Have problems setting up SSL self signed certificate on our hosted environment

Question

Cant seem to pick up SSL certificate on confluence server?  Can you help

Carson Mackin · Answer

Thanks for the late update, but we were sorted. Also, Keytool explorer is the very handy tool to play around with Java keystore, helped a lot. Also for some reason confluence tomcat not able to read the keystore file from the user profile location. it has to be on a location outside such as c:\certs In step 3 on the below article it says the property need to be added in order for tomcat to pickup keystoreFile location https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html keystoreFile=""/> where the correct syntax is keystoreFile="file:///C:/certs/" file:/// helps to avoid the error below on windows machine Failed to load keystore type [JKS] with path [C:\WINDOWS\system32\config\systemprofile/.keystore] due to [Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystore] java.lang.IllegalArgumentException: Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystore Thanks for your help.

Daniel Eads · Answer

Hi Carson,

Working with the Java keytool can be pretty fiddly. Here are a couple thoughts to check:

* Determine which JRE Confluence is trying to use. System java (the one installed in Program Files) or the JRE that comes bundled with Confluence (<confluence home>/jre). Instructions for determining/changing that are here.
* Once you know which Java that Confluence is trying to use, double-check that the keytool for that Java contains both the private and public key for the certificate you're trying to import.

Basically the error you're seeing now amounts to Java believing it doesn't have both the public and private key for the certificate you're trying to use. Since it's very easy to have some confusion on Windows over which Java Runtime Environment is in use, I'd try that path first.

But more in general, if you can use a reverse proxy such as IIS or Apache, I'd recommend going that route instead. Certificates are significantly easier to manage in a reverse proxy - as you've already seen, the Java keytool is not a great experience. If you're familiar with either web server, I think you may have better luck going this route:

* Instructions for IIS
* Instructions for Apache

Let me know if you need more help either continuing with the keytool or with a reverse proxy.

Cheers,
Daniel

Carson Mackin · Answer

Hi Daniel

We moved on now and we getting below error ( I have modified the Alias name in below for security reason)

Caused by: java.lang.IllegalArgumentException: Alias name [servername.im] does not identify a key entry
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:85)
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:216)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1043)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:540)
at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:932)
... 13 more
Caused by: java.io.IOException: Alias name [servername.im] does not identify a key entry
at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:229)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:112)

and keyAlias in server.xml set to the certificate name. Please be advised we trying to make it working using selfsigned certificate, which we created by following below article

https://confluence.atlassian.com/bitbucketserver/if-you-use-self-signed-certificates-938028692.html#Ifyouuseself-signedcertificates-commandlineinstallation

Please help