nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How do I completely disable SSL for JIRA on Apache Tomcat

Jason Huntowski

Hello,

This may be a rather dumb question, but I inherited JIRA from another company and they have SSL enabled on Apache Tomcat 7. It works great and if it didn't, I see there is a wealth of knowledge from Apache.org to JIRA's knowledge base and Atlassian Answers on how to set it up or fix it, but I can't find anything on simply turning it off.

Our instance sits behind a firewall and SSL is not necessary, or at least the powers that be deem it not necessary, so how do I just disable it?

Were running JIRA 6.3.1 on Windows Server 2012. I have tried altering the server.xml and changed SSLEnabled to false, which I kind of knew wouldn't work, which it didn't. I have tried opening the configuration tool and selecting "Disabled" as the profile, but it all just fails. I am server dumb, this whole thing just sort of got dropped into my lap, so any advice would be golden.

I could work backwards through the configuration steps, but that seems labor intensive for just turning something off. There has to be a better way. Is there a config file somewhere where I could just comment out the initial kick-off of the whole SSL process?

Thanks!

Accepted answers

rrudnicki

Hi Jason,

As I could see, you have a HTTPS connector setup. Commenting that code will disable your SSL. Put the comment between  like this:

&lt;!--
&lt;Connector port="8443" useBodyEncodingForURI="true" protocol="org.apache.coyote.http11.Http11Protocol" 
minSpareThreads="25" maxThreads="150" maxSpareThreads="75" maxHttpHeaderSize="8192" 
enableLookups="false" disableUploadTimeout="true" connectionTimeout="20000" acceptCount="100" 
sslProtocol="TLS" secure="true" scheme="https" keystoreType="JKS" keystorePass=[our pass] 
keystoreFile=[our file location] keyAlias=[our alias] clientAuth="false" SSLEnabled="true"/&gt;
&lt;/Service&gt;&lt;/Server&gt;
--&gt;

This connector is in the end of your server.xml toguether with the HTTP connector.

Also make sure Tomcat is not forcing the HTTPS redirecting. Please have a look on this link to check out this: https://confluence.atlassian.com/display/DOC/Running+Confluence+Over+SSL+or+HTTPS#RunningConfluenceOverSSLorHTTPS-Step5.AddaSecurityConstrainttoRedirectAllURLstoHTTPS

Regards,

Renato Rudnicki

All comments

David Di Blasio_f9zfaa

Hi Jason,
Depending on how SSL is configured you might just have to comment out the connector in <JIRA_INSTALL>/conf/server.xml. Here's an example from https://confluence.atlassian.com/display/JIRA/Running+JIRA+over+SSL+or+HTTPS

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxHttpHeaderSize="8192" SSLEnabled="true"
maxThreads="150" minSpareThreads="25"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" useBodyEncodingForURI="true"
keyAlias="jira" keystoreFile="<JIRA_HOME>/jira.jks" keystorePass="changeit" keystoreType="JKS"/>

If you paste in your server.xml we can get a better idea on how to direct you though. Be advised you'll want to change any sensitive information such as the keystorepass

rrudnicki

Hi Jason,

As I could see, you have a HTTPS connector setup. Commenting that code will disable your SSL. Put the comment between  like this:

&lt;!--
&lt;Connector port="8443" useBodyEncodingForURI="true" protocol="org.apache.coyote.http11.Http11Protocol" 
minSpareThreads="25" maxThreads="150" maxSpareThreads="75" maxHttpHeaderSize="8192" 
enableLookups="false" disableUploadTimeout="true" connectionTimeout="20000" acceptCount="100" 
sslProtocol="TLS" secure="true" scheme="https" keystoreType="JKS" keystorePass=[our pass] 
keystoreFile=[our file location] keyAlias=[our alias] clientAuth="false" SSLEnabled="true"/&gt;
&lt;/Service&gt;&lt;/Server&gt;
--&gt;

This connector is in the end of your server.xml toguether with the HTTP connector.

Regards,

Renato Rudnicki

Jason Huntowski

Renato,

Thank you for your suggestions. I did find that the web.xml was forcing the redirect. I am in the process of commenting out the code you suggested with the code from the web.xml commented out but I had one question? In the other connector that doesn't get commented out, should I remove the redirectPort="8443"?

Connector port="8080" useBodyEncodingForURI="true" redirectPort="8443" protocol="HTTP/1.1" minSpareThreads="25" maxThreads="150" maxSpareThreads="75" maxHttpHeaderSize="8192" enableLookups="false" disableUploadTimeout="true" connectionTimeout="20000" acceptCount="100"/>

Also, will I have to offer a new URL for accessing this site? the URL I use now is the servername:8443, that would no longer be viable if the redirect is off, right? Or am I way off base?

Thanks,

Jason

Jason Huntowski

David,

Thank you so much for your response. I was actually trying to comment out that section when you replied, but it still seems to go to the redirect port. I am wondering if I need to change a port redirect or proxy somewhere else? I have pasted my server xml below. Any info you can give me would be one step closer than I am right now.

Thanks,

Jason

Server.xml

<?xml version="1.0" encoding="UTF-8"?>

-<Server shutdown="SHUTDOWN" port="8005">

<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on"/>

<Listener className="org.apache.catalina.core.JasperListener"/><Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>

-<Service name="Catalina">

-<Engine name="Catalina" defaultHost="localhost">-<Host name="localhost" unpackWARs="true" autoDeploy="true" appBase="webapps">-<Context useHttpOnly="true" reloadable="false" path="" docBase="${catalina.home}/atlassian-jira">

<Resource name="UserTransaction" type="javax.transaction.UserTransaction" jotm.timeout="60" factory="org.objectweb.jotm.UserTransactionFactory" auth="Container"/><Manager pathname=""/></Context></Host>

<Valve className="org.apache.catalina.valves.AccessLogValve" resolveHosts="false" pattern="%a %{jira.request.id}r %{jira.request.username}r %t "%m %U%q %H" %s %b %D "%{Referer}i" "%{User-Agent}i" "%{jira.request.assession.id}r""/></Engine><Connector port="8080" useBodyEncodingForURI="true" redirectPort="8443" protocol="HTTP/1.1" minSpareThreads="25" maxThreads="150" maxSpareThreads="75" maxHttpHeaderSize="8192" enableLookups="false" disableUploadTimeout="true" connectionTimeout="20000" acceptCount="100"/><Connector port="8443" useBodyEncodingForURI="true" protocol="org.apache.coyote.http11.Http11Protocol" minSpareThreads="25" maxThreads="150" maxSpareThreads="75" maxHttpHeaderSize="8192" enableLookups="false" disableUploadTimeout="true" connectionTimeout="20000" acceptCount="100" sslProtocol="TLS" secure="true" scheme="https" keystoreType="JKS" keystorePass=[our pass] keystoreFile=[our file location] keyAlias=[our alias] clientAuth="false" SSLEnabled="true"/></Service></Server>

Jason Huntowski

So, I just wanted to update this question with what I learned as the answer to this. The culprit ended up being the forced HTTPS redirect in the web.xml in WEB-INF. We ultimately decided to leave the connector for both the HTTPS and the HTTP in the server.xml for a while so that users who don't read the full e-mail, won't be given an error when they access the old link. Thank you to both Renato and David for your help.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-administration