Running confluence over SSL - not working

[Mark Everest]

We are evaluating Confluence and have a starter license (shame there is no proper support as if I can't get it working, we won't extend it's use, so Atlassian will lose out!!!)

I have followed the instructions here https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html?_ga=2.136433333.480505651.1547734640-1387529059.1492005255

... but when browsing the server using port 8444 (I can't use 8443 as Jira is running on that) the page never loads.

How can I diagnose what this issue might be? I can successfully run it over http.

[Mark Everest]

Hi,

I did type a very long answer in here and it posted because I saw the confirmation, but I see that it seems to have not made it in :-(  I will try to remember it all.

Firstly, thanks for the offer of help and the promise of excellent service.

We are running Jira and Confluence on the same server as it is a VM and we can throw a load of hardware at it. Also, one of our staff said they had both systems running on the same server in a previous role and here it is OK with the exception of the SSL in Confluence.

Using "netstat -a -b" I can see that tomcat is listening on the right ports:

TCP 0.0.0.0:8080 servername:0 LISTENING
[tomcat8.exe.x64]     <-- this is jira on http
TCP 0.0.0.0:8090 servername:0 LISTENING
[tomcat9.exe]     <-- this is confluence on http
TCP 0.0.0.0:8091 servername:0 LISTENING
[java.exe]
TCP 0.0.0.0:8443 servername:0 LISTENING
[tomcat8.exe.x64]     <-- this is jira on https
TCP 0.0.0.0:8444 servername:0 LISTENING
[tomcat9.exe]     <-- this is confluence on https

The server.xml has the following entries un-commented about connectors:

<Connector port="8090" connectionTimeout="20000" redirectPort="8444"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol"/>

<Connector port="8444" maxHttpHeaderSize="8192"
 maxThreads="150" minSpareThreads="25"
 protocol="org.apache.coyote.http11.Http11Nio2Protocol"
 enableLookups="false" disableUploadTimeout="true"
 acceptCount="100" scheme="https" secure="true"
 clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" SSLEnabled="true"
 URIEncoding="UTF-8" keystorePass="password" keystorefile="drive:\folder\confluence.jks"/>

I cannot use SSL Server Test as this server isn't externally accessible - it is on our corporate network. Are there any internally running tools you could recommend? Surehly though, the app woudl have to response with something to test the certificate.

Confluence creates lots of logs - which ones can I look into see the underlying error (if any?)

Also I should have said (but I don't think it is a contributing factor) but we are using a CNAME to access confluence, rather than the server name. e.g. the users will type in something like https://confluence:8444 rather than https://unmemorableservernamethatconfusestheusers:8444

We do this a lot and it works with Jira. I say I don't think it contributes as:

1. the CNAME works when using http://confluence:8090
2. nothing is shown when browsing https://servername:8444 and usually the page would load, but a certificate error would be displayed.

I hope this helps and I look forward to your answer!

Thanks

Mark

[Shannon S]

Mark,

Can you let me know which reply you want to keep? I believe the one I am replying to here might be it but please confirm. It's a bit hard to follow the thread now so I want to first remove all the duplicates.

If you can also let us know what SSL errors you're experiencing exactly and what errors appear in your Confluence server logs, then we can know what the issue is exactly.

You may also be able to start here with your troubleshooting, depending on the error:

• SSL Troubleshooting

As for an internal testing option, there's one mentioned below:

• Unable to Connect to SSL Services due to PKIX Path Building Failed
  
  

Use SSL Poke to verify connectivity

Try the Java class SSLPoke to see if your truststore contains the right certificates. This will let you connect to a SSL service, send a byte of input, and watch the output.

1. Download SSLPoke.class

2. Execute the class as per the below, changing the URL and port appropriately. Take care that you are running the same Java as what Confluence is running with. If you used the installer you will need to use <confluence-home>/jre/java

Could you give that a test and let us know how it goes?

Shannon

[Mark Everest]

Hi Shannon,

Thanks for your reply - I have removed the duplicate text and this is the best one to use.

I have gone through the SSL troubleshooting, but none of the issues there match my problem - the issue is that when requesting the URL I get no response and eventually a timeout.

When I use SSLPoke I also do not get a response - no error, it is as if the process/request just hangs.

What error logs should I be checking? There are various folder and files, but I really don't know which one to check.

Thanks

Mark

[Mark Everest]

I have looked in the catalina log file and there is an entry as follows:

Illegal character in opaque part at index 2: C:\WINDOWS\system32\config\systemprofile/.keystore

However, the java keystore file is not in that folder. My server.xml file has...

<Connector port="8444" maxHttpHeaderSize="8192"
 maxThreads="150" minSpareThreads="25"
 protocol="org.apache.coyote.http11.Http11Nio2Protocol"
 enableLookups="false" disableUploadTimeout="true"
 acceptCount="100" scheme="https" secure="true"
 clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" SSLEnabled="true"
 URIEncoding="UTF-8" keystorefile="file:///D:/Certificates/confluence-test.jks"/>

... and I have tried ...

<Connector port="8444" maxHttpHeaderSize="8192"
 maxThreads="150" minSpareThreads="25"
 protocol="org.apache.coyote.http11.Http11Nio2Protocol"
 enableLookups="false" disableUploadTimeout="true"
 acceptCount="100" scheme="https" secure="true"
 clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" SSLEnabled="true"
 URIEncoding="UTF-8" keystorefile="D:\Certificates\confluence-test.jks"/>

I have removed the password entry attribute from the above.

[Mark Everest]

Oh - "keystoreFile" had a lowercase "F".

Changing this has fixed it!!!

[Shannon S]

That's really great to hear, thank you Mark!  So sorry for the delays on my end, but I am glad you were able to fix it in the end.

Can you confirm that now everything is working as expected?

Shannon

[Mark Everest]

Yes, all is fine thanks.

[Shannon S]

Happy to hear, thank you for following up, Mark!

Take care and have a pleasant week.

Shannon

[Shannon S]

Hi Mark!

Don't worry about the support for Starter Licenses! I'm not sure if you are aware, but there's a support team here on Community, and we all used to work on the support portal before we moved here. The support is the same quality, and if we need to obtain the Support Zip from you, we can open a case to do that.

In terms of your issue, would you be able to have a look at your server logs as well as having a peek in your Developer Tools console? It should give us some clue as to why it's not loading.

Another test I would recommend is entering your URL into this SSL Server Test. Sometimes this can let you know if there's an issue with your SSL certificate that you may not be aware of.

Finally, as Kian mentioned, make sure port 8444 is open, and that you have updated the connector in server.xml accordingly.

Feel free to share with us your settings so we can have a look and make sure everything is set up properly.

Regards,

Shannon

[Mark Everest]

.

[Mark Everest]

.

[Mark Everest]

.

[Mark Everest]

.

[Mark Everest]

.

[Mark Everest]

.

[Mark Everest]

.

[Kian Stack Mumo Systems]

Typically you'd want to run Confluence and Jira on separate machines to avoid any port issues and to dedicate the correct resources to each machine.

As for why you can't get it working, there could be different issues at play here. 

1) Did you validate that the server.xml has been changed to 8444?

2) Have you validated that 8444 is open?