Running Confluence over https

[Jose Salinas]

Hello people

I would like run Confluence over https. Im running a standalone version 3.5.5.

I have a certificate provided by my Company but the extension of certificate is .cer.

According to the documentation there is not a step that explain how to do with a certificate .cer.

Any idea?

Thanks in advance.

Kind regards,

Jose

[Jeremy Largman · Accepted solution]

Hi Jose,

It's in the documentation you linked. You'll want to import your cert into the keystore (step 1, certificate option 2, number 5):

keytool -importcert -alias tomcat -keystore <MY_KEYSTORE_FILENAME> -file <MY_CERTIFICATE_FILENAME>

[Jose Salinas]

Jeremy

Thank you for your fast reply.

I was a little confused.

Now, I have other question. I can not find my .kesystore to replace in <MY_KEYSTORE_FILENAME>

Must .keystore be generated? Or where it should be?

Thanks.

Jose

[Jeremy Largman]

I believe that's under step 3:

• On Windows: <tt>C:\Documents and Settings\\#CURRENT_USER#\.keystore</tt>
• On OS X and UNIX-based systems: <tt>~/.keystore</tt>

[Jose Salinas]

Jeremy,

There is not a fille called .keystore.

I generated one executing:

"%JAVA_HOME%\bin\keytool" -genkeypair -alias tomcat -keyalg RSA

But I execute:

keytool -importcert -alias tomcat -keystore <MY_KEYSTORE_FILENAME> -file <MY_CERTIFICATE_FILENAME>

An exceptions is raised:

keytool error: java.lang.Exception: Public keys in reply and keystore don't match

What is wrong?

Thanks,

Jose

[Jeremy Largman]

I'm guessing that you might have imported a self-signed certificate for your domain already (ie - you've already got something with that alias?) If you google the error 'Public keys in reply and keystore don't match' you'll see a bunch of resources about it. You can consider this independently of Confluence. It's a Tomcat + SSL issue, and will have lots of solutions from other Tomcat users for the same SSL problem.

Here's one good one:

http://old.nabble.com/Unable-to-import-certificate-into-keystore-td19416557.html

[Jose Salinas]

Jeremy,

Yes, the error was a replicated alias.

Anyway I followed all steps but I cant see Confluence over https.

Thanks

[Jeremy Largman]

If you can still get to Confluence over http but not https, make sure you've uncommented the ssl connector in server.xml.

[Jose Salinas]

You are right, I can get to Confluence over http (port 8090) but no https (port 8443)

Yes, the ssl connector is enabled in server.xml

<Connector port="8443" maxHttpHeaderSize="8192"

maxThreads="150" minSpareThreads="25" maxSpareThreads="75"

enableLookups="false" disableUploadTimeout="true"

acceptCount="100" scheme="https" secure="true"

clientAuth="false" sslProtocol="TLS" SSLEnabled="true"

URIEncoding="UTF-8" keystorePass="changeit"/>

[Jose Salinas]

You are right, I can get to Confluence over http (port 8090) but no https (port 8443)

Yes, the ssl connector is enabled in server.xml

<Connector port="8443" maxHttpHeaderSize="8192"

maxThreads="150" minSpareThreads="25" maxSpareThreads="75"

enableLookups="false" disableUploadTimeout="true"

acceptCount="100" scheme="https" secure="true"

clientAuth="false" sslProtocol="TLS" SSLEnabled="true"

URIEncoding="UTF-8" keystorePass="changeit"/>