Question related to confluence https/ssl encryption

[ujkimbitbucket]

I have a question about https/ssl encryption.

I want to change http protocol to https protocol.

I find your manual about issue (I refer to site https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html)

I made a SSL certificate from ROOT CA and I inserted certificate contents to .keystore file.

( If you perform the -importcert option procedure with the generated keystore file after performing step 1, the following error occurs.

keytool error: java.lang.Exception: Public keys in reply and keystore don't match

=> (I clearly insert the same password...)

So I did not do step 1, I did it by putting crt file(ssl certificate) in keystore file) )

I followed the command below.

keytool -importcert -alias tomcat -keystore <MY_KEYSTORE_FILENAME> -file <MY_CERTIFICATE_FILENAME>

The rest of procedure(for confluence launching) was followed out according to your manual. but when confluence service launch, https accessing failed.

I don't know why is not accessing.

Can I get some proof to solve this problem?

[AnnWorley]

Hi -

You mentioned you followed the instructions for launching Confluence after importing the certificate into the keystore file. Did you also make the changes to the server.xml file as part of that process? Step 2. Modify your Confluence server.xml file I would paste the instructions here but they are extensive.

I would like to let you know about another SSL tool besides keytool that may be of help to avoid or better interpret the errors you are seeing when you use keytool: Portecle

Please let me know more details about the instance being inaccessible over https. For example, does it mean the instance is still reachable over http or does it mean it's inaccessible altogether when you have the https connector in the server.xml?

Looking forward to hearing more about your case.

Thanks,

Ann

[ujkimbitbucket]

Thank you for your reply Ann Worley!

First, according to your advice, I followed Step 2.

Thanks for the advice on the key tool.

The test results show that the Confluence response time out. I expected it to be output to an unsafe site, but no.

Apart from the above results, I tried to register on another test website to check my certificate issue. As a result, the website is marked as unsafe and printed.

Based on the above results, I do not think this is a certificate problem.

In addition, there is one question not related to this phenomenon.

I've done a procedure to get a certificate from Let's encrypt site to get a certificate from.

Confluence has access to http://<domain>:Port, which is not accessible in that way. The site did not seem to recognize the port as a domain. Is there a way to configure Confluence to allow access without port information? (I was considering Reversy Proxy configuration here, wondering if that's the right direction)

The last question I asked was because this phenomenon seemed relevant.

(My Confluence environment is linux (Cent OS 7))

Best Regards,

Ui-joong Kim