nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

API with HTTP

Aviv Cohen

Hi all,

We moved our staging Jira machine to HTTPS (8443) with RootCA certificate recently

For some reason Rest API still accessible only with HTTP on port 8080. How it can be changed to work with HTTPS ? Is it a must ?

It's important for me to understand because we're using servers out of our domain

Any idea?

10x in advance !

Accepted answers

All comments

Josh Steckler

What happens when you try 8443? Error message?

And please post the <connector> object(s) in your server.xml as well.

-Josh

Aviv Cohen

HI @Josh Steckler

What happens when you try 8443?

Error 404

And please post the <connector> object(s) in your server.xml as well

I updated the Connector in the server.xml step-by-step like in the tutorial

-->
 <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
 maxHttpHeaderSize="8192" SSLEnabled="true"
 maxThreads="150" minSpareThreads="25"
 enableLookups="false" disableUploadTimeout="true"
 acceptCount="100" scheme="https" secure="true"
 clientAuth="false" sslProtocol="TLS" useBodyEncodingForURI="true"
 keyAlias="jira1" keystoreFile="/opt/atlassian/jira/jira.jks" keystorePass="<my pwd>" keystoreType="JKS"/>
 <!--

<Connector port="8080"

maxThreads="150"
 minSpareThreads="25"
 connectionTimeout="20000"

enableLookups="false"
 maxHttpHeaderSize="8192"
 protocol="HTTP/1.1"
 useBodyEncodingForURI="true"
 redirectPort="8443"
 acceptCount="100"
 disableUploadTimeout="true"
 bindOnInit="false"/>

<!--

Josh Steckler

Connectors look fine. Make sure your base url is changed to https://hostname.domain.com:8443

Can you give more information on the exact API endpoint you're using and the whole http response including headers?

I would recommend if you're trying this in a script to isolate the problem by using cURL.

For instance, run these commands:

curl -i https://jirahostname.domain.com:8443/rest/api/latest/serverInfo

curl -i http://jirahostname.domain.com:8080/rest/api/latest/serverInfo

These commands should have nearly identical response, looking like:

HTTP/1.1 200
Date: Mon, 02 Apr 2018 16:32:39 GMT
X-AREQUESTID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-ASEN: SEN-XXXXXXXXXX
X-AUSERNAME: anonymous
Cache-Control: no-cache, no-store, no-transform
Content-Type: application/json;charset=UTF-8
Set-Cookie: atlassian.xsrf.token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx|lout;path=/;Secure
Transfer-Encoding: chunked

{"baseUrl":"https://XXXXX.XXXXX.com:8443","version":"7.6.2","versionNumbers":[7,6,2],"deploymentType":"Server","buildNumber":76004,"buildDate":"2017-12-20T00:00:00.000-0500","scmInfo":"a2a9d7db0ecab4541c2f15c5625050b2b216894f","serverTitle":"JIRA"}

Aviv Cohen

I want 1st to understand why I can use REST API with HTTP port 8080 while Jira runs in browser on HTTPS with the new certificate?

Is it something else I need to configure ?

Josh Steckler

Thanks, this is what I thought.

Are you getting certificate errors in the browser? Bypassing them perhaps?

Or maybe your organization has added the root CA to the trust store on your computer, which would bypass this as well.

You may need to add the ca cert to the trust store on the system you're using to bypass the error. Most scripting http libraries have an option to override errors, and cURL does too, using the -k option mentioned in the error message.

If you are using a self-signed certificate, the best solution may be to purchase a trusted certificate from a reputable vendor.

Aviv Cohen

This will be useful for me in the next phase

At this point, I want to understand why I can use HTTP port 8080 when using the REST API while the server configured to be HTTPS port 8443 (in my local machine in IT domain)

the CURL looks as follows:

curl -k -D- -u user:key -X POST --data @path_to_json_file -H "Content-Type: application/json" https://hostname:8443/Dashboard.jspa/rest/api/2/issue/

I'm getting 404 error

using HTTP with port 8080 works fine. Port 8443 is available in my domain

Josh Steckler

Well, for one thing it should be https://hostname:8443/rest/api/2/issue/

Aviv Cohen

@Josh Steckler it works ! Tnx man

BUT:

My redirect configuration is not working now from HTTP port 80 to HTTPS port 8443
I took the name that I mentioned before from my FQDN

Josh Steckler

Is port 80 currently redirecting to 8080? I'm curious how that is occurring if it is.

Honestly the most robust method for securing Atlassian applications is to use a web server & proxy in front of Jira. That way Apache (or any other web server) could handle the redirects, and you'd be able to use port 443 on linux.

https://confluence.atlassian.com/adminjiraserver071/integrating-jira-with-apache-using-ssl-802593043.html

This is what I do. My only server.xml connector listens on port 8081.

Then on apache, I listen on 80, 8080 and 443. 80 and 8080 rewrite to https and the proxy. I understand that this is another piece of overhead to administer but it's ultimately going to provide you the most functionality and speed. Apache is better than Tomcat at SSL resolution.

Aviv Cohen

Is port 80 currently redirecting to 8080? I'm curious how that is occurring if it is.

Sorry I meant port 8080

Josh Steckler

Ah OK.

https://confluence.atlassian.com/adminjiraserver070/running-jira-applications-over-ssl-or-https-749383630.html#RunningJIRAapplicationsoverSSLorHTTPS-Advancedconfiguration

See step 5 under Advanced Configuration, subsection "Update Tomcat with Keystore"

If redirection to HTTPS will be used (this is recommended), edit the <JIRA_INSTALL>/WEB-INF/web.xml file and add the following section at the end of the file, before the closing </web-app>. In this example, all URLs except attachments are redirected from HTTP to HTTPS.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira