Accessing HTTPS services through VPN Connection

Issue

• Multiple security/certificate/host errors can occur when trying to access an internal HTTPS service through a SaaS/PaaS VPN connection.

Environment

• Liferay PaaS/SaaS client-to-site VPN connection.
• Set up port forwarding to a HTTPS service. (e.g. vpn:1000 → 10.10.10.10:443).

Resolution

• At this moment, the vpn host does not support https as it relies in port forwarding.
• Fundamentally, the infrastructure requires three elements to establish a VPN connection:
  
  1. VPN Server: Along with internal services. 
     • E.g., 111.112.113.XYZ:443 (Sample public IP).
  2. VPN Client (Cloud service): Connects to the VPN Server
     • E.g., vpn:1000 → 10.10.10.10:443 Port forwarding
  3. Liferay (Cloud service): Access the VPN service through the vpn:1000 host.
• Since Liferay has no visibility into the internal network or services of the VPN, all connections to VPN services will be made using the VPN host, which may lead to certificate errors
• This limitation will not be an issue in some cases, and the connection will be successfully established.
• However, allowing invalid SSL connections for this host on both client and server sides could help resolve this limitation.
  
  • For example, adding --insecure to curl will ignore the SSL certificate validation when checking the VPN server response:

  • curl --insecure https://vpn:1000

• If the connection issue persists, an HTTP service may be required.

Additional Information

• Connecting a VPN Server to Liferay Cloud 
• Before opening a ticket related to VPN on Liferay PaaS 
• Connecting the VPN