Error when accessing Jira though Apache SSL reverse proxy

Randall Perkins

Hello,

I currently have Jira, Confluence, and Bitbucket running on a server using a self-signed certificate. I've been accessing it directly using the server ip and port numbers, but am now working to move it to a subdomain with a CA signed certificate running through an Apache reverse proxy. I want to configure it to be accessible with a context path such as https://sub.domain.com/jira.

I'll keep the focus just on Jira for this problem.

I've used the following pages as a guide to my configuration:
Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http)
Integrating JIRA with Apache using SSL

I can access Jira via http by using http://sub.domain.com:8081/jira (I left out the https redirect for now just for testing).

But when I try to access it through https://sub.domain.com/jira, I get the following error:
Not Found
The requested URL /jira was not found on this server.

The CA certificate seems ok since I can access https://sub.domain.com and I get the test web page showing it's secured with the CA certificate.

See my current config below. I'm sure I'm missing something obvious to someone else.

Thanks,

Randall

 

Software:
RHEL 7.6
Apache 2.4
Jira 7.13
Confluence 6.15
Bitbucket 6.2

Jira Tomcat server.xml

<?xml version="1.0" encoding="UTF-8"?>

<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
<Listener SSLEngine="on" className="org.apache.catalina.core.AprLifecycleListener"/>
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>

<Service name="Catalina">

<!-- Apache Proxy Connector with values for scheme, proxyName and proxyPort -->
<Connector acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" port="8080" protocol="HTTP/1.1" redirectPort="8443" useBodyEncodingForURI="true"
scheme="https" proxyName="sub.domain.com" proxyPort="443"
relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"/>

<!-- Standard HTTP Connector -->
<Connector acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" port="8081" protocol="HTTP/1.1" redirectPort="8443" useBodyEncodingForURI="true"
relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"/>


<Engine defaultHost="localhost" name="Catalina">
<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true">
<Context docBase="${catalina.home}/atlassian-jira" path="/jira" reloadable="false" useHttpOnly="true">
<Resource auth="Container" factory="org.objectweb.jotm.UserTransactionFactory" jotm.timeout="60" 
name="UserTransaction" type="javax.transaction.UserTransaction"/>
<Manager pathname=""/>
<JarScanner scanManifest="false"/>
</Context>
</Host>
<Valve className="org.apache.catalina.valves.AccessLogValve" pattern="%a %{jira.request.id}r %{jira.request.username}r %t &quot;%m %U%q %H&quot; %s %b %D &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; &quot;%{jira.request.assession.id}r&quot;"/>
</Engine>
</Service>
</Server>

Apache jira-vhost.conf

<VirtualHost *.443>
ServerName sub.domain.com

ProxyRequests Off

<Proxy *>
Require all granted
</Proxy>

ProxyPass /jira http://localhost:8080/jira/
ProxyPassReverse /jira http://localhost:8080/jira/

SSLEngine On
SSLCertificateFile /etc/pki/CA/certs/ca_file.crt
SSLCertificateKeyFile /etc/pki/CA/certs/ca_key.key

</VirtualHost>


<VirtualHost *:80>
ServerName sub.domain.com

ProxyRequests Off

<Proxy *>
Require all granted
</Proxy>

ProxyPass /jira http://localhost:8080/jira/
ProxyPassReverse /jira http://localhost:8080/jira/

</VirtualHost>

 

Andy Heinzer

Hi Randall,

Taking a look at Jira's server.xml that part looks ok to me.  But I noticed something in the apache config that looked slightly off to me.  Your config doesn't seem to have the ProxyPreserveHost directive, whereas the documentation in Integrating JIRA with Apache using SSL does.  

For a site config like yours with Jira in a context path, we'd expect it to look more like this:

# JIRA Proxy Configuration:
<Proxy *>
        Order deny,allow
        Allow from all
</Proxy>

SSLProxyEngine          On
ProxyRequests           Off
ProxyPreserveHost       On
ProxyPass               /jira       http://jiraserver:8080/jira
ProxyPassReverse        /jira       http://jiraserver:8080/jira

I found from apache's documentation on that directive:

When enabled, this option will pass the Host: line from the incoming request to the proxied host, instead of the hostname specified in the <a href="https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypass" target="_blank" rel="nofollow noopener noreferrer">ProxyPass</a> line.

I think this might be needed so that Jira's Tomcat can respond to this request.  Try this and let me know if this helps or not.

Andy