Bitbucket Failed to start after adding SSL

Question

I'm adding certificate to our bitbucket server and it is failed to start.

ERROR:

says Alias name [tomcat] does not identify a key entry :(  but i'm giveing the correct alias name

APPLICATION FAILED TO START

Description: The Tomcat connector configured to listen on port 8080 failed to start. The port may already be in use or the connector may be misconfigured.

Action: Verify the connector's configuration, identify and stop any process that's listening on port 8080, or configure this application to listen on another port.

Logs

org.apache.catalina.LifecycleException: Failed to start component [Connector[HTTP/1.1-8080]]

at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)

at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.addPreviouslyRemovedConnectors(TomcatEmbeddedServletContainer.java:265)

at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.start(TomcatEmbeddedServletContainer.java:208)

at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.startEmbeddedServletContainer(EmbeddedWebApplicationContext.java:297)

at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.finishRefresh(EmbeddedWebApplicationContext.java:145)

at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:546)

at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:122)

at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:693)

at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:360)

at org.springframework.boot.SpringApplication.run(SpringApplication.java:303)

at com.atlassian.bitbucket.internal.boot.BitbucketServerApplication.start(BitbucketServerApplication.java:246)

at com.atlassian.bitbucket.internal.boot.BitbucketServerApplication.main(BitbucketServerApplication.java:82)

at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:48)

at org.springframework.boot.loader.Launcher.launch(Launcher.java:87)

at com.atlassian.bitbucket.internal.launcher.BitbucketServerLauncher.start(BitbucketServerLauncher.java:151)

at com.atlassian.bitbucket.internal.launcher.BitbucketServerLauncher.main(BitbucketServerLauncher.java:99)

... 5 frames trimmed

Caused by: org.apache.catalina.LifecycleException: Protocol handler start failed

at org.apache.catalina.connector.Connector.startInternal(Connector.java:1020)

... 16 common frames omitted

Caused by: java.lang.IllegalArgumentException: Alias name [tomcat] does not identify a key entry

at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:116)

... 16 common frames omitted

Caused by: java.io.IOException: Alias name [tomcat] does not identify a key entry

at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:229)

... 16 common frames omitted

2019-03-20 13:10:38,655 WARN[spring-startup]c.a.stash.internal.home.HomeLock Failed to write process information into the lock file

java.nio.channels.ClosedByInterruptException: null

at java.nio.channels.spi.AbstractInterruptibleChannel.end(AbstractInterruptibleChannel.java:202)

at sun.nio.ch.FileChannelImpl.write(FileChannelImpl.java:216)

at com.atlassian.stash.internal.home.HomeLock.acquireLock(HomeLock.java:127)

at com.atlassian.stash.internal.home.HomeLock.lock(HomeLock.java:98)

at com.atlassian.stash.internal.home.HomeLockAcquirer.lock(HomeLockAcquirer.java:58)

at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:151)

at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:687)

at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:525)

at javax.servlet.GenericServlet.init(GenericServlet.java:158)

at java.lang.Thread.run(Thread.java:745)

... 27 frames trimmed

2019-03-20 13:11:57,522 WARN[localhost-startStop-1]o.a.c.loader.WebappClassLoaderBase The web application [ROOT] appears to have started a thread named [Timer-0] but has failed to stop it. This is very likely to create a memory leak. Stack trace of thread:

java.lang.Object.wait(Native Method)

java.lang.Object.wait(Object.java:502)

java.util.TimerThread.mainLoop(Timer.java:526)

java.util.TimerThread.run(Timer.java:505)

2019-03-20 13:11:57,522 WARN[localhost-startStop-1]o.a.c.loader.WebappClassLoaderBase The web application [ROOT] appears to have started a thread named [OracleTimeoutPollingThread] but has failed to stop it. This is very likely to create a memory leak. Stack trace of thread:

2019-03-20 13:11:57,533 INFO[main]o.apache.catalina.util.LifecycleBase The stop() method was called on component [StandardServer[-1]] after stop() had already been called. The second call will be ignored.

2019-03-20 13:11:57,533 INFO[main]o.a.coyote.http11.Http11NioProtocol Stopping ProtocolHandler ["https-jsse-nio-8080"]

2019-03-20 13:11:57,533 INFO[main]o.a.coyote.http11.Http11NioProtocol Destroying ProtocolHandler ["https-jsse-nio-8080"]

2019-03-20 13:11:57,537 INFO[main]o.s.b.a.l.AutoConfigurationReportLoggingInitializer

Error starting ApplicationContext. To display the auto-configuration report re-run your application with 'debug' enabled.

2019-03-20 13:11:57,544 ERROR [main]o.s.b.d.LoggingFailureAnalysisReporter

***************************

APPLICATION FAILED TO START

***************************

Description:

The Tomcat connector configured to listen on port 8080 failed to start. The port may already be in use or the connector may be misconfigured.

Action:

Verify the connector's configuration, identify and stop any process that's listening on port 8080, or configure this application to listen on another port.

2019-03-20 13:11:57,546 INFO[main]o.s.b.c.e.AnnotationConfigEmbeddedWebApplicationContext Closing org.springframework.boot.context.embedded.AnnotationConfigEmbeddedWebApplicationContext@6ea12c19: startup date [Wed Mar 20 13:10:31 GMT 2019]; root of context hierarchy

2019-03-20 13:11:57,547 INFO[main]o.s.j.e.a.AnnotationMBeanExporter Unregistering JMX-exposed beans on shutdown

2019-03-20 13:11:57,547 INFO  [main]  c.a.b.i.boot.log.BuildInfoLogger Bitbucket 5.12.2 has shut down

Bit bucket properties file with SSL enable

server.require-ssl=true
server.additional-connector.1.port=7990
server.additional-connector.1.redirect-port=8080
server.additional-connector.1.require-ssl=true
server.port=8080
server.secure=true
server.scheme=https
server.ssl.enabled=true
server.ssl.client-auth=want
server.ssl.protocol=TLS
server.ssl.key-store=Bitbucket home directory>/shared/config/ssl-keystore
server.ssl.key-store-password=xxxx
server.ssl.key-password=xxx
server.ssl.key-alias=tomcat
plugin.bitbucket-git.path.executable=xxx

But when I remove the SSL it works file with port 8080

after removing ssl bitbucket properties file looks like below:

jdbc.driver=oracle.jdbc.driver.OracleDriver 
jdbc.url=xxxx jdbc.user=xxxx 
jdbc.password=xxx 
server.require-ssl=false 
server.additional-connector.1.port=7990 
server.additional-connector.1.redirect-port=8080 
server.port=8080 server.scheme=http 
server.ssl.enabled=false 
plugin.bitbucket-git.path.executable=/xxx

Can anyone please help me here to find the solution.

unknown · Answer

Thanks Mehmet,

I had followed the below steps to make it working:

Once you receive the certificate from CA follow the below steps:
 
Convert the certificate and private key to PKCS 12
 openssl pkcs12 -export -in [filename-certificate] -inkey [filename-key] -name [host] -out [filename-new-PKCS-12.p12]

Import the certificate to the keystore
 Now, import the PKCS 12 certificate and the CA bundle file the keystore.
  
   1 .Import the PKCS 12 certificate by executing the following command:
 keytool -importkeystore -deststorepass [password] -destkeystore [filename-new-keystore.jks] -srckeystore [filename-new-PKCS-12.p12] -srcstoretype PKCS12
 
  NOTE: Where the [password] is the password you specified when you created the private key.
  
   2. Import the CA bundle file by executing the following command:
   keytool -import -alias [alias-name] -trustcacerts -file [filename-certificate] -keystore [key-store-path]

Thanks,

Mehmet Şirin Usanmaz_egbzkb · Answer

Hi,

Can you try as follows?

server.port=8443
server.ssl.enabled=true

Thanks