Hi, I'm using JIRA with https proxied by apache. I was following the steps from this link. https://confluence.atlassian.com/adminjiraserver071/integrating-jira-with-apache-using-ssl-802593043.html Almost everything works fine, but the names of the gadgets are shown like __MSG_gadget... and the connection to confluence does not work propertly. I searched what the problem could be, but the only thing I found was an SSLHandshake exception what usually happens when using self signed certificates. This is a bit supprising, because I got my certificate signed by an official CA. Followed you can find my configs. server.xml vhosts ServerAdmin admin@domain.tld ServerName sub.domain.tld SSLEngine on SSLCertificateFile /etc/ssl/domain_tld.crt SSLCertificateKeyFile /etc/ssl/domain_tld.key SSLCertificateChainFile /etc/ssl/ca_bundle.crt ProxyRequests Off ProxyVia Off Order Deny,Allow Allow from all ProxyPass / http://localhost:8101/ ProxyPassReverse / http://localhost:8101/ ErrorLog ${APACHE_LOG_DIR}/issues-error.log CustomLog ${APACHE_LOG_DIR}/issues-access.log combined Do you have any Idea what I'm doing wrong and if the issues are related to each other or are this two different issues? Thanks in advance, Sascha

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Gadgets are showen like __MSG_gadget after setting a apache ssl proxy

Sascha Thiel

Hi,

I'm using JIRA with https proxied by apache. I was following the steps from this link.

https://confluence.atlassian.com/adminjiraserver071/integrating-jira-with-apache-using-ssl-802593043.html

Almost everything works fine, but the names of the gadgets are shown like __MSG_gadget... and the connection to confluence does not work propertly. I searched what the problem could be, but the only thing I found was an SSLHandshake exception what usually happens when using self signed certificates. This is a bit supprising, because I got my certificate signed by an official CA.

Followed you can find my configs.

server.xml

&lt;Connector port="8101"
	maxThreads="150"
	minSpareThreads="25"
	connectionTimeout="20000"
	enableLookups="false"
	maxHttpHeaderSize="8192"
	protocol="HTTP/1.1"
	useBodyEncodingForURI="true"
	redirectPort="8443"
	acceptCount="100"
	disableUploadTimeout="true"
	scheme="https"
	proxyName="sub.domain.tld"
	proxyPort="443"/&gt;
	
&lt;Connector port="8100"
   maxThreads="150"
   minSpareThreads="25"
   connectionTimeout="20000"
   enableLookups="false"
   maxHttpHeaderSize="8192"
   protocol="HTTP/1.1"
   useBodyEncodingForURI="true"
   redirectPort="8443"
   acceptCount="100"
   disableUploadTimeout="true"/&gt;

vhosts

&lt;VirtualHost xx.xx.xx.xx:443&gt;
	ServerAdmin admin@domain.tld
	ServerName sub.domain.tld
	SSLEngine on
	SSLCertificateFile /etc/ssl/domain_tld.crt
	SSLCertificateKeyFile /etc/ssl/domain_tld.key
	SSLCertificateChainFile /etc/ssl/ca_bundle.crt
	ProxyRequests Off
	ProxyVia Off
	&lt;Proxy *&gt;
			Order Deny,Allow
			Allow from all
	&lt;/Proxy&gt;
	ProxyPass / http://localhost:8101/
	ProxyPassReverse / http://localhost:8101/
	ErrorLog ${APACHE_LOG_DIR}/issues-error.log
	CustomLog ${APACHE_LOG_DIR}/issues-access.log combined
&lt;/VirtualHost&gt;

Do you have any Idea what I'm doing wrong and if the issues are related to each other or are this two different issues?

Thanks in advance,
Sascha

Accepted answers

Nic Brough -Adaptavist-

The configs there look ok, but the error is usually caused by JIRA not being able to talk to itself. Imagine that the dashboard is nothing to do with JIRA itself, but needs to read JIRA in order to work - you have to provide a valid route from the dashboard to JIRA.

So, have you imported the ssl keys required into the keystore?

All comments

Nic Brough -Adaptavist-

So, have you imported the ssl keys required into the keystore?

Sascha Thiel

Hi Nic,

Thanks for checking the configs.

No, I haven't imported the ssl keys yet, because I thought this is only neseccary for selfsigned certificates (mine is signed by an trusted CA). Isn't this the case? If not, can you explain me why?

Nic Brough -Adaptavist-

The JVM is trying to read a url, which you've protected with certificate checks. It can't get to the url, because it doesn't have the certificates.

Self signing is irrelevant, it needs the certificate to present to the url!

Sascha Thiel

I added now both crt files to the keystore but the issue is still there.

keytool -import -trustcacerts -keystore ../lib/security/cacerts -storepass changeit -noprompt -alias {alias} -file /etc/ssl/domain_tld.crt

chetan patil_kmv4te

Hi Sascha,

We are also facing the same issue with gadgets after upgrade JIRA from 6.3.15 to 7.2.7.

Could you please let us know where did you add "SSLVerifyClient none" line exactly.

Regards,

sascha_thiel

Hey, I added it into the VirtualHost definition.

<VirtualHost xx.xx.xx.xx:443>

... something

SSLEngine on
SSLVerifyClient none
... certificate stuff

... something

</VirtualHost>

JP_r9fro1

I am having the same issue, but in my case is beacuse I have been directed to to use SSLVerifyClient require. Once I chage from optional to require, it brakes the filters, gadgets and AppLink. Do you know if there is any workround if i have set apache to SSLVerifyClient to require?

Nic Brough -Adaptavist-

That flag makes Apache require a valid client certificate. You'll need to create a client cert for the server and enable it in the JVM so that it can talk to itself over SSL.

Vickey Palzor Lepcha

I've had this issue in the past - reimporting the SSL Certificate did resolve my issue.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-software

jira-administration