for self-signed certificate (exception for firewall, at this stage it's not active), than lizmap stopped working.
First nothing really worked, than I observed some difference in the default-ssl.conf compared to the 000-default.conf file previously used by default. The differences I synchronized were in the Directory part. Now I can access the lizmap default page, the admin functions are working. When I try to access my maps, including the demo map, there is a forever loading cycle, and "SERVICE NOT DISPONIBLE!" appears in the top frame.
Do you have any idea what is causing this error?

[rldhont]

Can you provide an URL for testing ?

[aeduard]

Yes, I gave anonymous access for demo map and one test map for limited time.
Link no longer available

[aeduard]

These are the error details form lizmap's error log, when I try to load a map.

2017-11-29 09:55:06 warning 2017-11-29 09:55:06 [2] file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed /var/www/lizmap-web-client-release_3_1/lizmap/modules/lizmap/classes/lizmapProxy.class.php 93

2017-11-29 09:55:06 warning 2017-11-29 09:55:06 [2] file_get_contents(): Failed to enable crypto /var/www/lizmap-web-client-release_3_1/lizmap/modules/lizmap/classes/lizmapProxy.class.php 93

2017-11-29 09:55:06 warning 2017-11-29 09:55:06 [2] file_get_contents(https://nonlocalhostip/cgi-bin/qgis_mapserv.fcgi?map=%2Fvar%2Fwww%2Flizmap%2Dweb%2Dclient%2Drelease%5F3%5F1%2Flizmap%2Finstall%2Fqgis%2Fmontpellier%2Eqgs&request=GetCapabilities&service=WMS&version=1%2E3%2E0): failed to open stream: operation failed /var/www/lizmap-web-client-release_3_1/lizmap/modules/lizmap/classes/lizmapProxy.class.php 93

2017-11-29 09:55:06 notice 2017-11-29 09:55:06 [8] Undefined variable: http_response_header /var/www/lizmap-web-client-release_3_1/lizmap/modules/lizmap/classes/lizmapProxy.class.php 97

2017-11-29 09:55:06 warning 2017-11-29 09:55:06 [2] Invalid argument supplied for foreach() /var/www/lizmap-web-client-release_3_1/lizmap/modules/lizmap/classes/lizmapProxy.class.php 97

[rldhont]

Firstly, why lizmap and QGIS Server are not on the same IP ? Can you use localhost for QGIS Server ?

[aeduard]

Lizmap and QGIS Server are on the same server, and should be on the same IP too. I modified WMS server URL from lizmap configuration to 127.0.0.1, so it is localhost. I think my problem is with the certificate. If I'm doing a get capabilities request with wget, it gives me an error that my certificates's common name (the IP address) doesn't match requested host (localhost).

[rldhont]

If the QGIS Server is on the same server, it will be better to use 127.0.0.1 or localhost without https

[aeduard]

Thanks for the reply. It looks I've managed to resolve the problem. The self-signed certificate created the issue, because it was checked also for localhost connections. Here are the steps to make the local computer/connections to trust the certificate:

sudo cp my.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Details can be found here: link

I'm removing the access details for my server.

[mdouchin]

If possible, you should use letsencrypt instead of self-signed certificates, since the modern browser show a big red warning for the latests.
Some help (in French) here https://www.grafikart.fr/formations/serveur-linux/nginx-ssl-letsencrypt

[aeduard]

I'm aware of the warning. At the moment it will remain with self-signed certificate, users are accessing the maps with invitations. Letsencrypt would be a better option, but I wasn't aware about the possibility.

[tethysgeco]

Hello,
we have a similar issue since we move from http to https.
We can access to lizmap default page but when we try to access maps, the statement "SERVICE NOT AVAILABLE!" appears in the top frame and maps are not loaded.
Error logs file is attached.
We have a *.pem as ssl certificate.

We tried the previous hints but it's not working.

Do you have any idea?
lizmap_https_errors_.txt

[pcav]

A local issues, IMHO