Problems with linking confluence with JIRA when using https and SSL-offloading

[Christoph Maaß]

Hello community!

We're running JIRA and Confluence on the same virtual machine on the default ports. We're using SSL-Offloading to make JIRA and confluence accessible via HTTPS for our users in our internal company network. 

Our problem is now: 

The applications each for themselves are reachable via the client's browsers over https (we configured the server.xml files). But when we're now trying to link confluence with jira it asks for jira's base URL (which is eg https://company.tld). It says that the connection couldn't be established, due to the fact that we use SSL-offloading the server can't reach applications via https within our data center. 

When we try http://localhost:8080 as jira's base URL in this step, it also can't reach JIRA (because JIRA is configured to use https connector in its server.xml and https://company.tld als its base URL).

Any ideas how we have to configure JIRA or confluence to fix this issue? Anyone who has the same configuration?

Thank you all in advance!

Best regards, Christoph

[Andy Heinzer]

Hi Christoph,

If I understand the problem here, you appear to be having some problems with having Confluence and Jira communicate with each other over SSL here. 

You could try to bypass the proxy and SSL setting here to try to get around this issue.  There is a guide on how to do this for Jira over in Bypass a proxy or SSL to test network connectivity for Jira server.  The suggestion of this article is not to try to use port 8080 itself as you know it's already being used for the SSL connection, so instead you can create another unique port in the server.xml and then try to have confluence direct connect to that port instead.  You could also repeat those steps in Confluence as well (but if you do be sure to pick another unique port).

Although, this approach might not be ideal.  I would be interested to try to understand why when Confluence attempts to reach Jira on the HTTPS address that this traffic is not being routed through the load balancer that handles SSL.  If it was, then we could have a better expectation that each application will behave much like clients have to in terms of the traffic routed to them.

Another common cause for these kinds of connection failures is that if Jira and Confluence have separate JVM host that the certificates for each application (Jira) might not exist in the truststore of the other application  (Confluence).  When this happens the application won't trust the connection and you tend to see errors in the logs of a nature such as 'PKIX path building failed'.  Since you mentioned Jira and Confluence are on the same machine, have you set the $JAVA_HOME variable on the system?  If you have then each application will be using the same truststore, but if you have not, then I'd expect each app to have its own.   There are steps you can follow in How to import a public SSL certificate into a JVM to avoid that error.

Let me know if you have any questions or concerns about this.

Andy