Need help with configuring Jira for SSL

Question

Hello, I need some help.  I have setup and installed Jira on my centos server.  It works well and I like it.  It'll be a huge help with my work.  However I am struggling to implement a reverse proxy to enable traffic over HTTPS. It all has to do with configuring the connectors in Tomcat with the server.xml configuration.  I don't know if I need to change the base connector, http, https or all 3. I have tried it multiple ways and I either get problems when I restart jira or I get a "bad gateway" when I go to the https version of the URL.

Jonathon Kline · Answer

I finally got it.  Someone posted a solution that added some things from the links you shared above.

https://www.justinsilver.com/technology/atlassian-jira-nginx-ssl-reverse-proxy/

lists a root directory for JIRA (  root   /opt/atlassian/jira;) and it uses an upstream gateway method of calling the proxy for TOMCAT.

upstream jira{

server       127.0.0.1:8081 fail_timeout=0;

}

proxy_pass        http://jira;

}

Jonathon Kline · Answer

OK.  I have tried this and I can't seem to get it to work. I've looked at both articles.

When I change the connectors it doesn't seem to want to proxy through NGINX.  The KB recommends changing 3 connectors (Base, HTTP, HTTPS) where you have 3 ports to proxy over (8080, 8081, 8082).  When I go to create my nginx conf file I need to specify a proxy port under the location.  I keep getting a bad gateway status page.

location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8080;
    }

The various questions I have are:

1 - Do I only need one connector specified?  The KB specifics 3.  The vendor's specifics 1.  Neither work for me?

2 - What ports need to be open?  I am using centos.  Also, is there any problems with SELINUX here between tomcat and NGINX.  I ask because SELINUX messes stuff up at times.

3 - When I follow the vendors guidance it's much simplier and only has 1 connector but I can't get it to go.  But I know the ports will proxy because I have jira running normally on 8080.

Any help to narrow down my troubleshooting would be appreciated.

Jonathon Kline · Answer

Great.  Thank you so much.  I will check this out.