TLS handshake timed out

[Lukas Blauensteiner]

Hy guys,

I followed this article (https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html - Option 2) to install a valid certificate from my CA.

The import of my crt file (step 5) was successfully done, but when I try to call my Confluence website the connection times out.

My confluence server is a Ubuntu 18.04 with inactive Firewall.

I edited the server base url, and server.xml as mentioned in the article:

server.xml:

<Server port="8000" shutdown="SHUTDOWN" debug="0">
<Service name="Tomcat-Standalone">
<!--
==============================================================================================================
DEFAULT - Direct connector with no proxy, for unproxied HTTP access to Confluence.

If using a http/https proxy, comment out this connector.
==============================================================================================================
-->
<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
maxThreads="48" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
protocol="org.apache.coyote.http11.Http11NioProtocol"/>
<!--
==============================================================================================================
HTTP - Proxying Confluence via Apache or Nginx over HTTP

If you're proxying traffic to Confluence over HTTP, uncomment the connector below and comment out the others.
Make sure you provide the right information for proxyName and proxyPort.

For more information see:
Apache - https://confluence.atlassian.com/x/4xQLM
nginx - https://confluence.atlassian.com/x/TgSvEg

==============================================================================================================
-->

<!--
<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
maxThreads="48" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
protocol="org.apache.coyote.http11.Http11NioProtocol"
scheme="http" proxyName="<subdomain>.<domain>.com" proxyPort="80"/>
-->

<!--
==============================================================================================================
HTTPS - Direct connector with no proxy, for unproxied HTTPS access to Confluence.

For more info see https://confluence.atlassian.com/x/s3UC
==============================================================================================================
-->

<Connector port="8443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25"
protocol="org.apache.coyote.http11.Http11NioProtocol"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" SSLEnabled="true"
URIEncoding="UTF-8" keyAlias="tomcat" keystoreFile="/root/.keystore" keystorePass=<MY_KEYSTORE_PW> />

<!--
==============================================================================================================
HTTPS - Proxying Confluence via Apache or Nginx over HTTPS

If you're proxying traffic to Confluence over HTTPS, uncomment the connector below and comment out the others.
Make sure you provide the right information for proxyName and proxyPort.

For more information see:
Apache - https://confluence.atlassian.com/x/PTT3MQ
nginx - https://confluence.atlassian.com/x/cNIvMw
==============================================================================================================
-->

<!--
<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
maxThreads="48" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
protocol="org.apache.coyote.http11.Http11NioProtocol"
scheme="https" secure="true" proxyName="<subdomain>.<domain>.com" proxyPort="443"/>
-->

<Engine name="Standalone" defaultHost="localhost" debug="0">
<Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false" startStopThreads="4">
<Context path="" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true">
<!-- Logging configuration for Confluence is specified in confluence/WEB-INF/classes/log4j.properties -->
<Manager pathname=""/>
<Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60"/>
</Context>

<Context path="${confluence.context.path}/synchrony-proxy" docBase="../synchrony-proxy" debug="0"
reloadable="false" useHttpOnly="true">
<Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60"/>
</Context>
</Host>
</Engine>
</Service>
</Server>

The CN of the certificate from my CA is equal to the server base URL I want to access.

With connector port 8090 I can login to Confluence.

[Kurt Engle]

I have been having the same issue after an upgrade to my Confluence server from 6.3.2 to 6.15.1. I am using an internal private CA. My keystore is JKS and is found at the normal location /opt/atlassian/confluence/jre/lib/security/cacerts. I began with standard 'server' cert and set the CN to be the FQDN of my server. This caused the SSL handshake to fail after the 'Client HELLO'. The server never sent a 'Server HELLO'. I created a new SAN cert and specified SAN to be the FQDN and specified the static IP address of my server as well. Imported that puppy into the ./cacerts file and restarted Confluence and it worked. This is with a JKS keystore. 

However, when I run 'keytool' against my keystore, it tells me that I need to change to a PKCS12 keystore. I tried that and did not have good results. I was able to connect to Confluence over HTTPS but was not able to link to Jira or Active Directory over HTTPS/LDAPS. I would get a 'trustAnchor parameter not set' error. Working with Atlassian to trouble shoot, but no solution as of yet.

[Lukas Blauensteiner]

Hey, thanks for your reply.

My solution was to build a apache proxy redirection to the tomcat port, so I was able to use our wildcard certificate within the apache vhost, and a establish a LDAPs connection to our AD.