Openmeetings SSL構築

いまやGoogle Chromeがシェア７０％だという、
　Chromeはセキュリティが強く使いずらい、
　位置情報やカメラ、マイクをブラウザで使う場合ＳＳＬ化されたサーバーでないと認識させない仕様となってしまった！
FireFoxやPale Moon、Sea Monkeyはまだ認識するがそのうちChromeと同じようになるだろう、
nogiriya.comサーバーもSSL化しましたのでそれに伴いＷｅｂ会議でカメラやマイクも使うOpenmeetingsをSSL化してみました、
以下、備忘録として、Openmeetings v3.0.6。

Openmeetings SSL化は以下の２サイトを参考にしました。
　Using OpenMeetings with RTMPS and HTTPS
　http://www.refogar.com/plataformacacumen/apache_openmeetings/webapps/openmeetings/docs/RTMPSAndHTTPS.html
　https://openmeetings.apache.org/RTMPSAndHTTPS.html
上記サイト文を引用しています。

C:\WINDOWS\system32> cd\
C:\> cd red5
C:\red5> cd conf
C:\red5\conf> c:\Apache\bin\openssl pkcs12 -export -in red5.crt -inkey red5.key -out red5.p12 -name red5 -certfile root.crt -certfile intermediate.crt
Enter Export Password:
Verifying - Enter Export Password:
C:\red5\conf> cd\

C:\> keytool -importkeystore -srcstorepass 私のパスワード -srckeystore red5/conf/red5.p12 -srcstoretype PKCS12 -deststorepass 私のパスワード -destkeystore red5/conf/keystore.jks -alias red5
キーストアred5/conf/red5.p12をred5/conf/keystore.jksにインポートしています...

Warning:
JKSキーストアは独自の形式を使用しています。"keytool -importkeystore -srckeystore red5/conf/keystore.jks -destkeystore red5/conf/keystore.jks -deststoretype pkcs12"を使用する業界標準の形式であるPKCS12に移行することをお薦めします。
C:\> keytool -importkeystore -srckeystore red5/conf/keystore.jks -destkeystore red5/conf/keystore.jks -deststoretype pkcs12
ソース・キーストアのパスワードを入力してください:
別名red5のエントリのインポートに成功しました。
インポート・コマンドが完了しました: 1件のエントリのインポートが成功しました。0件のエントリのインポートが失敗したか取り消されました

Warning:
"red5/conf/keystore.jks"がNon JKS/JCEKSに移行されました。JKSキーストアは"red5/conf/keystore.jks.old"としてバックアップされます。

C:\> keytool -import -alias intermed -keystore red5/conf/keystore.jks -trustcacerts -file red5/conf/intermediate.crt
キーストアのパスワードを入力してください:
証明書は、別名<red5>のキーストアにすでに存在します
追加しますか。[いいえ]:  y
証明書がキーストアに追加されました
C:\> cd red5
C:\red5> cd conf
C:\red5\conf> c:\apache\bin/openssl pkcs12 -export -in red5.crt -inkey red5.key -out red5.p12 -name red5 -certfile ca.crt
Enter Export Password:
Verifying - Enter Export Password:

C:\red5\conf> keytool -importkeystore -srcstorepass 私のパスワード -srckeystore red5.p12 -srcstoretype PKCS12 -deststorepass 私のパスワード -destkeystore /red5/conf/keystore.jks -alias red5
キーストアred5.p12を/red5/conf/keystore.jksにインポートしています...
既存のエントリの別名red5が存在しています。上書きしますか。[いいえ]:  y

C:\red5\conf> keytool -import -alias root -keystore /red5/conf/keystore.jks -keypass 私のパスワード -trustcacerts -file ca.crt
キーストアのパスワードを入力してください:
証明書は、別名<red5>のキーストアにすでに存在します
追加しますか。[いいえ]:  y
証明書がキーストアに追加されました

C:\red5\conf> cp /red5/conf/keystore.jks /red5/conf/truststore.jks
C:\red5\conf>

Edit red5/webapps/openmeetings/public/config.xml and set <rtmpsslport>5443</rtmpsslport> , <useSSL>yes</useSSL> and <proxyType>none</proxyType>

nogiriya.comのconfig.xmlはこんな感じ、御参考まで。
ここから↓
<?xml version="1.0" encoding="UTF-8" ?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at
  
      http://www.apache.org/licenses/LICENSE-2.0
    	  
  Unless required by applicable law or agreed to in writing,
  software distributed under the License is distributed on an
  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, either express or implied.  See the License for the
  specific language governing permissions and limitations
  under the License.
  
-->
<config 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:noNamespaceSchemaLocation="config.xsd">

<!-- URL/IP to use for the Server for RTMP and RTMPT traffic.
    If this value is empty it will try to connect to the 
    domain-name the OpenMeetings-Client has been loading from
    
    Can be either and IP or a domain name. 
    For example: 
    <rtmphostlocal>192.168.254.182</rtmphostlocal>
    or
    <rtmphostlocal>mysubdomain.streaming.to</rtmphostlocal>
    -->
<rtmphostlocal>nogiriya.com</rtmphostlocal>

<!-- URL/IP to use for the Server for HTTP and HTTPS traffic.
    If this value is empty it will use the rtmphostlocal 
    variable (and in that way try to connect to the 
    domain-name the OpenMeetings-Client has been loading from)
    -->
<httphostlocal>nogiriya.com</httphostlocal>

<!--  
Port to use for the Server
To this port the default server lookup is done

You can find all this configuration in your red5-Config in: $RED5_HOME/conf/red5.properties
 -->
<rtmpport>1935</rtmpport>
<rtmpsslport>5443</rtmpsslport>

<!--
Wether it should try to connect to rtmps first or not
Valid values: yes / no

NOTE: The OSx and Linux Flash Player are NOT able to connect via rtmps
The support for Windows is experimental
 -->
<useSSL>yes</useSSL>

<!-- 
Port to use for the Server
This port is used to connect to the http-servlet
of the red5-servlet
 -->

<red5httpport>5443</red5httpport>

<!--
    The protocol to use for the http connections
    for example upload/download of files 
 -->
<protocol>https</protocol>

<!--
    The setting for the NetConnection
    default settings is "none"
    set to value "best" if you are trying to use rtmp over native SSL
    see: http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/NetConnection.html#proxyType
 -->
<proxyType>none</proxyType>
<!--  best を設定すると何故か証明書認証に失敗する  -->
	
<!--
    Name of the Application
    this is the Top-Icon Name of the Application
 -->    
<currentappname>Apache OpenMeetings</currentappname>    
    
<!-- 
    URL to the Home of the Application
    this is the URL which is used if you click on the Top-icon
-->    
<currentappnameurl>http://openmeetings.apache.org</currentappnameurl>        

<!--
    URL to Bugs/Support
    this is the URL which is used if you click on *report a bug*
 -->
<currentappnamebugurl>https://issues.apache.org/jira/browse/OPENMEETINGS</currentappnamebugurl>   
        
<!--
    Video-Settings
    
    Number that specifies the amount of sound required to activate the microphone 
	Acceptable values from 0 to 100.	
    this value is used in Audio_Streaming, at which the *activity-meter* will
    send a notification for all connected hosts of a conference
    the result of this notification is that you see the green-light highlighted if
    a remote user is speaking
 -->
<loudnessAcitviation>0</loudnessAcitviation>  
    
<!--
    OpenMeetings-Webapp Name
    This is the name of the WebApp the Client will try to connect
    in former versions (till 0.5 Beta7) the name was xmlcrm
    the same param kann be find in the webapp in the Red5-Webapp
    red5-web.properties
    web.xml
 -->
<webAppRootKey>openmeetings</webAppRootKey>  

<!--
    We need this additional ROOT-Key as we have to deploy the application 
    as Global Contex Root. 
    
    If the rtmpt issues is solved sothat several Webapps can use different RTMPT connection
    we might change this value again to its origin / webapp-context

 -->
<httpRootKey>/openmeetings/</httpRootKey>  
    
<!--
    Window-Effect Settings
    showWindowEffect-values:
    y = yes
    n = no
    showWindowEffectOpacity-values
    between 0 and 1
 -->
<showWindowEffect>n</showWindowEffect> 

<!--
    Show the recorder buttons in the Conference Rooms
    visible = yes
    hidden = no
 -->	
<showRecording>hidden</showRecording>

<!--
    
	To enable the modern whiteboard Panel you need to switch this to y
    old menu bar is not active any more
    
<showmodernWhiteBoard>y</showmodernWhiteBoard>    
 -->    
	
<!--
	First day in the Week used by the Calendar
	0 means Sunday
	1 means Monday
	this is the way how the calendar UI shows a week
-->
<firstdayinweek>0</firstdayinweek>	
    
    
<!--
    #############################################################################
    Audio and Video Settings
    Before you change settings here,
    you should first Play and learn how the Settings work in the Documentation:
    http://code.google.com/p/openmeetings/wiki/AudioVideoTestingApplication
    #############################################################################
 -->
 
<!-- Camera Settings for codecType

    codecType possible values:
    h263
    h264
    If you want to use red5sip, set value to "h264"
 -->
<codecType>h263</codecType>
 
<!-- Camera Settings for the FramesPerSecond
    
    fps:Number [optional] - The requested rate at which the camera should capture 
    data, in frames per second. The default value is 15.
 -->    
<framesPerSecond>30</framesPerSecond>
    
    
<!-- Camera Settings for the Bandwidth:
    
    bandwidth:Number [optional] - An integer that specifies the maximum amount 
    of bandwidth that the current outgoing video feed can use, in bytes per second. 
    To specify that Flash video can use as much bandwidth as needed to maintain 
    the value of frameQuality, pass 0 for bandwidth. The default value is 16384.
 -->
<!-- These are the settings for the Quality-Modus *normal*
    The Quality-Modus can be chosen in the Login-Box --> 
<bandwidthNeededNormal>16384</bandwidthNeededNormal>    
<!-- These are the settings for the Quality-Modus *best* -->    
<bandwidthNeededBest>0</bandwidthNeededBest>
    
    
<!-- Camera Settings for the Quality
    
    quality:Number [optional] - An integer that specifies the required level of 
    picture quality, as determined by the amount of compression being applied to 
    each video frame. Acceptable values range from 1 (lowest quality, maximum 
    compression) to 100 (highest quality, no compression). To specify that picture 
    quality can vary as needed to avoid exceeding bandwidth, pass 0 for quality. 
    The default value is 0.
 --> 
<!-- These are the settings for the Quality-Modus *normal* -->  
<camQualityNormal>85</camQualityNormal>     
<!-- These are the settings for the Quality-Modus *best* -->       
<camQualityBest>90</camQualityBest> 
    
    
<!-- Microphone Settings for the Rate:
    
    rate:Number - 
    The rate at which the microphone should capture sound, in kHz. 
    Acceptable values are 5, 8, 11, 22, and 44. 
    The default value is 8 kHz if your sound capture 
    device supports this value. Otherwise, the default value 
    is the next available capture level above 8 kHz that your sound 
    capture device supports, usually 11 kHz.
 -->
<!-- Microphone Settings Quality-Modus -->
<microphoneRateBest>22</microphoneRateBest>

<!-- AEC configuration value
Specifies the echo path length (in milliseconds). A longer echo path means better 
echo cancellation but also introduces longer delays and requires more processing power. 
The default value is 128; the only other possible value is 256.
To disable AEC please specify 0.
 -->
<echoPath>128</echoPath>

<!--
    Set "true" or "false" to enable/disable microphone echo suppression
 -->
<echoSuppression>true</echoSuppression>

<!--
    The Size of the Whiteboard
    The Whiteboard has scrollbars so you may increase the size without problems
 -->
<defaultWhiteboardWidth>2400</defaultWhiteboardWidth>  
<defaultWhiteboardHeight>1200</defaultWhiteboardHeight>  

<!-- Available Configurations -->

<availableCameraResolutions>
    <resolution type="4:3 (~6 KByte/sec)" width="40" height="30" isDefault="false" />
    <resolution type="4:3 (~12 KByte/sec)" width="80" height="60" isDefault="false" />
    <resolution type="4:3 (~20 KByte/sec)" width="120" height="90" isDefault="true" />
    <resolution type="QQVGA 4:3 (~36 KByte/sec)" width="160" height="120" isDefault="false" />
    <resolution type="4:3 (~40 KByte/sec)" width="240" height="180" isDefault="false" />
    <resolution type="HVGA 4:3 (~56 KByte/sec)" width="320" height="240" isDefault="false" />
    <resolution type="4:3  (~60 KByte/sec)" width="480" height="360" isDefault="false" />
    <resolution type="4:3 (~68 KByte/sec)" width="640" height="480" isDefault="false" />
    <resolution type="XGA 4:3" width="1024" height="768" isDefault="false" />
    <resolution type="16:9" width="256" height="150" isDefault="false" />
    <resolution type="WQVGA 9:5" width="432" height="240" isDefault="false" />
    <resolution type="pseudo 16:9" width="480" height="234" isDefault="false" />
    <resolution type="16:9" width="512" height="300" isDefault="false" />
    <resolution type="nHD 16:9" width="640" height="360" isDefault="false" />
    <resolution type="16:9" width="1024" height="600" isDefault="false" />
</availableCameraResolutions>
    
 
<!-- Module Configuration -->
<!-- #############################################
    Moderator Modules
 -->

<moderatorModuleUser>userModerate</moderatorModuleUser>

<moderatorModuleRoom>roomModerate</moderatorModuleRoom>


<!-- #############################################
    Conference Room
    
    Room Layout's: flexibleConferenceRoom,conferenceView
 -->

<conferenceRoomModule>flexibleConferenceRoom</conferenceRoomModule>

<!-- #############################################
    Event Room
    
    Room Layouts: flexibleRestrictedConferenceRoom,restrictedConferenceRoom
 -->
<restrictedRoomModule>restrictedConferenceRoom</restrictedRoomModule>

<!-- #############################################
    Interview Room
    
    Room Layouts: interviewConferenceRoom
 -->
<interviewRoomModule>interviewConferenceRoom</interviewRoomModule>
        
</config>
ここまで↑


In webapps/openmeetings/WEB-INF/conf/axis2.xml add (below the existing http transportReceiver (around line 225))
<transportReceiver name="https" class="org.apache.axis2.transport.http.AxisServletListener">
    <parameter name="port">443</parameter>
</transportReceiver>

nogiriya.comのaxis2.xmlはこんな感じ、御参考まで。
ここから↓
<!--


-->

<axisconfig name="AxisJava2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    <!-- ================================================= -->
    <!-- Deployers -->
    <!-- ================================================= -->

    <!-- ================================================= -->
    <!-- Message Receivers -->
    <!-- ================================================= -->

    <!-- ================================================= -->
    <!-- Message Formatter -->
    <!-- ================================================= -->

    <!-- ================================================= -->
    <!-- Message Builders -->
    <!-- ================================================= -->

    <!-- ================================================= -->
    <!-- Transport Ins -->
    <!-- ================================================= -->
    <transportReceiver name="https"
                       class="org.apache.axis2.transport.http.SimpleHTTPServer">
<!--        <parameter name="port">8080</parameter> -->
        <parameter name="port">443</parameter>

        <!-- Here is the complete list of supported parameters (see example settings further below):
            port: the port to listen on (default 6060)
            hostname:  if non-null, url prefix used in reply-to endpoint references                                 (default null)
            originServer:  value of http Server header in outgoing messages                                         (default "Simple-Server/1.1")
            requestTimeout:  value in millis of time that requests can wait for data                                (default 20000)
            requestTcpNoDelay:  true to maximize performance and minimize latency                                   (default true)
                                false to minimize bandwidth consumption by combining segments
            requestCoreThreadPoolSize:  number of threads available for request processing (unless queue fills up)  (default 25)
            requestMaxThreadPoolSize:  number of threads available for request processing if queue fills up         (default 150)
                                       note that default queue never fills up:  see HttpFactory
            threadKeepAliveTime:  time to keep threads in excess of core size alive while inactive                  (default 180)
                                  note that no such threads can exist with default unbounded request queue
            threadKeepAliveTimeUnit:  TimeUnit of value in threadKeepAliveTime (default SECONDS)                    (default SECONDS)
        -->
        <!-- <parameter name="hostname">http://www.myApp.com/ws</parameter> -->
        <!-- <parameter name="originServer">My-Server/1.1</parameter>           -->
        <!-- <parameter name="requestTimeout">10000</parameter>                   -->
        <!-- <parameter name="requestTcpNoDelay">false</parameter>                   -->
        <!-- <parameter name="requestCoreThreadPoolSize">50</parameter>                      -->
        <!-- <parameter name="requestMaxThreadPoolSize">100</parameter>                     -->
        <!-- <parameter name="threadKeepAliveTime">240000</parameter>                  -->
        <!-- <parameter name="threadKeepAliveTimeUnit">MILLISECONDS</parameter>            -->
    </transportReceiver>

    <!-- This is where you'd put custom transports.  See the transports project -->
    <!-- for more.  http://ws.apache.org/commons/transport                      -->

    <!-- ================================================= -->
    <!-- Transport Outs -->
    <!-- ================================================= -->


    <!-- ================================================= -->
    <!-- Global Modules  -->
    <!-- ================================================= -->


    <!-- ================================================= -->
    <!-- Clustering  -->
    <!-- ================================================= -->


    <!-- ================================================= -->
    <!-- Phases  -->
    <!-- ================================================= -->

</axisconfig>
ここまで↑


    Change passwords in /red5/conf/red5.properties

    rtmps.keystorepass=私のパスワード
    rtmps.truststorepass=私のパスワード
    jmx.keystorepass=私のパスワード

    Set up SSL according SSL for the web interface section.
    Set up RTMPS according Tunneling RTMPS or Native RTMPS sections.
    Restart OM service or whole OM server. Now OM server is ready to accept SSL-connections.

Steps for client machines

Windows specific steps are marked with (**)

    (**)Add the ca.crt certificate as trusted into the CA's list on all windows PC at the system level (certmgr.msc applet)
    Add the ca.crt certificate as trusted into Chrome/Firefox if it used
    Add the ca.crt certificate into ${JAVA_HOME}/lib/security/cacerts with keytool utility on a PC that organizes screensharing

    (**)
    For example, Java Version 8 Update 144 has been installed on Windows machine by default location path.
    Copy ca.crt to a folder : c:\ca.crt
    Start command line interface as administrator:
    runas /user:AdminAccount cmd.exe
    Enter admin password
    Enter to bin directory of java:
    cd "c:\Program Files\Java\jre1.8.0_144\bin"
    Import ca.crt into keystore:
    keytool -import -alias root -keypass ..\lib\security\cacerts -file c:\ca.crt
    Enter the password to keystore: changeit

SSL for the web interface

Please perform following steps if you want to use SSL for the web interface. This is mainly to secure the server against MITM attacks, additionally some other features like file uploads also use a plain HTTP connection if this is not done. The following instructions assume that you have already set up RTMPS successfully.

    Edit red5/conf/jee-container.xml file:
    Comment Tomcat without SSL enabled section
    UNComment Tomcat with SSL enabled section
    Restart red5 and try to connect to https://your.server:5443 - you should be redirected to the OpenMeetings app and all access should be via HTTPS and/or RTMPS (close port 5080 to be sure).

Set up RTMPS
Tunneling RTMPS

    HTTPS need to be enabled otherwise tunneling will not work (it can be set up using frontend nginx/apache as well)
    In Administration->Configuration set

    					flash.secure = true
    					flash.secure.proxy = none

    Restart red5 and try to connect - your connection should now be made via RTMPS (close port 1935 to be sure)

Native RTMPS

    Default RTMPS port is 8443, you can change it by editing red5/conf/red5.properties and change the port here: rtmps.port=8443
    Please set rtmps.keystorepass=password and rtmps.truststorepass=password (password = password you set on your new keystore(s))
    Additionally you need to set rtmps.screen.keystorepass=screenpassword (screenpassword = password you set on your keystore for screen-sharing application)

nogiriya.comのred5.propertiesはこんな感じ、御参考まで。
ここから↓
# Socket policy
policy.host=0.0.0.0
policy.port=843

# HTTP
http.host=0.0.0.0
http.port=5080
https.port=5443
http.URIEncoding=UTF-8
http.max_keep_alive_requests=-1
http.max_threads=20
http.acceptor_thread_count=10
http.processor_cache=20

# RTMP
rtmp.host=0.0.0.0
rtmp.port=1935
rtmp.io_threads=16
rtmp.send_buffer_size=65536
rtmp.receive_buffer_size=65536
rtmp.ping_interval=1000
rtmp.max_inactivity=60000
rtmp.max_handshake_time=5000
rtmp.tcp_nodelay=true
rtmp.tcp_keepalive=false
rtmp.default_server_bandwidth=10000000
rtmp.default_client_bandwidth=10000000
rtmp.client_bandwidth_limit_type=2
rtmp.bandwidth_detection=false
rtmp.encoder_base_tolerance=5000
rtmp.encoder_drop_live_future=false
# traffic optimization hinting. to disable set traffic class set to -1
# low delay + high throughput == 24 (0x18)
rtmp.traffic_class=-1
# requested maximum length of the queue of incoming connections
rtmp.backlog=32
# the interval (seconds) between each throughput calculation
rtmp.thoughput_calc_interval=15
# enable use of the default mina acceptor
rtmp.default_acceptor=true
# socket i/o pool sizes used when default acceptor is disabled
rtmp.initial_pool_size=0
rtmp.max_pool_size=2
rtmp.max_processor_pool_size=16
rtmp.executor_keepalive_time=60000
mina.logfilter.enable=false
# scheduler configs (per connection)
rtmp.scheduler.pool_size=2
# adjust this as needed if you get tasks rejected
rtmp.executor.queue_capacity=32
# maximum amount of time allotted to process a single rtmp message / packet in milliseconds
rtmp.max_handling_time=2000

# RTMPS
rtmps.host=0.0.0.0
rtmps.port=443
rtmps.ping_interval=5000
rtmps.max_inactivity=60000
rtmps.max_keep_alive_requests=-1
rtmps.max_threads=20
rtmps.acceptor_thread_count=2
rtmps.processor_cache=20
# RTMPS Key and Trust store parameters
rtmps.keystorepass=私のパスワード
rtmps.keystorefile=conf/keystore.jks
rtmps.truststorepass=私のパスワード
rtmps.truststorefile=conf/truststore.jks

# RTMPT
rtmpt.host=0.0.0.0
rtmpt.port=8088
rtmpt.ping_interval=5000
rtmpt.max_inactivity=60000
rtmpt.max_handshake_time=5000
rtmpt.max_keep_alive_requests=-1
rtmpt.max_threads=20
rtmpt.acceptor_thread_count=2
rtmpt.processor_cache=20
rtmpt.encoder_base_tolerance=5000
rtmpt.encoder_drop_live_future=true
# better setting for streaming media
rtmpt.target_reponse_size=32768
# best setting for small messages or shared objects
#rtmpt.target_reponse_size=8192
# max incoming messages to process at a time. the most that FP appears to send is 166
rtmpt.max_in_msg_process=166
# max time in millis that we will wait when offering data to the in or out queue
rtmpt.max_queue_offer_time=125
# max offer attempts
rtmpt.max_queue_offer_attempts=4

# Debug proxy (needs to be activated in red5-core.xml)
proxy.source_host=127.0.0.1
proxy.source_port=1936
proxy.destination_host=127.0.0.1
proxy.destination_port=1935

# JMX
jmx.rmi.host=localhost
## jmx.rmi.port=9999 このポートはNework Camera が使用なので9997 へ変更
jmx.rmi.port=9997
jmx.rmi.sport=9998
jmx.rmi.port.remoteobjects=
jmx.keystorepass=私のパスワード
jmx.mina.monitor.enable=false
jmx.mina.poll.interval=1000
jmx.registry.create=true
jmx.reuse.existing.server=true

# Server properties
# max events to send in a single update
so.max.events.per.update=64
so.scheduler.pool_size=4
keyframe.cache.entry.max=500
war.deploy.server.check.interval=600000
fileconsumer.delayed.write=true
fileconsumer.queue.size=21
subscriberstream.buffer.check.interval=5000
subscriberstream.underrun.trigger=100
broadcaststream.auto.record=false
ここまで↑


    Edit red5/conf/red5-core.xml file:
    UNComment RTMPS section
    In Administration->Configuration set

    					flash.secure = true
    					flash.secure.proxy = best

nogiriya.comのred5-core.xmlはこんな感じ、御参考まで。
ここから↓
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:lang="http://www.springframework.org/schema/lang"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd                            
	http://www.springframework.org/schema/lang http://www.springframework.org/schema/lang/spring-lang-3.1.xsd">

	<!-- DO NOT FORMAT THIS FILE IN ECLIPSE -->
	
	<bean id="customEditorConfigurer" class="org.springframework.beans.factory.config.CustomEditorConfigurer">
		<property name="customEditors">
			<map>
				<entry key="java.net.SocketAddress" value="org.apache.mina.integration.beans.InetSocketAddressEditor" />
			</map>
		</property>
	</bean>	
	
	<bean id="placeholderConfig" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
		<property name="location" value="classpath:/red5.properties" />
	</bean>
	
	<!-- RTMP -->
    <bean id="rtmpScheduler" scope="prototype" class="org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler">
        <property name="poolSize" value="${rtmp.scheduler.pool_size}" />  
	</bean>        
	        
	<bean id="messageExecutor" scope="prototype" class="org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor">  
        <property name="corePoolSize" value="1" />  
	    <property name="maxPoolSize" value="1" />  
	    <property name="queueCapacity" value="${rtmp.executor.queue_capacity}" /> 
	</bean>     
    
    <!-- RTMP connection manager --> 
    <bean id="rtmpConnManager" class="org.red5.server.net.rtmp.RTMPConnManager" />
    
    <bean id="rtmpCodecFactory" class="org.red5.server.net.rtmp.codec.RTMPMinaCodecFactory"/>
	    
	<!-- RTMP Handler -->
	<bean id="rtmpHandler" class="org.red5.server.net.rtmp.RTMPHandler">
		<property name="server" ref="red5.server" />
		<property name="statusObjectService" ref="statusObjectService" />
		<!-- Enable this if you want to allow global scope connections
		<property name="globalScopeConnectionAllowed" value="true" />
		-->
	</bean>
	
	<!-- RTMP Mina IO Handler -->
	<bean id="rtmpMinaIoHandler" class="org.red5.server.net.rtmp.RTMPMinaIoHandler">
		<property name="handler" ref="rtmpHandler" />
        <property name="codecFactory" ref="rtmpCodecFactory" />
	</bean>
	
	<!-- RTMP Mina Transport -->
	<bean id="rtmpTransport" class="org.red5.server.net.rtmp.RTMPMinaTransport" init-method="start" destroy-method="stop">
		<property name="ioHandler" ref="rtmpMinaIoHandler" />
        <property name="addresses">
            <list>
				<value>${rtmp.host}:${rtmp.port}</value>
                <!-- You can now add additional ports and ip addresses
				<value>${rtmp.host}:1936</value>
                 -->
            </list>
        </property>
		<property name="ioThreads" value="${rtmp.io_threads}" />
        <property name="sendBufferSize" value="${rtmp.send_buffer_size}" />
        <property name="receiveBufferSize" value="${rtmp.receive_buffer_size}" />		
        <property name="trafficClass" value="${rtmp.traffic_class}" />
        <property name="backlog" value="${rtmp.backlog}" />
        <property name="tcpNoDelay" value="${rtmp.tcp_nodelay}" />
		<property name="keepAlive" value="${rtmp.tcp_keepalive}" />
        <property name="thoughputCalcInterval" value="${rtmp.thoughput_calc_interval}" />
        <property name="enableDefaultAcceptor" value="${rtmp.default_acceptor}" />
        <!-- Pool settings are used when the default acceptor is disabled -->
        <property name="initialPoolSize" value="${rtmp.initial_pool_size}" />
        <property name="maxPoolSize" value="${rtmp.max_pool_size}" />
        <property name="maxProcessorPoolSize" value="${rtmp.max_processor_pool_size}" />
        <property name="executorKeepAliveTime" value="${rtmp.executor_keepalive_time}" />
		<!-- This is the interval at which the sessions are polled for stats. If mina monitoring is not enabled, polling will not occur. -->
		<property name="minaPollInterval" value="${jmx.mina.poll.interval}" />
		<property name="enableMinaMonitor" value="${jmx.mina.monitor.enable}" />
		<property name="enableMinaLogFilter" value="${mina.logfilter.enable}" />
	</bean>
	
	<!-- RTMP Mina Connection -->
	<bean id="rtmpMinaConnection" scope="prototype"	class="org.red5.server.net.rtmp.RTMPMinaConnection">
	    <!-- Executor for scheduled tasks -->
        <property name="scheduler" ref="rtmpScheduler" />
        <!-- Executor for incoming messages -->
        <property name="executor" ref="messageExecutor" />
		<!-- Ping clients every X ms. Set to 0 to disable ghost detection code. -->
		<property name="pingInterval" value="${rtmp.ping_interval}" />
		<!-- Disconnect client after X ms of not responding. -->
		<property name="maxInactivity" value="${rtmp.max_inactivity}" />
		<!-- Max. time in milliseconds to wait for a valid handshake. -->
		<property name="maxHandshakeTimeout" value="${rtmp.max_handshake_time}" />
        <!-- Default server bandwidth per connection -->
        <property name="defaultServerBandwidth" value="${rtmp.default_server_bandwidth}" />
        <!-- Default client bandwidth per connection -->
        <property name="defaultClientBandwidth" value="${rtmp.default_client_bandwidth}" />
        <!-- Client bandwidth limit type: 0 = hard, 1 = soft, 2 = dynamic -->
        <property name="limitType" value="${rtmp.client_bandwidth_limit_type}" />
        <!-- Bandwidth detection. If "false" the server will NOT initiate a check -->
        <property name="bandwidthDetection" value="${rtmp.bandwidth_detection}" />
        <!-- Maximum time allowed for a single RTMP packet to be processed -->
        <property name="maxHandlingTimeout" value="${rtmp.max_handling_time}" />        
	</bean>
	
	<!-- RTMPT -->
	
	<!-- RTMPT Handler -->
	<bean id="rtmptHandler" class="org.red5.server.net.rtmpt.RTMPTHandler" autowire="byType">
		<property name="codecFactory" ref="rtmptCodecFactory" />
	</bean>
	
	<!-- Use injection to store RTMPT handler in servlet -->
	<bean id="rtmptServlet"	class="org.red5.server.net.rtmpt.RTMPTServlet">
        <property name="manager" ref="rtmpConnManager" />
		<property name="handler" ref="rtmptHandler" />
		<!-- Increasing this value results in better stream performance, but also increases the latency -->
		<property name="targetResponseSize" value="${rtmpt.target_reponse_size}" />
		<!-- Response for /fcs/ident2 requests -->
		<!--
		<property name="ident2" value="127.0.0.1" />
		-->
	</bean>
	
	<!-- RTMPT Connection -->
	<bean id="rtmptConnection" scope="prototype" class="org.red5.server.net.rtmpt.RTMPTConnection">
        <!-- Executor for scheduled tasks -->
        <property name="scheduler" ref="rtmpScheduler" />
        <!-- Executor for incoming messages -->
        <property name="executor" ref="messageExecutor" /> 
		<!-- Ping clients every X ms. Set to 0 to disable ghost detection code. -->
		<property name="pingInterval" value="${rtmpt.ping_interval}" />
		<!-- Disconnect client after X ms of not responding. -->
		<property name="maxInactivity" value="${rtmpt.max_inactivity}" />
		<!-- Max. time in milliseconds to wait for a valid handshake. -->
		<property name="maxHandshakeTimeout" value="${rtmpt.max_handshake_time}" />
		<!-- Maximum incoming messages to process at a time per client -->
		<property name="maxInMessagesPerProcess" value="${rtmpt.max_in_msg_process}" />
		<!-- Maximum amount of time in milliseconds to wait before allowing an offer to fail on incoming or outgoing queues -->
		<property name="maxQueueOfferTime" value="${rtmpt.max_queue_offer_time}" />
		<!-- Maximum offer attempts before failing on incoming or outgoing queues -->
		<property name="maxQueueOfferAttempts" value="${rtmpt.max_queue_offer_attempts}" />
	</bean>
		
   <!-- RTMPS -->
    <bean id="rtmpsMinaIoHandler" class="org.red5.server.net.rtmps.RTMPSMinaIoHandler">
        <property name="handler" ref="rtmpHandler" />
        <property name="codecFactory" ref="rtmpCodecFactory" />
        <property name="keystorePassword" value="${rtmps.keystorepass}" />
        <property name="keystoreFile" value="${rtmps.keystorefile}" />
        <property name="truststorePassword" value="${rtmps.truststorepass}" />
        <property name="truststoreFile" value="${rtmps.truststorefile}" />
    </bean>
    
    <bean id="rtmpsTransport" class="org.red5.server.net.rtmp.RTMPMinaTransport" init-method="start" destroy-method="stop">
        <property name="ioHandler" ref="rtmpsMinaIoHandler" />
		<property name="addresses">
		    <list>
		         <value>${rtmps.host}:${rtmps.port}</value>
		    </list>
		</property>
        <property name="ioThreads" value="${rtmp.io_threads}" />
        <property name="tcpNoDelay" value="${rtmp.tcp_nodelay}" />
    </bean>

   <!-- Enable when you need it -->
<!--   
        <bean id="rtmpProxyTransport" class="org.red5.server.net.rtmp.RTMPMinaTransport" init-method="start" destroy-method="stop">
                <property name="ioHandler" ref="debugProxyIoHandler" />
                <property name="address" value="${proxy.source_host}" />
                <property name="port" value="${proxy.source_port}" />
                <property name="ioThreads" value="${rtmp.io_threads}" />
                <property name="tcpNoDelay" value="${rtmp.tcp_nodelay}" />
        </bean>
    
        <bean id="debugProxyIoHandler"
                class="org.red5.server.net.proxy.DebugProxyHandler">
                <property name="codecFactory" ref="rtmpCodecFactory" />
                <property name="forward" value="${proxy.destination_host}:${proxy.destination_port}" />
                <property name="dumpTo" value="./webapps/dump/" />
        </bean>
-->

</beans>
ここまで↑


C:\Program Files\Java\jdk\bin>keytool -import -alias root -keypass ../lib/security/cacerts -file c:/red5/conf/ca.crt
キーストアのパスワードを入力してください:
新規パスワードを再入力してください:

所有者: OU=Apache xxxxx Distribution Test Certificate, O=Apache xxxxx Distribution Test Certificate, ST=Some-State, C=DE
発行者: OU=Apache xxxxx Distribution Test Certificate, O=Apache xxxxx Distribution Test Certificate, ST=Some-State, C=DE
シリアル番号: abxxxxxxxxxxxx91
有効期間の開始日: Fri Apr 06 09:21:34 JST 2012 終了日: Sat Apr 04 09:21:34 JST 2020
証明書のフィンガプリント:
         MD5:  0B:C1:xx:19:xx:E6:xx:4E:xx:71:xx:B6:xx:0E:xx:CE
         SHA1: 55:xx:B1:xx:8A:xx:9D:xx:CA:xx:82:xx:88:xx:F3:xx:AC:xx:21:3A
         SHA256: 22:63:xx:D4:41:xx:E4:93:xx:8E:EE:xx:0D:2F:xx:7A:EB:xx:6C:9C:xx:EE:60:xx:E7:BB:xx:24:23:xx:47:EE
署名アルゴリズム名: SHA1withRSA
サブジェクト公開鍵アルゴリズム: 1024ビットRSA鍵
バージョン: 1
この証明書を信頼しますか。 [いいえ]:  y
証明書がキーストアに追加されました

C:\Program Files\Java\jdk\bin>

    Restart red5 and try to connect - your connection should now be made via RTMPS (close port 1935 to be sure)

ちなみに
Windows 10 でのポート解放とブロックの設定。

コントロールパネル
↓
セキュリティとメンテナンス　　「セキュリティ」をクリック→ネットワーク　ファイアウォール→「Windows セキュリティの表示」をクリック
↓
ファイアウォールとネットワーク保護→「詳細設定」をクリック
　Womdows 7ではWindows ファイアウォール→
↓
「受信の規則」および「送信の規則」をクリック→右側の「新しい規則」をクリック
↓
規則の種類が出るので適宜ポート開放かブロックかを設定する、OpenmeetingsのSSL化ではポート 5080と1935をブロックすること
↓
ＯＫ


Setting up different set of allowed cithers
In case you would like to specify different set of allowed cithers you need to

    Open conf/jee-container.xml using your favorite text editor
    Go to "Tomcat with SSL enabled" -> "tomcat.server" -> "connectors" -> "httpsConnector" -> "connectionProperties"
    Add following entry
    <entry key="ciphers" value="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_ECDHE_RSA_WITH_AES_256_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,TLS_ECDHE_RSA_WITH_AES_256_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_256_SHA256,TLS_DHE_DSS_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_256_SHA" />

nogiriya.comのjee-container.xmlはこんな感じ、御参考まで。
ここから↓
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:lang="http://www.springframework.org/schema/lang"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                           http://www.springframework.org/schema/lang http://www.springframework.org/schema/lang/spring-lang-3.1.xsd">

    <!-- 
    The tomcat connectors may be blocking or non-blocking. Select between either option via the protocol property.
        Blocking I/O:
            <property name="protocol" value="org.apache.coyote.http11.Http11Protocol" />
        Non-blocking I/O:
            <property name="protocol" value="org.apache.coyote.http11.Http11NioProtocol" />  
     -->                           
    
    <!-- Tomcat without SSL enabled -->   
<!--
    <bean id="tomcat.server" class="org.red5.server.tomcat.TomcatLoader" depends-on="context.loader" init-method="start" lazy-init="true">

        <property name="webappFolder" value="${red5.root}/webapps" />
        
        <property name="connectors">
            <list>
                <bean name="httpConnector" class="org.red5.server.tomcat.TomcatConnector">
					<property name="protocol" value="org.apache.coyote.http11.Http11NioProtocol" />
					<property name="address" value="${http.host}:${http.port}" />
                    <property name="redirectPort" value="${https.port}" />  
                </bean>     
            </list>
        </property>
        
        <property name="baseHost">
           <bean class="org.apache.catalina.core.StandardHost">
               <property name="name" value="${http.host}" />
           </bean>     
        </property>     

        <property name="valves">
            <list>
                <bean id="valve.access" class="org.apache.catalina.valves.AccessLogValve">
                    <property name="directory" value="log" />
                    <property name="prefix" value="${http.host}_access." />
                    <property name="suffix" value=".log" />
                    <property name="pattern" value="common" />
                    <property name="resolveHosts" value="false" />
                    <property name="rotatable" value="true" />
                </bean>
            </list>
        </property>
    </bean>
-->
 
    <!-- Tomcat with SSL enabled -->

    <bean id="tomcat.server" class="org.red5.server.tomcat.TomcatLoader" depends-on="context.loader" init-method="start" lazy-init="true">

        <property name="webappFolder" value="${red5.root}/webapps" />
        
        <property name="connectors">
            <list>
                <bean name="httpConnector" class="org.red5.server.tomcat.TomcatConnector">
                    <property name="protocol" value="org.apache.coyote.http11.Http11NioProtocol" />
                    <property name="address" value="${http.host}:${http.port}" />
                    <property name="redirectPort" value="${https.port}" />  
                </bean>
                <bean name="httpsConnector" class="org.red5.server.tomcat.TomcatConnector">
                    <property name="secure" value="true" />
                    <property name="protocol" value="org.apache.coyote.http11.Http11NioProtocol" />
                    <property name="address" value="${http.host}:${https.port}" />
                    <property name="redirectPort" value="${http.port}" />  
                    <property name="connectionProperties">
                        <map>           
                            <entry key="port" value="${https.port}" />
                            <entry key="redirectPort" value="${http.port}" />
                            <entry key="SSLEnabled" value="true" />
                            <entry key="sslProtocol" value="TLS" />
                            <entry key="keystoreFile" value="${rtmps.keystorefile}" />
                            <entry key="keystorePass" value="${rtmps.keystorepass}" />
                            <entry key="keystoreType" value="JKS" />
                            <entry key="truststoreFile" value="${rtmps.truststorefile}" />
                            <entry key="truststorePass" value="${rtmps.truststorepass}" />
                            <entry key="clientAuth" value="false" />                             
                            <entry key="allowUnsafeLegacyRenegotiation" value="true" />                             
                            <entry key="maxKeepAliveRequests" value="${http.max_keep_alive_requests}"/>
                            <entry key="useExecutor" value="true"/>
                            <entry key="maxThreads" value="${http.max_threads}"/>
                            <entry key="acceptorThreadCount" value="${http.acceptor_thread_count}"/>
                            <entry key="processorCache" value="${http.processor_cache}"/>
                            <entry key="ciphers" value="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_ECDHE_RSA_WITH_AES_256_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,TLS_ECDHE_RSA_WITH_AES_256_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_256_SHA256,TLS_DHE_DSS_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_256_SHA" />
                        </map>
                    </property> 
                </bean>             
            </list>
        </property>
                        
        <property name="baseHost">
            <bean class="org.apache.catalina.core.StandardHost">
                <property name="name" value="${http.host}" />
            </bean>     
        </property>
    </bean>


    <!-- This entry enabled websocket support on port 8081 at localhost -->
    <bean id="webSocketTransport" class="org.red5.net.websocket.WebSocketTransport">
        <property name="addresses">
            <list>
                <value>localhost:8081</value>
            </list>
        </property>
    </bean>

</beans>
ここまで↑


Please check this JIRA issue for more information
Credits

Thanks to Nexus, Holger Rabbach and Yakovlev Nick for their help and contribution to configuration and documentation!


なお、nogiriya.comサーバーはApache v2.4.37でOpenSSL v1.1.1aを使用しています、
ＳＳＬ化は多くのサイト様が構築ページをアップされてますのでそちらを参考にしてください。

ちなみにnogiriya.comのApache\conf\httpd.conf は以下の通り。
#
Define SRVROOT "/Apache"
ServerRoot "${SRVROOT}"
Define ENABLE_TLS13 "Yes"
Listen 80

#LoadModule access_compat_module modules/mod_access_compat.so 
LoadModule actions_module modules/mod_actions.so
LoadModule alias_module modules/mod_alias.so
LoadModule allowmethods_module modules/mod_allowmethods.so
LoadModule asis_module modules/mod_asis.so
LoadModule auth_basic_module modules/mod_auth_basic.so
#LoadModule auth_digest_module modules/mod_auth_digest.so
#LoadModule auth_form_module modules/mod_auth_form.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_core_module modules/mod_authn_core.so
#LoadModule authn_dbd_module modules/mod_authn_dbd.so
#LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_file_module modules/mod_authn_file.so
#LoadModule authn_socache_module modules/mod_authn_socache.so
#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule authz_core_module modules/mod_authz_core.so
#LoadModule authz_dbd_module modules/mod_authz_dbd.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_host_module modules/mod_authz_host.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_user_module modules/mod_authz_user.so
#LoadModule autoindex_module modules/mod_autoindex.so
#LoadModule buffer_module modules/mod_buffer.so
#LoadModule cache_module modules/mod_cache.so
#LoadModule cache_disk_module modules/mod_cache_disk.so
#LoadModule cache_socache_module modules/mod_cache_socache.so
#LoadModule cern_meta_module modules/mod_cern_meta.so
LoadModule cgi_module modules/mod_cgi.so
#LoadModule charset_lite_module modules/mod_charset_lite.so
#LoadModule data_module modules/mod_data.so
#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
#LoadModule dav_lock_module modules/mod_dav_lock.so
#LoadModule dbd_module modules/mod_dbd.so
#LoadModule deflate_module modules/mod_deflate.so
LoadModule dir_module modules/mod_dir.so
#LoadModule dumpio_module modules/mod_dumpio.so
LoadModule env_module modules/mod_env.so
#LoadModule expires_module modules/mod_expires.so
#LoadModule ext_filter_module modules/mod_ext_filter.so
#LoadModule file_cache_module modules/mod_file_cache.so
#LoadModule filter_module modules/mod_filter.so
#LoadModule headers_module modules/mod_headers.so
#LoadModule heartbeat_module modules/mod_heartbeat.so
#LoadModule heartmonitor_module modules/mod_heartmonitor.so
#LoadModule http2_module modules/mod_http2.so
#LoadModule ident_module modules/mod_ident.so
#LoadModule imagemap_module modules/mod_imagemap.so
LoadModule include_module modules/mod_include.so
LoadModule info_module modules/mod_info.so
LoadModule isapi_module modules/mod_isapi.so
#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
#LoadModule ldap_module modules/mod_ldap.so
#LoadModule logio_module modules/mod_logio.so
LoadModule log_config_module modules/mod_log_config.so
#LoadModule log_debug_module modules/mod_log_debug.so
#LoadModule log_forensic_module modules/mod_log_forensic.so
#LoadModule lua_module modules/mod_lua.so
#LoadModule macro_module modules/mod_macro.so 
#LoadModule md_module modules/mod_md.so
LoadModule mime_module modules/mod_mime.so
#LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule proxy_module modules/mod_proxy.so
#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
#LoadModule proxy_express_module modules/mod_proxy_express.so
#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
#LoadModule proxy_html_module modules/mod_proxy_html.so
LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_http2_module modules/mod_proxy_http2.so
#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
#LoadModule ratelimit_module modules/mod_ratelimit.so
#LoadModule reflector_module modules/mod_reflector.so
#LoadModule remoteip_module modules/mod_remoteip.so
#LoadModule request_module modules/mod_request.so
#LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule rewrite_module modules/mod_rewrite.so
#LoadModule sed_module modules/mod_sed.so
#LoadModule session_module modules/mod_session.so
#LoadModule session_cookie_module modules/mod_session_cookie.so
#LoadModule session_crypto_module modules/mod_session_crypto.so
#LoadModule session_dbd_module modules/mod_session_dbd.so
LoadModule setenvif_module modules/mod_setenvif.so
#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
#LoadModule socache_dbm_module modules/mod_socache_dbm.so
#LoadModule socache_memcache_module modules/mod_socache_memcache.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
#LoadModule speling_module modules/mod_speling.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule status_module modules/mod_status.so
#LoadModule substitute_module modules/mod_substitute.so
#LoadModule unique_id_module modules/mod_unique_id.so
LoadModule userdir_module modules/mod_userdir.so
#LoadModule usertrack_module modules/mod_usertrack.so
#LoadModule version_module modules/mod_version.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
#LoadModule watchdog_module modules/mod_watchdog.so
#LoadModule xml2enc_module modules/mod_xml2enc.so

<IfModule unixd_module>
User daemon
Group daemon
</IfModule>

ServerAdmin xxxx@nogiriya.com
ServerName nogiriya.com:80                                                                       

<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "z:/yyyyy/xxxxx"
<Directory "z:/yyyyy/xxxxx">
    Options Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    AllowOverride None
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

<Files ".ht*">
    Require all denied
</Files>

ErrorLog "logs/error.log"

LogLevel warn

<IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below). 
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    CustomLog "logs/access.log" common
    #CustomLog "logs/access.log" combined
</IfModule>

<IfModule alias_module>
    ScriptAlias /www/ "z:/yyyyy/xxxxx/"
</IfModule>

<IfModule cgid_module>
    #Scriptsock logs/cgisock
</IfModule>

<Directory "z:/yyyyy/xxxxx">
    AllowOverride None
    Options Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    Require all granted
</Directory>

<IfModule mime_module>
    TypesConfig conf/mime.types
    #AddType application/x-gzip .tgz
    #AddEncoding x-compress .Z
    #AddEncoding x-gzip .gz .tgz
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddHandler cgi-script .cgi .pl
    #AddHandler type-map var
    #AddType text/html .shtml
    #AddOutputFilter INCLUDES .shtml
</IfModule>

#MIMEMagicFile conf/magic

#ErrorDocument 500 "The server made a boo boo."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 http://www.example.com/subscription_info.html

#MaxRanges unlimited

# Defaults: EnableMMAP On, EnableSendfile Off
#
#EnableMMAP off
#EnableSendfile on
#AcceptFilter http none
#AcceptFilter https none

# Server-pool management (MPM specific)
#Include conf/extra/httpd-mpm.conf

# Multi-language error messages
#Include conf/extra/httpd-multilang-errordoc.conf

# Fancy directory listings
#Include conf/extra/httpd-autoindex.conf

# Language settings 
#Include conf/extra/httpd-languages.conf

# User home directories
Include conf/extra/httpd-userdir.conf

# Real-time info on requests and configuration
Include conf/extra/httpd-info.conf

# Virtual hosts
Include conf/extra/httpd-vhosts.conf

# Local access to the Apache HTTP Server Manual
#Include conf/extra/httpd-manual.conf

# Distributed authoring and versioning (WebDAV)
#Include conf/extra/httpd-dav.conf 

# Various default settings
#Include conf/extra/httpd-default.conf

# Configure mod_proxy_html to understand HTML4/XHTML1

<IfModule proxy_html_module>
Include conf/extra/httpd-proxy-html.conf
</IfModule>

# Secure (SSL/TLS) connections
# Note: The following must must be present to support
#       starting without SSL on platforms with no /dev/random equivalent
#       but a statically compiled-in mod_ssl.
#
<IfModule ssl_module>
#Include conf/extra/httpd-ssl.conf
Include conf/extra/httpd-**ssl.conf
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>

<IfModule http2_module>
    ProtocolsHonorOrder On
    Protocols h2 h2c http/1.1
</IfModule>
ここまで↑            


Apache\conf\extra\httpd-**ssl.conf
ここから↓
Listen 443 https

<IfDefine ENABLE_TLS13>
  SSLProtocol -all +TLSv1.2 +TLSv1.3
  SSLCipherSuite SSL ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:!RC4:!LOW:!MD5:!aNULL:!eNULL:!3DES:!EXP:!PSK:!SRP:!DSS
  SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
</IfDefine>

<IfDefine !ENABLE_TLS13>
SSLProtocol -all +TLSv1.1 +TLSv1.2
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:!RC4:!LOW:!MD5:!aNULL:!eNULL:!3DES:!EXP:!PSK:!SRP:!DSS
SSLProxyCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:!RC4:!LOW:!MD5:!aNULL:!eNULL:!3DES:!EXP:!PSK:!SRP:!DSS
</IfDefine>

SSLHonorCipherOrder On

SSLPassPhraseDialog  builtin

#SSLSessionCache         "dbm:${SRVROOT}/logs/ssl_scache"
SSLSessionCache        "shmcb:${SRVROOT}/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory "${SRVROOT}/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

CustomLog "${SRVROOT}/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" env=HTTPS

##
## SSL Virtual Host Context
##

<VirtualHost _default_:443>
  SSLEngine on
  ServerName localhost:443
  SSLCertificateFile "${SRVROOT}/conf/ssl/server.crt"
  SSLCertificateKeyFile "${SRVROOT}/conf/ssl/server.key"

  DocumentRoot "z:/yyyyy/xxxxx"
	CustomLog "${SRVROOT}/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
	<Directory "z:/yyyyy/xxxxx">          
		Options Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
		AllowOverride AuthConfig Limit FileInfo
                           Require all granted
	</Directory>
</virtualhost>

<VirtualHost *:443>
  SSLEngine on
  ServerName nogiriya.com:443
  SSLCertificateFile "${SRVROOT}/conf/ssl/red5.crt"
  SSLCertificateKeyFile "${SRVROOT}/conf/ssl/red5.key"

   DocumentRoot "z:/yyyyy/xxxxx"
	CustomLog "${SRVROOT}/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
	<Directory "z:/yyyyy/xxxxx">
		Options Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
		AllowOverride AuthConfig Limit FileInfo
                           Require all granted
	</Directory>
</virtualhost>
ここまで↑

Apache\conf\extra\httpd-vhosts.conf
ここから↓
#
# Virtual Hosts
#
<VirtualHost *:80>
        ServerName nogiriya.com
        ServerAdmin xxxx@nogiriya.com
        DocumentRoot "z:/yyyyy/xxxxx"
<Directory "z:/yyyyy/xxxxx">
    Options Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    AllowOverride None
    Require all granted
</Directory>
        ProxyPreserveHost on
        RewriteEngine on
###      RewriteCond %{HTTP:Upgrade} !=websocket [NC]
###      RewriteRule /(.*)           http://nogiriya.com:5080/$1 [P,L]
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [L,QSA,R=permanent]
        ProxyPassReverse / http://nogiriya.com:5080/ 
        ProxyPassReverse /openmeetings/wicket/ ws://nogiriya.com:5080/openmeetings/wicket/
 
        ErrorLog  "logs/openmeetings-error.log"  
        CustomLog "logs/openmeetings-access.log" combined  
</VirtualHost>       
                     
<VirtualHost *:443>    
  SSLEngine on
  ServerName nogiriya.com:443
  SSLCertificateFile "${SRVROOT}/conf/ssl/red5.crt"
  SSLCertificateKeyFile "${SRVROOT}/conf/ssl/red5.key"

   DocumentRoot "z:/yyyyy/xxxxx"
	CustomLog "${SRVROOT}/logs/ssl_request.log" \ 
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 
	<Directory "z:/yyyyy/xxxxx">
		Options Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
		AllowOverride AuthConfig Limit FileInfo
                Require all granted 
	</Directory> 
 
</virtualhost>  
ここまで↑ 
       
   
Openmeetings SSL化にあたり下記サイト様が非常に参考になりました、ありがとう御座居ました。
参考サイト様：ろっひー
https://ameblo.jp/yoshihirow/entry-12344533766.html
以下４部作 
・OpenmeetingsインストールからProxy設定(3.0.5〜3.2.1近辺) 
・OpenmeetingsをSSLで動作させる設定(3.3.0以降)
・OpenmeetingsをそれでもProxyで動作させる(危険)
・Openmeetingsのアップグレード ＆ ChromiumとFlash

現時点でほかに日本語でのＳＳＬ構築ページは見つかりませんでした。