HTTPS problem in Jira servicedesk

[Artesa]

Hi, I have a problem with implementation of HTTPS to Jira servicedesk. I was use jira configuration tool to set up it but when I change mode to HTTPS or HTTP / HTTPS, Jira cannot start (ERR_CONNECTION_TIMED_OUT). When you change back to HTTP mode all works fine. 

I tried many things to do with server.xml file, but nothing works. 

Of course I have right keystore and updated keystore path in server.xml.

Do You Have Anyone Idea?

Thanks a lot.

P.S. I can share with you my server.xml file.

[Andy Heinzer · Accepted solution]

Hi,

I understand that you are trying to configure Jira to use HTTPS, but that when you do this in the config tool, Jira fails to start up.   

It is possible that some specific versions of Jira had the config tool fail to added required parameters to that config file as needed for HTTPS connections.  More details about this bug in JRASERVER-64082. That bug page does have a work-around listed that should help here:

Workaround

Modify JIRA_INSTALL/conf/server.xml. Change the protocol on your HTTPS connector to: protocol="org.apache.coyote.http11.Http11NioProtocol"

• If you do not use the HTTP Connector but use the AJP Connector instead, use the AJP NIO protocol instead.
  • The AJP connector is: protocol="org.apache.coyote.ajp.AjpNioProtocol"

Refer to Upgrade notes for 7.3 for instructions. See Running JIRA applications over SSL.

See Running JIRA applications over SSL or HTTPS for full directions on running JIRA over SSL or HTTPS.

If your config file has multiple connectors, you would need to repeat these steps for each connector.   And if you are still unable to start Jira when this happens, I would want to take a closer look at both your $JIRAINSTALL/conf/server.xml and the $JIRAINSTALL/logs/catalina.out  That catalina file will have more details about why Jira is failing to start up here that will help us to troubleshoot this problem.

Cheers,

Andy

[Artesa]

Hi Andy, I try your workaround but without any luck. So now I don´t know where I make a mistake... Please could you check my server.xml and catalina.out?

You can download it here:

https://wetransfer.com/downloads/0024d642ef928ab04da8d633808ddd0e20190913083420/e96e4368baa6df498372c69d8a608f0a20190913083420/ed1fff

Thank you verry much.

[Andy Heinzer]

Hi Artesa,

Thanks for posting these logs.  I found another error in them that I believe is related to a different bug.   The error I see explains that Jira cannot startup with the current settings in the server.xml:

2019-09-13 09:29:56,688 JIRA-Bootstrap ERROR [c.a.jira.startup.DefaultJiraLauncher] JIRA has failed to start because of the following errors: [(Event: Level = (EventLevel: error) , Key = (EventType: setup) , Desc = Tomcat is misconfigured , Exception = The server.xml file is missing parameters needed by Jira to handle requests that contain special characters.<br/>)]

This is a different bug in where the config tool is not always adding the proper configuration for SSL connectors.  More details in JRASERVER-68559.  That bug also has a workaround that links to the page: Changing server.xml to handle requests with special characters

That page documents a solution here.  I would suggest that you use the config tool to try to setup the SSL here once more, save those changes, and then manually edit the server.xml file once more.

Solution

1. Go to <Jira-installation-directory>/conf, and edit the server.xml file.
2. Find all connectors your application is using. Just search for Connector in the file, or look at the example below. You're interested only in connectors whose protocol is set to HTTP and HTTPS (not AJP).

3. Add relaxedPathChars="[]|" relaxedQueryChars="[]|{}^\`"<>" to the connector properties in server.xml. For example:

   <Connector 
   port="8080" 
   relaxedPathChars="[]|" 
   relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;" 
   maxThreads="150" 
   minSpareThreads="25" 
   connectionTimeout="20000" 
   enableLookups="false" 
   maxHttpHeaderSize="8192" 
   protocol="HTTP/1.1" 
   useBodyEncodingForURI="true" 
   redirectPort="8443" 
   acceptCount="100" 
   disableUploadTimeout="true" 
   bindOnInit="false"/>

4. Restart Jira.

Note that you will need to make sure that both of your connectors (http and https) have these relaxedPathChars and relaxedQueryChars values. Try making these changes, then save the server.xml and start Jira once more.

Andy

[Artesa]

Hi Andy, I was tried your solution, but again without any luck. I don´t know where I make a mistake... 

Again I send you logs and server.xml file.

https://wetransfer.com/downloads/ef19f67f1b31909bdf1dcdaa8bb15db620190917075116/c6c1213a3774ca5d9d498204aeeec7fd20190917075116/bd1b78

Thank you for your support.

[Andy Heinzer]

Hi @Artesa 

I can see in the most recently files, it looks like your configuration of the server.xml file looks correct now.   However in the catalina log file I can see the entry of :

17-Sep-2019 09:39:48.260 SEVERE [Catalina-startStop-1] org.apache.catalina.startup.HostConfig.beforeStart Unable to create directory for deployment: [/opt/atlassian/jira/conf/Catalina/localhost]

Which indicates that when Jira is starting up, there is some reason that Jira cannot create this needed directory. 

It could be that it's a permission issue, in which case it might help to walk back through the steps in How to fix directory permissions in Linux for Jira Server.   Try following the steps in that KB as well, and restart Jira once more.  I would be interested to see if this corrects the startup problem here.  If not, then by all means I would like to see more updated logs about this issue.

Andy

[Artesa]

Perfect!!! It works!!!!!!

Thanks a LOT!!!!