Stash backup client problem with self-signed certificate

[kayy11]

In my Stash installation I configured tomcat's server.xml and web.xml according to this link so that HTTP is blocked and automatically redirected to HTTPS. Using a self-signed certifcate the stash backup client runs into trouble, output is:

2014-10-10 13:13:36,673 ERROR        A backup could not be created. Reason: java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching <our real and existing servername> found
org.apache.wink.client.ClientRuntimeException: java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching <our real and existing servername> found

What I tried:

• localhost and <our real and existing servername>, run as root or the stash user
• added javax.net.ssl.keyStore=/home/atlstash/.keystore to backup-config.properties (location of the keystore containing the self-signed certificate)
• Everything else works as expected after accepting the certificate when entering the site for the very first time

What can I do to get this working?

Is there a way to allow HTTP connections to tomcat from localhost only?

Thanks in advance

[PB Xu]

You can also try it the other way around: Program a workaround, example: http://pastebin.com/g8KFQHms This class calls the backup client, but before excludes localhost from certificate checking. Compile it with something like: javac -cp .:stash-backup-client.jar SSLWorkAround.java And run it with: java -cp .:stash-backup-client.jar SSLWorkAround

[Mike Friedrich]

So both logfile and the certicate show the same sever FQDN? I was assuming a mismatch between the certificate and the server configuration. If thats not the case i recommend opening a ticket with Atlassian Support. Maybe the backup tool cannot deal with the redirect from http to https when communicating with the server.

[kayy11]

Yes it's like myhost.myprovider.com. In backup-config.properties I specified https://myhost.myprovider.com.net:8443. myhost.myprovider.com is a technical domain name like you get it when ordering a root server

[Mike Friedrich]

Is the server name shown in FQDN format?