nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Bitbucket SSL Config For PKS File

Rob Ables

We have had Bitbucket running on SSL with a self-signed cert. The properties file pointed to the jks keystore that had the cert in it.

Now we have a purchased wildcard cert to use, and we are having trouble updating the properties file to work with the PFX file directly. We have no issues with Jira using that PFX file, but it is doing it via the older style XML config.

Here is what we have in the properties file that is failing. What are we missing, or have wrong?

server.port=8443
server.ssl.enabled=true
#server.ssl.key-store=e:/keystore/stash.jks
server.ssl.key-store-type=pkcs12
server.ssl.key-store=e:/ssl/healthsmart_wildcard_2017_cert.pfx
server.ssl.key-store-password=******
server.ssl.key-password=******
server.ssl.protocol=TLS

Thanks in advance.

Rob

Accepted answers

Rodrigo M

Hello Rob!

Please take a look at the Securing Bitbucket Server with Tomcat using SSL documentation in order to set the new SSL cert.

Also, be sure to include all needed parameters in bitbucket.properties in order to set the new SSL certificate. For example, you may want to include the server.ssl.key-alias of the certificate if the alias is anything different from its standard value, which is tomcat.

If the issue still occurs, would you mind sharing with us any SSL errors that Bitbucket may generate when starting the application?
This way we would have more information about the issue and what's going on behind the scenes.

Regards
Rodrigo

All comments

Rodrigo M

Hello Rob!

Please take a look at the Securing Bitbucket Server with Tomcat using SSL documentation in order to set the new SSL cert.

Regards
Rodrigo

Rob Ables

Hey Rodrigo!

Thank you for the reply. I have read through the article (prior to posting this as well). We didn't have the server.ssl.key-alias entry in there, and that could be the issue. However, the PFX cert doesn't contain an alias as it was just directly issued by the CA. Should I specify that entry in the file with a blank in that scenario?

The log file is very vague on startup fail:

2018-07-23 10:40:20 Commons Daemon procrun stderr initialized
Exception in thread "main" nTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:48)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:87)
at com.atlassian.bitbucket.internal.launcher.BitbucketServerLauncher.start(BitbucketServerLauncher.java:151)
at com.atlassian.bitbucket.internal.launcher.BitbucketServerLauncher.main(BitbucketServerLauncher.java:99)
Caused by: org.springframework.boot.context.embedded.tomcat.ConnectorStartFailedException: Connector configured to listen on port 8443 failed to start
at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.checkThatConnectorsHaveStarted(TomcatEmbeddedServletContainer.java:222)
at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.start(TomcatEmbeddedServletContainer.java:198)
at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.startEmbeddedServletContainer(EmbeddedWebApplicationContext.java:297)
at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.finishRefresh(EmbeddedWebApplicationContext.java:145)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:546)
at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:122)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:693)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:360)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:303)
at com.atlassian.bitbucket.internal.boot.BitbucketServerApplication.start(BitbucketServerApplication.java:247)
at com.atlassian.bitbucket.internal.boot.BitbucketServerApplication.main(BitbucketServerApplication.java:83)

Thank you,

Rob

Rodrigo M

Hey Bob

Can you confirm what log file did you share? Probably the errors we are looking for are being written in the BITBUCKET_HOME/log/atlassian-bitbucket.log file.

Regards
Rodrigo

Rob Ables

Rodrigo,

Thanks for pointing that out. There are two log file folders. Logs and Log. In reviewing the new file, I found that the service was being denied access to the new PFX cert file. I corrected that issue, and now it is telling me that the alias does not identify a key entry. I have tried leaving the server.ssl.key-alias= entry blank, and entering the wildcard cert's domain in there. There is no alias I can see in for this cert. How can you specify that?

"java.io.IOException: Alias name [*.healthsmart.com] does not identify a key entry"

Thanks,

Rob

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

bitbucket

bitbucket-server