Application Links no longer working after SSL upgrade. NGINX Reverse Proxy

[Matthew Jarvis]

Hello Community! 

We recently added our wildcard certificates to our local Confluence and Jira integration. We are utilizing NGINX as a reverse proxy for said installations. After enabling HTTPS the Application Link between Jira and Confluence is no longer working. Additionally I am attempting to redirect HTTP requests to HTTPS or disable HTTP completely however have had no luck. I believe I disabled the HTTP listener in my NGINX configuration however both Jira and Confluence still accept HTTP requests. 

When attempting to add the application URL "https://example1.com I receive the message 

"No response was received from the URL you entered - it may not be valid. Please fix the URL below, if needed, and click Continue."

I am able to access the application via https://example1.com and https://example2.com

My server.xml is as follows. 

<Server port="9000" shutdown="SHUTDOWN" debug="0">
 <Service name="Tomcat-Standalone">
 <!--
 ==============================================================================================================
 DEFAULT - Direct connector with no proxy, for unproxied HTTP access to Confluence.

 If using a http/https proxy, comment out this connector.
 ==============================================================================================================

 <Connector port="9090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol"/>
 -->
 <!--
 ==============================================================================================================
 HTTP - Proxying Confluence via Apache or Nginx over HTTP

 If you're proxying traffic to Confluence over HTTP, uncomment the connector below and comment out the others.
 Make sure you provide the right information for proxyName and proxyPort.

 For more information see:
 Apache - https://confluence.atlassian.com/x/4xQLM
 nginx - https://confluence.atlassian.com/x/TgSvEg

 ==============================================================================================================
 -->

 <!--
 <Connector port="9090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol"
 scheme="http" proxyName="example1.com" proxyPort="80"/>

 -->
 <!--
 ==============================================================================================================
 HTTPS - Direct connector with no proxy, for unproxied HTTPS access to Confluence.

 For more info see https://confluence.atlassian.com/x/s3UC
 ==============================================================================================================
 -->

 <!--
 <Connector port="8443" maxHttpHeaderSize="8192"
 maxThreads="150" minSpareThreads="25"
 protocol="org.apache.coyote.http11.Http11NioProtocol"
 enableLookups="false" disableUploadTimeout="true"
 acceptCount="100" scheme="https" secure="true"
 clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" SSLEnabled="true"
 URIEncoding="UTF-8" keystorePass="<MY_CERTIFICATE_PASSWORD>"/>
 -->

 <!--
 ==============================================================================================================
 HTTPS - Proxying Confluence via Apache or Nginx over HTTPS

 If you're proxying traffic to Confluence over HTTPS, uncomment the connector below and comment out the others.
 Make sure you provide the right information for proxyName and proxyPort.

 For more information see:
 Apache - https://confluence.atlassian.com/x/PTT3MQ
 nginx - https://confluence.atlassian.com/x/cNIvMw
 ==============================================================================================================
 -->


 <Connector port="9090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol"
 scheme="https" secure="true" proxyName="example1.com" proxyPort="443"/>


 <Engine name="Standalone" defaultHost="localhost" debug="0">
 <Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false" startStopThreads="4">
 <Context path="" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true">
 <!-- Logging configuration for Confluence is specified in confluence/WEB-INF/classes/log4j.properties -->
 <Manager pathname=""/>
 <Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60"/>
 </Context>

 <Context path="${confluence.context.path}/synchrony-proxy" docBase="../synchrony-proxy" debug="0"
 reloadable="false" useHttpOnly="true">
 <Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60"/>
 </Context>
 </Host>
 </Engine>
 </Service>
</Server>

My NGINX configuration is as follows. 

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
 #listen 80 default_server;
 #listen [::]:80 default_server;

 location / {
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "Upgrade";
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-Server $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_pass http://localhost:9090;

 }

 # SSL configuration
 #
 listen 443 ssl default_server;
 listen [::]:443 ssl default_server;
 ssl_certificate /srv/wild.crt;
 ssl_certificate_key /srv/wild.key;
 #
 # Note: You should disable gzip for SSL traffic.
 # See: https://bugs.debian.org/773332
 #
 # Read up on ssl_ciphers to ensure a secure configuration.
 # See: https://bugs.debian.org/765782
 #
 # Self signed certs generated by the ssl-cert package
 # Don't use them in a production server!
 #
 # include snippets/snakeoil.conf;

# root /var/www/html;

 # Add index.php to the list if you are using PHP
# index index.html index.htm index.nginx-debian.html;

# server_name _;

# location / {
 # First attempt to serve request as file, then
 # as directory, then fall back to displaying a 404.
# try_files $uri $uri/ =404;
# }

 # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
 #
 #location ~ \.php$ {
 # include snippets/fastcgi-php.conf;
 #
 # # With php7.0-cgi alone:
 # fastcgi_pass 127.0.0.1:9000;
 # # With php7.0-fpm:
 # fastcgi_pass unix:/run/php/php7.0-fpm.sock;
 #}

 # deny access to .htaccess files, if Apache's document root
 # concurs with nginx's one
 #
 #location ~ /\.ht {
 # deny all;
 #}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
# listen 80;
# listen [::]:80;
#
# server_name example.com;
#
# root /var/www/example.com;
# index index.html;
#
# location / {
# try_files $uri $uri/ =404;
# }
#}

And finally I have added the following to my web.xml

<security-constraint>
 <web-resource-collection>
 <web-resource-name>Restricted URLs</web-resource-name>
 <url-pattern>/</url-pattern>
 </web-resource-collection>
 <user-data-constraint>
 <transport-guarantee>CONFIDENTIAL</transport-guarantee>
 </user-data-constraint>
</security-constraint>

I have no ACLs in place that should be blocking any connection between my Jira and Confluence servers. 

I am stumped. Any assistance would be very much appreciated. I am fairly new to Atlassian and reverse proxies in general. Thanks for your time!

[Fabian Lim]

Hi Mathew,

Check this troubleshooting guide for reference: https://confluence.atlassian.com/kb/application-links-troubleshooting-guide-718668765.html#ApplicationLinksTroubleshootingGuide-ssl

I hope this helps.