How do I configure a new instance of Bitbucket server 6.2 with SSL?

[Aram Ghanimian]

This is a new bitbucket server. I was able to go through atlassian documentation to set up the server without ssl. I am trying to get it to run over ssl but with no luck. Here are my parameters that I am trying to use for my bitbucket.properties file:

server.require-ssl=true
server.additional-connector.1.port=7990
server.additional-connector.1.redirect-port=443
server.port=7990
server.connection-timeout=20000
server.redirect-port=443
server.compression.mime-types=text/css,text/html,text/javascript,text/json,text/plain,text/xml,text/x-javascript,\application/javascript,application/json,application/x-javascript,application/vnd.git-lfs+json
server.secure=true
server.ssl.enabled=true
server.ssl.key-alias=salesgit
server.ssl.key-store=d:/keystore/salesgit-keystore.jks
server.ssl.key-store-password=XXXXXXXX
server.ssl.protocol=TLSv1.2
server.ssl.key-store-type=jks
server.ssl.client-auth=need
server.address=X.X.X.X

As a reminder, this is not a migration. This is a new instance.

I am running this as a windows service. So when I try to start the service, it stops after about 30 seconds. 

The error I get states that the service failed to start on port 7990:

Caused by: org.springframework.boot.web.embedded.tomcat.ConnectorStartFailedException: Connector configured to listen on port 7990 failed to start

Any assistance is greatly appreciated.

[Stephen Sifers · Accepted solution]

Hello Aram,

The error you provided along with your properties file does tell us something is wrong with your SSL configuration. The first step I would take to verify there isn’t another configuration issue would be to restore your properties file back to default and only add in the following lines to the file:

server.port=8443
server.ssl.enabled=true
server.ssl.key-store=/path/to/keystore/bitbucket.jks
server.ssl.key-store-password=<password value>
server.ssl.key-password=<password value>

Source documentation: To configure HTTPS-only access to Bitbucket Server

Once these lines have been added attempt to start Bitbucket again and see if the same error is present. If not, then proceed to add the additional items you have within the properties file until you run into an error. If you’re still getting the error with only these 5 lines present then please let us know.

Regards,
Stephen Sifers

[Aram Ghanimian]

Hi Stephen,

I haven't been able to apply the requested changes. I can tell you that I tried what the document suggested at its barebones. I.e. the server.port property was set to 443. When I did that, bitbucket wouldn't start. The error simply states it could not find the port. I will let you know the results of what you suggested this week. Many thanks for taking a look at this.

-Aram

[Aram Ghanimian]

Hi Stephen,

I have a maintenance window today for this bitbucket server instance at 2:00 PDT today. I'll keep you posted on the changes.

[Aram Ghanimian]

Here are the results of the change with your suggested bitbucket.properties tags:

2019-06-12 16:17:15 Commons Daemon procrun stderr initialized
Exception in thread "main" nTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:48)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:87)
at com.atlassian.bitbucket.internal.launcher.BitbucketServerLauncher.start(BitbucketServerLauncher.java:151)
at com.atlassian.bitbucket.internal.launcher.BitbucketServerLauncher.main(BitbucketServerLauncher.java:99)
Caused by: org.springframework.boot.web.embedded.tomcat.ConnectorStartFailedException: Connector configured to listen on port 443 failed to start
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.checkConnectorHasStarted(TomcatWebServer.java:232)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.checkThatConnectorsHaveStarted(TomcatWebServer.java:224)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:202)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.startWebServer(ServletWebServerApplicationContext.java:311)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.finishRefresh(ServletWebServerApplicationContext.java:164)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:549)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:142)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:775)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:397)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:316)
at com.atlassian.bitbucket.internal.boot.BitbucketServerApplication.start(BitbucketServerApplication.java:247)
at com.atlassian.bitbucket.internal.boot.BitbucketServerApplication.main(BitbucketServerApplication.java:82)
... 8 more

[Aram Ghanimian]

Hi Stephen,

I resolved my issue. I don't know if its a big forehead smack, but here is what I did.

1. allowed 443 for TCP inbound in the local firewall

2. restarted the server

3. modified bitbucket properties to include one more line: server.ssl.key-alias=<keystore alias>

4. restarted the bitbucket 6.2 service. I noticed it didn't automatically stop.

5. checked if 443 was listening. It was.

6. Bitbucket started up successfully. All certificates and ssl applied.

I am not sure If I am missing anything else or any best practices I should cover for bitbucket server. If you know of any that I can apply, I'd be grateful.

-Aram