Non-FQDN requests with SSL not working

[Matthias Fleschütz]

I set up our Confluence server with SSL following mainly https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html (except using a CSR with our own internal CA). The certificate is valid for the configured base URL as well as DNS aliases (shortname without FQDN domain).

I also set up a HTTP to HTTPS redirect within tomcat, using https://community.atlassian.com/t5/Confluence-questions/Confluence-Redirect-HTTP-Requests-to-HTTPS/qaq-p/219942

After everything works I changed the base URL from http://confluence.my.domain.com to https://confluence.my.domain.com

My issue:

Everything works fine when using the FQDN (long base URL).

Confluence behaves strange when using the short DNS alias (https://confluence/):

• Home is showing well
• Space homes have no menu anymore
• Page editor will not load
• ...

We tried this with different browsers, cleaned cache/cookies and so on.

Any idea? I just wanted to avoid setting up a reverse proxy just for DNS alias resolving.

Best,

Matthias

[JP _AC Bielefeld Leader_ · Accepted solution]

Well,

you are terminating SSL directly at the application server. I assume you're using the latest Confluence version 6.12.x

You need a rewrite rule to rewrite your short name to rewrite to the base URL, otherwise your users will run into problems. 

With Tomcat 9 you could try:

https://tomcat.apache.org/tomcat-9.0-doc/rewrite.html

My best practice is to terminate SSL at the front end proxy (Apache, ngnix) and reverse proxy to Confluence / Jira by AJP protocol: Easier, more flexible setup, can run on the same and/or different machine.

Best

JP

[Matthias Fleschütz]

Hi JP,

we have 6.11.2 running. 

Your suggestion would mean, that everything would work fine, when I change the baseurl of my installation to the non-FQDN short version https://confluence instead of https://confluence.my.domain.com

Unfortunately the behaviour is the same, even when changing baseURL and restarting.
What makes it even more strange is that the problem only occur with fixed URLs (e.g. https://confluence/display/SPACE by accessing via menu / navigation). When accessing via breadcrumps it works as the links are like https://confluence/pages/viewpage.action?pageId=4128873...

If it would be just a baseurl problem, I would assume that the problem should occur always, not only with fixed URLs and that it should be solved by changing baseurl.

Best,

Matthias

[JP _AC Bielefeld Leader_]

Your SSL cert is only working correctly for  https://confluence.my.domain.com/... and not https://confluence/.... As Confluence accesses certain URLs internally by using the base (matching the SSL cert) URL there might be certificate errors or other unforeseen behavior.

Do the logs tell you anything? (application & tomcat)

Best

JP

[Matthias Fleschütz]

As we have created the certificate with SAN extension for all our long and short URLs it is working. The certificate chain is also working and checked OK internally as our internal CA is imported in the given truststore and Javas lib/security/cacerts as well. Before I did the last one I had PKIX errors in the log. The clients handle the certificate quite good aswell.

catalina log doesn't have any error at all.

atlassian-confluence logs tells:

2018-10-17 19:46:49,238 ERROR [pool-11-thread-2] [atlassian.hibernate.util.ThreadSafeCheckingSessionEventListener] checkThread Session called from wrong thread
 -- url: /pages/viewpage.action | page: 4128873 | traceId: df92d3d13125bddd | userName: firstname.lastnae@domain.com | referer: https:/confluence/display/RnD/Asana+Plugin+Test | action: viewpage
java.lang.Exception
 at com.atlassian.hibernate.util.ThreadSafeCheckingSessionEventListener.checkThread(ThreadSafeCheckingSessionEventListener.java:125)
 at com.atlassian.hibernate.util.ThreadSafeCheckingSessionEventListener.cacheGetStart(ThreadSafeCheckingSessionEventListener.java:79)
 at org.hibernate.engine.internal.SessionEventListenerManagerImpl.cacheGetStart(SessionEventListenerManagerImpl.java:181)
 at org.hibernate.engine.internal.CacheHelper.fromSharedCache(CacheHelper.java:30)
 at org.hibernate.event.internal.DefaultLoadEventListener.getFromSharedCache(DefaultLoadEventListener.java:651)
 at org.hibernate.event.internal.DefaultLoadEventListener.loadFromSecondLevelCache(DefaultLoadEventListener.java:595)
 at org.hibernate.event.internal.DefaultLoadEventListener.doLoad(DefaultLoadEventListener.java:462)
 at org.hibernate.event.internal.DefaultLoadEventListener.load(DefaultLoadEventListener.java:219)
 at org.hibernate.event.internal.DefaultLoadEventListener.doOnLoad(DefaultLoadEventListener.java:116)
 at org.hibernate.event.internal.DefaultLoadEventListener.onLoad(DefaultLoadEventListener.java:89)
 at org.hibernate.internal.SessionImpl.fireLoad(SessionImpl.java:1230)
 at org.hibernate.internal.SessionImpl.immediateLoad(SessionImpl.java:1088)
 at org.hibernate.proxy.AbstractLazyInitializer.initialize(AbstractLazyInitializer.java:155)
 at org.hibernate.proxy.AbstractLazyInitializer.getImplementation(AbstractLazyInitializer.java:259)
 at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:73)
 at com.atlassian.hibernate.adapter.proxy.JavassistLazyInitializer_ImplementV2Proxy.invoke(JavassistLazyInitializer_ImplementV2Proxy.java:68)
 at com.atlassian.confluence.spaces.Space_$$_jvst95e_7.getKey(Space_$$_jvst95e_7.java)
 at com.atlassian.confluence.core.SpaceContentEntityObject.getSpaceKey(SpaceContentEntityObject.java:45)
 at com.atlassian.confluence.util.ContentUtils.getSpaceKeyFromCeo(ContentUtils.java:76)
 at com.atlassian.confluence.renderer.PageContext.getSpaceKey(PageContext.java:155)
 at com.atlassian.confluence.content.render.xhtml.DefaultConversionContext.getSpaceKey(DefaultConversionContext.java:268)
 at com.comalatech.confluence.workflow.transformer.UpdateMacroDefinitionsTransformer.transform(UpdateMacroDefinitionsTransformer.java:64)
 at com.comalatech.confluence.workflow.transformer.AbstractTransformer.transform(AbstractTransformer.java:24)
 at com.atlassian.confluence.content.render.xhtml.TransformerChain.transform(TransformerChain.java:33)
 at com.atlassian.confluence.content.render.xhtml.PluggableTransformerChain.transform(PluggableTransformerChain.java:39)
 at com.atlassian.confluence.content.render.xhtml.DefaultRenderer.renderWithoutMetrics(DefaultRenderer.java:194)
 at com.atlassian.confluence.content.render.xhtml.DefaultRenderer.renderWithResult(DefaultRenderer.java:153)
 at com.atlassian.confluence.content.render.xhtml.DefaultRenderer.render(DefaultRenderer.java:134)
 at com.atlassian.confluence.content.render.xhtml.DeviceTypeAwareRenderer.render(DeviceTypeAwareRenderer.java:55)
 at com.atlassian.confluence.content.render.xhtml.DefaultXhtmlContent.convertStorageToView(DefaultXhtmlContent.java:135)
 at sun.reflect.GeneratedMethodAccessor804.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.util.ContextClassLoaderSettingInvocationHandler.invoke(ContextClassLoaderSettingInvocationHandler.java:26)
 at com.sun.proxy.$Proxy422.convertStorageToView(Unknown Source)
 at sun.reflect.GeneratedMethodAccessor804.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.osgi.bridge.external.HostComponentFactoryBean$DynamicServiceInvocationHandler.invoke(HostComponentFactoryBean.java:136)
 at com.sun.proxy.$Proxy422.convertStorageToView(Unknown Source)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.renderDetailRows(DetailsSummaryBuilder.java:328)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.lambda$renderDetailRowsWithTransaction$6(DetailsSummaryBuilder.java:296)
 at com.atlassian.sal.core.transaction.HostContextTransactionTemplate$1.doInTransaction(HostContextTransactionTemplate.java:21)
 at com.atlassian.sal.spring.component.SpringHostContextAccessor$1.doInTransaction(SpringHostContextAccessor.java:71)
 at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:133)
 at com.atlassian.sal.spring.component.SpringHostContextAccessor.doInTransaction(SpringHostContextAccessor.java:68)
 at com.atlassian.confluence.spring.transaction.interceptor.ConfluenceSpringHostContextAccessor.access$001(ConfluenceSpringHostContextAccessor.java:21)
 at com.atlassian.confluence.spring.transaction.interceptor.ConfluenceSpringHostContextAccessor.lambda$doInTransaction$3(ConfluenceSpringHostContextAccessor.java:72)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContextInternal(VCacheRequestContextManager.java:87)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContext(VCacheRequestContextManager.java:71)
 at com.atlassian.confluence.spring.transaction.interceptor.ConfluenceSpringHostContextAccessor.doInTransaction(ConfluenceSpringHostContextAccessor.java:72)
 at sun.reflect.GeneratedMethodAccessor237.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.util.ContextClassLoaderSettingInvocationHandler.invoke(ContextClassLoaderSettingInvocationHandler.java:26)
 at com.sun.proxy.$Proxy316.doInTransaction(Unknown Source)
 at sun.reflect.GeneratedMethodAccessor237.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.osgi.bridge.external.HostComponentFactoryBean$DynamicServiceInvocationHandler.invoke(HostComponentFactoryBean.java:136)
 at com.sun.proxy.$Proxy316.doInTransaction(Unknown Source)
 at com.atlassian.sal.core.transaction.HostContextTransactionTemplate.execute(HostContextTransactionTemplate.java:18)
 at sun.reflect.GeneratedMethodAccessor238.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invokeUnprivileged(ServiceTCCLInterceptor.java:70)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invoke(ServiceTCCLInterceptor.java:53)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)
 at com.sun.proxy.$Proxy1489.execute(Unknown Source)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.renderDetailRowsWithTransaction(DetailsSummaryBuilder.java:296)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.lambda$null$4(DetailsSummaryBuilder.java:265)
 at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1590)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)

and

2018-10-17 19:45:55,787 ERROR [AtlassianEvent::CustomizableThreadFactory-1] [renderer.internal.http.HttpClientFetcher] fetch Unable to perform a request to: https://kms/rest/gadgets/1.0/g/messagebundle/und/gadget.common%2Cgadget.activity.stream
org.apache.http.conn.ConnectTimeoutException: Connect to confluence:443 [confluence/1.2.3.4] failed: Read timed out
 at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)
 at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373)
 at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
 at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
 at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
 at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
 at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
 at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
 at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
 at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
 at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
 at com.atlassian.gadgets.renderer.internal.http.WhitelistAwareHttpClient.execute(WhitelistAwareHttpClient.java:49)
 at com.atlassian.gadgets.renderer.internal.http.ShindigApacheClientAdapter.execute(ShindigApacheClientAdapter.java:41)
 at com.atlassian.gadgets.renderer.internal.http.HttpClientFetcher.fetch(HttpClientFetcher.java:47)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.fetchBundle(DefaultMessageBundleFactory.java:138)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getNestedBundle(DefaultMessageBundleFactory.java:111)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getBundle(DefaultMessageBundleFactory.java:79)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getParentBundle(DefaultMessageBundleFactory.java:124)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getNestedBundle(DefaultMessageBundleFactory.java:101)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getBundle(DefaultMessageBundleFactory.java:79)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getParentBundle(DefaultMessageBundleFactory.java:127)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getNestedBundle(DefaultMessageBundleFactory.java:101)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getBundle(DefaultMessageBundleFactory.java:79)
 at org.apache.shindig.gadgets.variables.VariableSubstituter.substitute(VariableSubstituter.java:47)
 at com.atlassian.gadgets.renderer.internal.GadgetSpecFactoryImpl.getGadgetSpec(GadgetSpecFactoryImpl.java:127)
 at com.atlassian.gadgets.renderer.internal.GadgetSpecFactoryImpl.getGadgetSpec(GadgetSpecFactoryImpl.java:83)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invokeUnprivileged(ServiceTCCLInterceptor.java:70)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invoke(ServiceTCCLInterceptor.java:53)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)
 at com.sun.proxy.$Proxy1937.getGadgetSpec(Unknown Source)
 at com.atlassian.confluence.plugins.gadgets.metadata.GadgetsMacroMetadataProvider.getGadgetSpecs(GadgetsMacroMetadataProvider.java:193)
 at com.atlassian.confluence.plugins.gadgets.metadata.GadgetsMacroMetadataProvider.getMacroMetadata(GadgetsMacroMetadataProvider.java:89)
 at com.atlassian.confluence.plugins.gadgets.metadata.CachingGadgetsMacroMetadataProvider.loadOnMiss(CachingGadgetsMacroMetadataProvider.java:168)
 at com.atlassian.vcache.internal.core.metrics.TimedSupplier.get(TimedSupplier.java:32)
 at com.atlassian.vcache.internal.legacy.LegacyJvmCache.lambda$get$4(LegacyJvmCache.java:52)
 at java.util.Optional.orElseGet(Optional.java:267)
 at com.atlassian.vcache.internal.legacy.LegacyJvmCache.get(LegacyJvmCache.java:50)
 at com.atlassian.vcache.internal.core.metrics.TimedLocalCacheOperations.get(TimedLocalCacheOperations.java:64)
 at com.atlassian.confluence.plugins.gadgets.metadata.CachingGadgetsMacroMetadataProvider.getData(CachingGadgetsMacroMetadataProvider.java:133)
 at com.atlassian.confluence.macro.browser.DefaultMacroMetadataManager.buildMacroMetadata(DefaultMacroMetadataManager.java:144)
 at com.atlassian.confluence.macro.browser.DefaultMacroMetadataManager.onPluginFrameworkStartedEvent(DefaultMacroMetadataManager.java:72)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.event.internal.SingleParameterMethodListenerInvoker.invoke(SingleParameterMethodListenerInvoker.java:40)
 at com.atlassian.confluence.event.ConfluenceListenerHandlersConfiguration$TimingListenerHandler$1$1.invoke(ConfluenceListenerHandlersConfiguration.java:69)
 at com.atlassian.confluence.event.ConfluenceEventDispatcher$VCacheRequestContextRunnableFactory$1.lambda$run$0(ConfluenceEventDispatcher.java:93)
 at com.atlassian.confluence.vcache.VCacheRequestContextOperations.lambda$doInRequestContext$0(VCacheRequestContextOperations.java:50)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContextInternal(VCacheRequestContextManager.java:87)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContext(VCacheRequestContextManager.java:71)
 at com.atlassian.confluence.vcache.VCacheRequestContextOperations.doInRequestContext(VCacheRequestContextOperations.java:49)
 at com.atlassian.confluence.event.ConfluenceEventDispatcher$VCacheRequestContextRunnableFactory$1.run(ConfluenceEventDispatcher.java:93)
 at com.atlassian.confluence.event.ConfluenceEventDispatcher$1.run(ConfluenceEventDispatcher.java:61)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)

[Matthias Fleschütz]

Hi JP,

before playing around and get stucked in more unlogic Confluence architecture I decided to follow your hint by using Tomcat redirect...works great.

Although it is really disappointing that Confluence can't handle it in another way as now we have one update-problematic component more :-(

Thanks,

Matthias