I am unable to change the Portal Start Page to the Rules tab via the URL /rules/

The problem isn’t with importing the certificate, we’ve done that. The problem is that due to the networking setup the app server is unable to contact its own address as specified in SERVER_AND_PORT. This is the reason that the conf.suite.MAIL_SERVER_AND_PORT property exists (the comments for that property say “…if the application server cannot connect to the URL defined by … conf.suite.SERVER_AND_PORT…”).

The reason that the server cannot reach itself is that it is behind a load balancer/firewall (listening on 443) which redirects to port 8443, and the server’s name resolves to the Load Balancer’s address, which is only reachable from the Internet, not from “inside”.

So your code should not have used the reported URL as the base of the verification request, but instead should have used some other SCHEME, SERVER_AND_PORT and APPLICATION_CONTEXT to construct the URL for validation (just as for mail rendering).

If this validation only needs to happen once, when setting up the default page, we might be able to create a temporary “tunnel” that will allow the normal scheme+server+port+context to work. But if this validation happens more than once we simply will not be able to do it.

The problem isn’t with importing the certificate, we’ve done that. The problem is that due to the networking setup the app server is unable to contact its own address as specified in SERVER_AND_PORT. This is the reason that the conf.suite.MAIL_SERVER_AND_PORT property exists (the comments for that property say “…if the application server cannot connect to the URL defined by … conf.suite.SERVER_AND_PORT…”).

The reason that the server cannot reach itself is that it is behind a load balancer/firewall (listening on 443) which redirects to port 8443, and the server’s name resolves to the Load Balancer’s address, which is only reachable from the Internet, not from “inside”.

So your code should not have used the reported URL as the base of the verification request, but instead should have used some other SCHEME, SERVER_AND_PORT and APPLICATION_CONTEXT to construct the URL for validation (just as for mail rendering).

If this validation only needs to happen once, when setting up the default page, we might be able to create a temporary “tunnel” that will allow the normal scheme+server+port+context to work. But if this validation happens more than once we simply will not be able to do it.