SSL error with Bitbucket (v5.10.0)

Question

Hello:

I have SSL enable but chrome reports my connection is not private listing "ERR_CERT_COMMON_NAME_INVALID".  Searching on this yields lots of results but nothing that I'm able to use.

I followed the process outline in the documents (https://confluence.atlassian.com/bitbucketserver/securing-bitbucket-server-with-tomcat-using-ssl-776640127.html) with one exception...my CA gives instructions for importing a .pem file.

So when that didn't work, i started back from scratch and was able to find where to download root, intermediate and servercertificate files and import root and intermediate .crt files.  After rebooting the service still the same error.

Over this weekend I've play more with various steps but never was able to get it correct all browsers (chrome, firefox, edge) report that the site is not private.

So I am at a loss to what the issue is, any insight is welcomed.

bitbucket.properties

server.port=443
server.ssl.enabled=true
server.ssl.key-store=C:/cert/tomcat.keystore
server.ssl.key-store-password=<password>
server.ssl.key-alias=tomcat

Jonny Polivka · Answer

After talking with our CA vendor support and searching online I've come to the conclusion that what I'm asking isn't realistic.

The short is, I want Bitbucket users not have to go through the rigmarole of trusting a self-signed cert for any Git client they use...plus not have to do the same with our build automation for a system that is not exposed to the internet.

The forum thread below describes exactly what I want to accomplish and answers the question.  Spoiler alert... Not feasible.

https://community.letsencrypt.org/t/ssl-certificate-for-a-internal-only-domain-thats-not-on-the-internet/27062

Stephen Sifers · Answer

Hello Jonny,

Certificate setup with errors can be very frustrating to deal with.

The error you have is typically a browser error, more inline with Chrome not liking the certificate and possibly the intermediate certificate. If you are using GoDaddy, DigiCert, etc, then you need to ensure the intermediate certificate is imported into your keystore. Not having the intermediate certificate will cause issues with trusting the certificate chain.

To check to see if your keystore has the intermediate cert, run the following:

C:/JAVAPATH/keytool -list -v -keystore C:/cert/tomcat.keystore

Here is the Chrome KB for connection errors (ERR_CERT_COMMON_NAME_INVALID): https://support.google.com/chrome/answer/6098869?vid=0-1096065308212-1494386582244

We also have a KB that lists diagnosis tools that you can use to test connectivity: https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-779355358.html

I hope this helps in resolving your issue.

-Stephen Sifers