Stash backup client problem with self-signed certificate

Question

In my Stash installation I configured tomcat's server.xml and web.xml according to this link so that HTTP is blocked and automatically redirected to HTTPS. Using a self-signed certifcate the stash backup client runs into trouble, output is: 2014-10-10 13:13:36,673 ERROR A backup could not be created. Reason: java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching found org.apache.wink.client.ClientRuntimeException: java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching found What I tried: * localhost and , run as root or the stash user * added javax.net.ssl.keyStore=/home/atlstash/.keystore to backup-config.properties (location of the keystore containing the self-signed certificate) * Everything else works as expected after accepting the certificate when entering the site for the very first time What can I do to get this working? Is there a way to allow HTTP connections to tomcat from localhost only? Thanks in advance

PB Xu1 · Answer

You can also try it the other way around: Program a workaround, example:

http://pastebin.com/g8KFQHms

This class calls the backup client, but before excludes localhost from certificate checking.

Compile it with something like:

javac -cp .:stash-backup-client.jar SSLWorkAround.java

And run it with:

java -cp .:stash-backup-client.jar SSLWorkAround

Mike Friedrich · Answer

So both logfile and the certicate show the same sever FQDN? I was assuming a mismatch between the certificate and the server configuration. If thats not the case i recommend opening a ticket with Atlassian Support. Maybe the backup tool cannot deal with the redirect from http to https when communicating with the server.

kayy11 · Answer

Yes it's like myhost.myprovider.com. In backup-config.properties I specified https://myhost.myprovider.com.net:8443. myhost.myprovider.com is a technical domain name like you get it when ordering a root server