Enabling https on Crowd now can access through both port 8095 and 8443

Shiuh Rong Yong

I have just configured https on my Crowd server, upon restarting the application, now I can access the https site through port 8095 and 8443, is that intentionally?

Or did I missed something? I followed the Atlassian guide online.

Tomislav Tobijas

Hi @Shiuh Rong Yong ,

I believe this is intentional, as the default HTTP connector remains active in your configuration files.

To ensure a secure environment, you must manually configure a redirection or disable the insecure port.

From what I can remember, you'll have to do something like this:

1. Update server.xml:
   • Locate the HTTP Connector (port 8095) in <Crowd-Install>/apache-tomcat/conf/server.xml.
   • Add the redirectPort="8443" attribute to this connector.
2. Update web.xml:
   • Navigate to <Crowd-Install>/crowd-webapp/WEB-INF/.
   • Add a security constraint at the end of the file, just before the closing </web-app> tag, to force a confidential transport guarantee:

<security-constraint>

  <web-resource-collection>

    <web-resource-name>Entire Application</web-resource-name>

    <url-pattern>/*</url-pattern>

  </web-resource-collection>

  <user-data-constraint>

    <transport-guarantee>CONFIDENTIAL</transport-guarantee>

  </user-data-constraint>

</security-constraint>

And lastly, restart Crowd.

This is a bit documented here https://confluence.atlassian.com/crowd/integrating-crowd-with-atlassian-jira-192625.html , although I believe there are other, more relevant docs as well. 👀📖

Note that I haven't done this for quite some time, so things might have changed a bit, but I believe the core steps should be what's stated above 🤔

Cheers,
Tobi