Problems with HTTPS

[Martin Schmalz]

Hello.

im running Confluence 6.14.3 on HTTP in a docker-container and i want to migrate to https (same version for now).

i followed this guide (https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html) and after some cert-errors it worked, container was running.

after some days the container shut down - and now i cant bring it up again. if i deactivate the https-part in server.xml, server starts. if i change the ports (because only one is exposed), i can access http. there are no error-messages in the log files.  the starting-process goes on for about 1 minute, then the container crashes.

log-entrys are

09-Feb-2022 11:00:11.733 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server} Setting property 'debug' to '0' did not find a matching property.
09-Feb-2022 11:00:11.783 WARNING [main] org.apache.catalina.startup.SetAllPropertiesRule.begin [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'proxyPort' to '' did not find a matching property.
09-Feb-2022 11:00:11.784 WARNING [main] org.apache.catalina.startup.SetAllPropertiesRule.begin [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'debug' to '0' did not find a matching property.
09-Feb-2022 11:00:11.932 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine} Setting property 'debug' to '0' did not find a matching property.
09-Feb-2022 11:00:11.936 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'debug' to '0' did not find a matching property.
09-Feb-2022 11:00:11.961 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.
09-Feb-2022 11:00:11.975 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.
09-Feb-2022 11:00:12.089 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8095"]
09-Feb-2022 11:00:12.099 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
09-Feb-2022 11:00:12.104 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["https-jsse-nio2-8090"]
09-Feb-2022 11:00:12.284 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 609 ms
09-Feb-2022 11:00:12.290 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Tomcat-Standalone]
09-Feb-2022 11:00:12.290 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/9.0.12
09-Feb-2022 11:00:13.268 INFO [localhost-startStop-2] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
09-Feb-2022 11:00:13.510 INFO [localhost-startStop-2] org.apache.catalina.core.ApplicationContext.log Spring WebApplicationInitializers detected on classpath: [com.atlassian.synchrony.proxy.SynchronyDispatcherServletInitializer@7cc844c8]
09-Feb-2022 11:00:13.704 INFO [localhost-startStop-2] org.apache.catalina.core.ApplicationContext.log Initializing Spring FrameworkServlet 'dispatcher'
09-Feb-2022 11:00:13.705 INFO [localhost-startStop-2] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization started
09-Feb-2022 11:00:13.711 INFO [localhost-startStop-2] org.springframework.web.context.support.AnnotationConfigWebApplicationContext.prepareRefresh Refreshing WebApplicationContext for namespace 'dispatcher-servlet': startup date [Wed Feb 09 11:00:13 CET 2022]; root of context hierarchy
09-Feb-2022 11:00:13.754 INFO [localhost-startStop-2] org.springframework.web.context.support.AnnotationConfigWebApplicationContext.loadBeanDefinitions Registering annotated classes: [class com.atlassian.synchrony.proxy.websocket.WebSocketConfig,class com.atlassian.synchrony.proxy.web.SynchronyWebMvcConfig]
2022-02-09 11:00:13,892 INFO [localhost-startStop-1] [com.atlassian.confluence.lifecycle] contextInitialized Starting Confluence 6.14.3 [build 7901 based on commit hash 4635873c8e185dc5df37b4e2487dfbef570b5e2c] - synchrony version 2.1.0-master-9d112c9d
09-Feb-2022 11:00:14.123 INFO [localhost-startStop-2] org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler.initialize Initializing ExecutorService 'defaultSockJsTaskScheduler'
09-Feb-2022 11:00:14.167 INFO [localhost-startStop-2] org.springframework.web.socket.server.support.WebSocketHandlerMapping.registerHandler Mapped URL path [/v1/bayeux-sync1] onto handler of type [class org.springframework.web.socket.server.support.WebSocketHttpRequestHandler]
09-Feb-2022 11:00:14.452 INFO [localhost-startStop-2] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.initControllerAdviceCache Looking for @ControllerAdvice: WebApplicationContext for namespace 'dispatcher-servlet': startup date [Wed Feb 09 11:00:13 CET 2022]; root of context hierarchy
09-Feb-2022 11:00:14.521 INFO [localhost-startStop-2] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping.register Mapped "{[/healthcheck]}" onto public com.atlassian.synchrony.proxy.web.HealthCheckResult com.atlassian.synchrony.proxy.web.SynchronyProxyRestController.getSynchronyProxyInfo()
09-Feb-2022 11:00:14.522 INFO [localhost-startStop-2] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping.register Mapped "{[/reload],methods=[PUT]}" onto public org.springframework.http.ResponseEntity com.atlassian.synchrony.proxy.web.SynchronyProxyRestController.reloadConfiguration(com.atlassian.synchrony.proxy.web.SynchronyProxyConfigPayload)
09-Feb-2022 11:00:14.534 INFO [localhost-startStop-2] org.springframework.web.servlet.handler.SimpleUrlHandlerMapping.registerHandler Mapped URL path [/**] onto handler of type [class org.springframework.web.servlet.resource.DefaultServletHttpRequestHandler]
09-Feb-2022 11:00:14.609 INFO [localhost-startStop-2] org.springframework.context.support.DefaultLifecycleProcessor.start Starting beans in phase 2147483647
09-Feb-2022 11:00:14.627 INFO [localhost-startStop-2] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization completed in 922 ms
Starting to initialize Git4C Confluence Plugin components...

server.xml: (exposed https port is 443 -> 8090, http port is 8095 (not exposed), redirect is 8090)

<Connector port="8090" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25"
protocol="org.apache.coyote.http11.Http11Nio2Protocol"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2" SSLEnabled="true"
URIEncoding="UTF-8" keystorePass="<password>" keyAlias="tomcat" keystoreFile="/opt/java/openjdk/jre/lib/security/cacerts"/>

• changed the shutdown-port... no effect
• deleted the lock-file... no effect
• web.xml is untouched
• certificat is in cacarts PrivateKeyEntry 
• keyalias is correct
• certificate is from the company (intranet), recieved as a p12-file and was combined with the cacerts from confluence (works in dev container)
• dev and prod container running on same server (port 8443 and 443)
• container have different local volumes 

the same setup in another container (prod and dev) is working.  but also not everytime. sometimes i start the container and it crashes on the same point. then the container restarts and everyting is fine

[Pramodh M]

Hi @Martin Schmalz 

Did you make the certificate trusted in the Keystore?

Using an external proxy is the recommended approach here

Here's a similar post I found that might help you

https://confluence.atlassian.com/jirakb/set-ssl-using-docker-container-1014274479.html

Thanks,
Pramodh