JIRA Running with NGINX proxy and Confluence on HTTP (mixed-content warning)

[Service-Link Support]

Hi everyone, 

We have a JIRA server that we are running proxied through NGINX over HTTPS.  A confluence server is running on the same machine and when the JIRA server asks for content from the knowledge base we get the following error. 

Mixed Content: The page at 'https://<our_domain>/servicedesk/customer/kb/view/1409038?q=811&q_time=1534377518961&portalId=1&applicationId=3e655cfa-aw85-3204-ac6a-066ad88b23a8' was loaded over HTTPS, but requested an insecure resource 'http://localhost:8090/plugins/servlet/remotepageview?pageId=1409038'. This request has been blocked; the content must be served over HTTPS.

I was wondering the best way to solve this. Any help will be greatly appreciated. I hope I explained this correctly; please feel free to write back if anything is not clear on my explanation. 

Thank you.

[Craig Castle-Mead]

Hi,

My guess is that the application link between JIRA and confluence is setup using 127.0.0.1:8090 and not https://confluence.yourcompany.com/ so instead of hitting nginx over ssl, the request is going straight to the confluence application which is only http.

Change the application link to use the full hostname and it should help.

CCM  

[Service-Link Support]

Thanks much for your answer; I made Confluence run on HTTPS by creating another proxy rule from Nginx. This works perfectly. :)

[Andy Nguyen]

Hey Sudharaka,

I'd like to add on some points to Craig's comment, which is already correct.

Basically this is a known issue where JIRA/JSD is on HTTPS but Confluence is on HTTP. When you browse a Knowledge Base article from JSD Portal, which is over HTTPS, it requests the actual content from a Confluence page, which is over HTTP.

Due to this, the browser detects insecure content and throws the warning. In other words, JSD expects secure content over HTTPS, but receives insecure content over HTTP.

You may get more information here:

1. Unable to View Knowledge Base due to Browser Security for Mixed Content
2. Knowledge Base Shows Empty Content - JIRA Service Desk Self-Help

The best solution, as suggested by Craig, is to also run Confluence over HTTPS, so that JSD will be receiving secure content.

I hope this helps.

Best,

Andy

[Service-Link Support]

I made Confluence run on HTTPS by creating another proxy rule from Nginx. This works perfectly.. Thanks for your answer.