nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Recommended way to creating SSL Cert

John Chuma

I am using Ubuntu 18.04 as my OS. I am looking at setting up Jira to utilize HTTPS instead of HTTP as this is going to be accessible on the outside. Currently, I have already setup the Apache Reverse Proxy using HTTP.

I have read multiple articles regarding creating a cert and one place recommended using Portecle, but it has to be used on the server itself. Seeing as the server is a Linux box, that isn't the case.

My question is what have you guys used in the passed with creating a CSR for Jira? Would utilizing openssl work? We are looking at buying the SSL Cert through our website hosting company so that we don't have to renew the cert every 90 days.

Please let me know your thoughts.

Thank you in advance!

Accepted answers

Alexis Robert

Hi @John Chuma ,

I usually give 2 options when asked about SSL certs:

the cheapest way is to use Letsencrypt, as they provide free certificates. The certs are only valid 3 months but it's very easy to automate.
the easiest way is to simply purchase a cert with Digicert, GlobalSign, Geotrust ... or anyone you like, that is valid for up to 2 years. You can then forget about it until it's up for renewal.

To implement HTTPS, I recommend doing so using Apache as a rever proxy, it's way easier than trying to set up the cert in Jira itself (you need to import it into Tomcat with another tool, not very user friendly and quite complex).

There is a very good documentation page to setup HTTPS with Apache, you can simply follow the steps described there and you should not have any problems.

Let me know if you have any questions,

--Alexis

All comments

Alexis Robert

Hi @John Chuma ,

I usually give 2 options when asked about SSL certs:

the cheapest way is to use Letsencrypt, as they provide free certificates. The certs are only valid 3 months but it's very easy to automate.
the easiest way is to simply purchase a cert with Digicert, GlobalSign, Geotrust ... or anyone you like, that is valid for up to 2 years. You can then forget about it until it's up for renewal.

There is a very good documentation page to setup HTTPS with Apache, you can simply follow the steps described there and you should not have any problems.

Let me know if you have any questions,

--Alexis

John Chuma

Hi Alexis,

Thank you for the quick response. We are going to purchase the cert for 2 years. I have already setup the Apache Reverse Proxy via HTTP and it works well.

I read through the documentation page and it was one of the articles I have already read. I was wondering if I should just create the CSR using openssl instead of using the Portecle application, which is referenced here.

Thank you in advance!

John

Alexis Robert

@John Chuma ,

I usually create the CSR with openssl on the command line, I'm sure your certificate provider should have a documentation available on how to proceed if you need help.

There are only a few command needed, it's not very complex. For example, creating a CSR is done with one command:

new -key certificate.key -out certificate.csr -sha256<br>openssl req -

Let me know if you have any questions,

--Alexis

John Chuma

Alexis,

Thank you for the info. As of right now, I have my http reverse proxy working without any challenges.

Within my reverse proxy Virtual host, I have setup the HTTPS virtual host (see below for the config, it's slightly redacted for privacy reasons. To get the http proxy to work again, I commented out the https virtual host).

<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName jira.domain.com

ProxyRequests off
ProxyVia off

<Proxy *>
Require all granted
</Proxy>

ProxyPass /jira http://X.X.X.X:8080/jira
ProxyPassReverse /jira http://X.X.X.X:8080/jira

#ServerAdmin webmaster@localhost
#DocumentRoot /var/www/html

# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
</VirtualHost>

#<VirtualHost *:443>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
# ServerName jira.domain.com:443

#SSLEngine on
# SSLCertificateFile /path/to/cert/file/certName.crt
# SSLCertificateKeyFile /path/to/cert/file/jira.domain.com.key
# SSLCertificateChainFile /path/to/cert/file/certBundle.crt

GNU nano 2.9.3 /etc/apache2/sites-enabled/000-default.conf

# ProxyVia off

# <Proxy *>
# Require all granted
# </Proxy>

# ProxyPass /jira http://X.X.X.X:8443/jira
# ProxyPassReverse /jira http://X.X.X.X:8443/jira

#ServerAdmin webmaster@localhost
#DocumentRoot /var/www/html

# ErrorLog ${APACHE_LOG_DIR}/error.log
# CustomLog ${APACHE_LOG_DIR}/access.log combined

#</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

When I attempt to light up the https tomcat connector, it doesn't load and jira doesn't start. I am sure it's something silly. I have included my connectors below.

<Service name="Catalina">
<!--
==============================================================================================================
DEFAULT - Direct connector with no proxy for unproxied access to Jira.

If using a http/https proxy, comment out this connector.
==============================================================================================================
-->

<!-- Relaxing chars because of JRASERVER-67974
<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^\`"<>"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
acceptCount="100" disableUploadTimeout="true" bindOnInit="false"
proxyName="jira.domain.com" proxyPort="80" scheme="http"/>

-->
<!--
==============================================================================================================
HTTP - Proxying Jira via Apache or Nginx over HTTP

If you're proxying traffic to Jira over HTTP, uncomment the below connector and comment out the others.
Ensure the proxyName and proxyPort are updated with the appropriate information if necessary as per the docs.

See the following for more information:

Apache - https://confluence.atlassian.com/x/4xQLM
nginx - https://confluence.atlassian.com/x/DAFmGQ
==============================================================================================================
-->

GNU nano 2.9.3 server.xml

<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^\`"<>"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
acceptCount="100" disableUploadTimeout="true" bindOnInit="false" scheme="http"
proxyName="jira.domain.com" proxyPort="80"/>

<!--
==============================================================================================================
HTTPS - Proxying Jira via Apache or Nginx over HTTPS

If you're proxying traffic to Jira over HTTPS, uncomment the below connector and comment out the others.
Ensure the proxyName and proxyPort are updated with the appropriate information if necessary as per the docs.

See the following for more information:

Apache - https://confluence.atlassian.com/x/PTT3MQ
nginx - https://confluence.atlassian.com/x/DAFmGQ
==============================================================================================================
-->

<!--

Please let me know if you need any additional information.

Thank you for your help thus far, it is much appreciated.

John

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-service-desk

jira-service-desk-server