Cant seem to pick up SSL certificate on confluence server? Can you help
Hi Carson,
Can you clarify a bit - are you trying to:
Hopefully these documents provide what you are looking for or at least get you pointed in the right direction.
We're happy to provide more help if you can hone us in on the exact issue you're facing or problem you're trying to solve.
Cheers,Daniel
Hi Daniel
We follow these articles to setup Confluence over ssl
https://confluence.atlassian.com/bitbucketserver/if-you-use-self-signed-certificates-938028692.html#Ifyouuseself-signedcertificates-commandlineinstallation
https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html
Keystore explore indicates certificate installed correctly
We have uncommented lines & updated password in server.xml as advised in the second article and after the restart of confluence service we getting below error in catalinalogs. Could you please help why we getting this illegal character error. We didnt created the keystore file its been created by the Java Keytool.
.keystore file exist under user profile. Appreciate if you please help.
17-Sep-2018 14:12:50.535 SEVERE [main] org.apache.tomcat.util.net.SSLUtilBase.getStore Failed to load keystore type [JKS] with path [C:\WINDOWS\system32\config\systemprofile/.keystore] due to [Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystore]java.lang.IllegalArgumentException: Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystoreat java.net.URI.create(URI.java:852)at java.net.URI.resolve(URI.java:1036)at org.apache.tomcat.util.file.ConfigFileLoader.getInputStream(ConfigFileLoader.java:88)at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:132)at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:204)at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:184)at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:112)at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:85)at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:216)at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1043)at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:540)at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)at org.apache.catalina.connector.Connector.initInternal(Connector.java:932)at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)at org.apache.catalina.core.StandardService.initInternal(StandardService.java:530)at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:852)at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)at org.apache.catalina.startup.Catalina.load(Catalina.java:633)at org.apache.catalina.startup.Catalina.load(Catalina.java:656)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:306)at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:491)Caused by: java.net.URISyntaxException: Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystoreat java.net.URI$Parser.fail(URI.java:2848)at java.net.URI$Parser.checkChars(URI.java:3021)at java.net.URI$Parser.parse(URI.java:3058)at java.net.URI.<init>(URI.java:588)at java.net.URI.create(URI.java:850)... 25 more
17-Sep-2018 14:12:50.536 SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to initialize component [Connector[HTTP/1.1-8443]]org.apache.catalina.LifecycleException: Protocol handler initialization failedat org.apache.catalina.connector.Connector.initInternal(Connector.java:935)at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)at org.apache.catalina.core.StandardService.initInternal(StandardService.java:530)at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:852)at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)at org.apache.catalina.startup.Catalina.load(Catalina.java:633)at org.apache.catalina.startup.Catalina.load(Catalina.java:656)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:306)at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:491)Caused by: java.lang.IllegalArgumentException: Failed to load keystore type [JKS] with path [C:\WINDOWS\system32\config\systemprofile/.keystore] due to [Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystore]at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:85)at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:216)at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1043)at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:540)at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)at org.apache.catalina.connector.Connector.initInternal(Connector.java:932)... 13 moreCaused by: java.io.IOException: Failed to load keystore type [JKS] with path [C:\WINDOWS\system32\config\systemprofile/.keystore] due to [Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystore]at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:150)at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:204)at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:184)at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:112)... 19 more
Hai Daniel
Can we please have an update on this ticket?
Thanks
Carson
We moved on now and we getting below error ( I have modified the Alias name in below for security reason)
Caused by: java.lang.IllegalArgumentException: Alias name [servername.im] does not identify a key entryat org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:85)at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:216)at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1043)at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:540)at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)at org.apache.catalina.connector.Connector.initInternal(Connector.java:932)... 13 moreCaused by: java.io.IOException: Alias name [servername.im] does not identify a key entryat org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:229)at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:112)
and keyAlias in server.xml set to the certificate name. Please be advised we trying to make it working using selfsigned certificate, which we created by following below article
Please help
Working with the Java keytool can be pretty fiddly. Here are a couple thoughts to check:
Basically the error you're seeing now amounts to Java believing it doesn't have both the public and private key for the certificate you're trying to use. Since it's very easy to have some confusion on Windows over which Java Runtime Environment is in use, I'd try that path first.
But more in general, if you can use a reverse proxy such as IIS or Apache, I'd recommend going that route instead. Certificates are significantly easier to manage in a reverse proxy - as you've already seen, the Java keytool is not a great experience. If you're familiar with either web server, I think you may have better luck going this route:
Let me know if you need more help either continuing with the keytool or with a reverse proxy.
It looks like you're new here. Sign in or register to get started.
