Using the official Atlassian Bitbucket image I've written a docker-compose file, which gets Bitbucket working with SSL via an Nginx container.
Everything works well except when I attempt to configure the Active Directory integration using SSL (non SSL AD traffic over 389 works fine).
When I click "Save and Test" I get an error:
"Connection test failed. Response from server:
<servername>:636; nested exception is javax.naming.CommunicationException: <servername:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: uname to find valid certification path to requested target]"
I've tried mounting the host CA certificates into the Bitbucket container at /etc/ssl/ca-certificates.pem, however this didn't resolve the issue.
Does anybody have any ideas as to how to resolve this issue with the Bitbucket container?
Following the instructions here:
I've created a keystore and mounted it into the container at: /var/atlassian/application-data/bitbucket/shared/config/ssl-keystore.jks.
This keystore was populated with the root & domain CA certs and the local machine cert.
I then updated bitbucket.properties to add:
server.secure=true # Already set via container env properties server.scheme=https # Already set via container env properties server.proxy-port=443 # Already set via container env properties server.proxy-name=bitbucket.domain.com # Already set via container env properties
I still get the same error when attempting to change the AD User Directory configuration to SSL.
Finally figured it out.
It seems that for some reason the Bitbucket:6 container ignores its own keystore, regardless of what you put in the bitbucket.properties file.
This is how I fixed the issue:
Strip all of the server.* entries from bitbucket.properties
Copy $JAVA_HOME/jre/lib/security/cacerts from the container to the host
Use keytool to import your CA certs into this file
Mount this updated file back into the Docker container at its original location.
Note: My Nginx container is configured with certificates to do the HTTPS redirection.
Personally I don't like touching $JAVA_HOME/jre/lib/security/cacerts. Mainly because you need to remember to re-apply your edit every time you receive a Java update!
I prefer to grab a proper wildcard cert and put that in front of AD (Active Directory).
There's a 2-year wildcard here for $84: https://www.ssl2buy.com/alphassl-wildcard.php
I use that $84 cert in my own environment and it's fine with Java 6, Java 7, Java 8 and all newer Javas.
(Why not use a free Let's Encrypt cert instead? The problem with Let's Encrypt is that some older Java's don't work with it, and its 90-day expiry, while good for security, is not great for things like AD).
p.s. I have no relationship with any SSL certificate vendor. Just sharing my own experience here.
I hear you. I used to be the bitbucket admin for a mid-size financial (around 1000 staff total, including 100 developers). Convincing the windows infra team to do anything to make my life easier usually took several months - not exactly an option when Bitbucket needs to be up & running yesterday!
Hi everyone, The Cloud team recently announced 12 new DevOps features that help developers ship better code, faster ! While we’re all excited about the new improvements to Bitbucket ...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events