Having some difficulties with getting SSL setup on our Windows instance of Confluence using Letsencrypt. Has anyone run through this before using letsencrypt? Would appreciate any help or guidance!
Are you using IIS as a reverse proxy and doing the SSL termination at IIS or are you doing the SSL termination with Tomcat?
We’re utilizing Tomcat Davin
I think you are going to have the best success if you set it up to reverse proxy through IIS. We are on Windows in our organization as well and we saw about 15%-20% performance boost when we switched where we terminate the SSL connection. I think IIS is just better about handling SSL than Tomcat is. Plus there is lots of information on how to setup Let's Encrypt with IIS. I don't really have any gems for you with regards to Tomcat, but maybe consider using IIS for that. It's actually pretty easy to setup and it took me less than an hour to do.
That’s interesting, I think I’m going to look at going that route, didn’t even think about doing it that way. You didn’t happen to follow https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-microsoft-internet-information-services-iis-833931378.html did you?
Sure did. Honestly, I think it makes doing SSL with Confluence a bit easier anyway. I'm not fond of having to go to the command line to create java keystores and generating CSRs. If you are on Confluence 6.5 or above this web.config works. If you are below 6.5 there are some changes that need to be made due to a bug that causes synchrony to stop working when large amounts of text are pasted into the editor window.
<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <rewrite> <rules> <clear /> <rule name="Force HTTPS" enabled="true" stopProcessing="true"> <match url="(.*)" /> <conditions logicalGrouping="MatchAll" trackAllCaptures="false"> <add input="{HTTPS}" pattern="off" /> </conditions> <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" /> </rule> <rule name="Synchrony HTTP" stopProcessing="true"> <match url="synchrony/(.*)" /> <conditions logicalGrouping="MatchAll" trackAllCaptures="false" /> <action type="Rewrite" url="http://localhost:8091/synchrony/{R:1}" /> </rule> <rule name="Synchrony Web Sockets Reverse Proxy" stopProcessing="true"> <match url="ws://(.*)" /> <conditions logicalGrouping="MatchAll" trackAllCaptures="false" /> <action type="Rewrite" url="ws://localhost:8091/{R:1}" /> </rule> <rule name="Confluence Reverse Proxy" stopProcessing="true"> <match url="(.*)" /> <conditions logicalGrouping="MatchAll" trackAllCaptures="false" /> <action type="Rewrite" url="http://localhost:8090/{R:1}" /> </rule> </rules> </rewrite> <security> <requestFiltering allowDoubleEscaping="true"> <!-- This value must be in bytes. Set it a little higher than what Confluence's max upload size is. --> <requestLimits maxAllowedContentLength="62914560" /> </requestFiltering> </security> </system.webServer> <system.web> <!-- The attribute "requestPathInvalidCharacters" keeps IIS from complaining about special characters in the url. The attribute "maxRequestLength" controls the max upload size. Set to the equivalent of the above, but in kilobytes instead of bytes. --> <httpRuntime executionTimeout="20" maxRequestLength="61440" requestPathInvalidCharacters="" requestValidationMode="2.0" /> <pages validateRequest="false" /> </system.web> </configuration>
It looks like you're new here. Sign in or register to get started.
