Jira - Can't Connect Externally (Incorrect SERVER.XML?)

Question

I’m using Cloudflare with the ports set to 2052 (HTTP) and 2053 (HTTPS). In the server.xml file, I redirect from 2052 to 2053 and it’s been working fine for years, except when I reinstalled Jira and updated to version 9.17.1 I cannot access it remotely anymore.

Rolling back to my previous version is also broken now too and I have no idea why or what's going on. I do not see any warnings or errors in the Catalina logs either. I am able to access Jira by localhost but not by the domain (EG: jira.mywebsite.com) so Jira is in fact running and working but the outside world cannot reach it.

The ports 2052 and 2053 are open on my modem/router (have been for years).

SERVER.XML

Jim Knepley - ReleaseTEAM · Answer

I'm assuming that "isn't being accepted" translates to "fails to validate" in nerd-speak.

There's any number of reasons a certificate can fail to validate. Common issues are that the certificate...

* has expired (valid to is in the past)
* is self-signed (the issuer and the subject are the same)
* was signed by an issuer that isn't trusted by the client/browser, such as an internal CA
* doesn't have a CN or SAN entry that exactly matches the requested hostname

Less frequently, the certificate...

* has been revoked
* isn't yet valid ("valid from" is in the future)
* does not include "server authentication" in its key usage field

Matt_imnilt · Answer

Ah, never mind. I'm stupid. I forgot to re-enable the proxy in Cloudflare since I'm using their certificate and without it going through their proxy, the certificate won't authenticate.

Thanks for your help Jim. Greatly appreciated!

Matt_imnilt · Answer

Okay that wasn't changing anything for me and I had spent about 3 days trying to figure out why, so instead what I've done is I've configured Jira to run in a proxy on IIS (Windows Server 2019) which is actually much cleaner because now there isn't a silly port number on the URL. This seems to have fixed the external connection issue as well.

However, a new problem is facing me which is that my SSL certificate isn't being accepted which is rather odd because all my other CNAME sites are working fine with the same certificate.

Would you happen have any suggestions about this new issue for me? I have included my server.xml file for you (so you can check the proxy settings) which is now the only connector present.

SERVER.XML