How to run Jira server over https

[Fayaz Abdul]

Hi team,

I am trying to run Jira over https where i have cert files and followed this link https://confluence.atlassian.com/kb/securing-your-atlassian-applications-with-apache-using-ssl-838284349.html, but it's giving 503 error. And i have checked that https certificates are valid and locked with green.

server.xml

<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
acceptCount="100" disableUploadTimeout="true" bindOnInit="false" secure="true" scheme="https"
proxyName="global-jira.tafzs.com" proxyPort="443"/>

httpd/ssl.conf

<VirtualHost *:443>
ServerName global-jira.tafzs.com

ProxyRequests Off

<Proxy *>
Require all granted
</Proxy>

ProxyPass / http://global-jira.tafzs.com:8080/
ProxyPassReverse / http://global-jira.tafzs.com:8080/

SSLEngine On
SSLCertificateFile /etc/letsencrypt/live/global-jira.tafzs.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/global-jira.tafzs.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/global-jira.tafzs.com/chain.pem
</VirtualHost>

<VirtualHost *:80>
ServerName global-jira.tafzs.com
Redirect Permanent / https://global-jira.tafzs.com/
</VirtualHost>

Thanks

Fayaz

[Fayaz Abdul · Accepted solution]

Hi @Jack Nolddor _Sweet Bananas_ 

I have solved my problem by changing below in /etc/selinux/config:

SELINUX=disabled 

And restarted my apache in my centos server:

systemctl restart httpd

Thanks

Fayaz

[Jack Nolddor _Sweet Bananas_]

Hi and welcome,

Is Apache Httpd reverse proxy in the same machine as Jira is located or in a different machines?

You should change:

ProxyPass / http://global-jira.tafzs.com:8080/
ProxyPassReverse / http://global-jira.tafzs.com:8080/

To

ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/

Supossing both are in the same machine, if not please type the IP of the Jira machine.

In Addition, here is a complete httpd configuration of my PROD env, hope this helps:

<Virtualhost *:80>
    ServerName jira.mycompany.com
    Redirect permanent / https://jira.mycompany.com/
</Virtualhost>

<Virtualhost *:443>
    ServerName jira.mycompany.com
    SSLEngine On
    SSLProxyEngine On
    ProxyPass / http://127.0.0.1:8080/ connectiontimeout=5 timeout=300
    ProxyPassReverse / http://127.0.0.1:8080/
    SSLCertificateFile /etc/httpd/ssl/STAR.mycompany.COM.crt
    SSLCertificateKeyFile /etc/httpd/ssl/STAR.mycompany.COM.key
    SSLCACertificateFile /etc/httpd/ssl/OV_NetworkSolutionsOVServerCA2.crt
</Virtualhost>

Does it work?
Regards

[Fayaz Abdul]

Hi @Jack Nolddor _Sweet Bananas_ 

I got an error /opt/atlassian/jira/logs/catalina.out

http-nio-8080-exec-17 ERROR anonymous 735x23x1 - 35.177.238.18 /plugins/servlet/gadgets/dashboard-diagnostics [c.a.g.d.internal.diagnostics.DiagnosticsServlet] DIAGNOSTICS: FAILED
com.atlassian.gadgets.dashboard.internal.diagnostics.UrlSchemeMismatchException: Detected URL scheme, 'https', does not match expected scheme 'http'
at com.atlassian.gadgets.dashboard.internal.diagnostics.Diagnostics.checkExpectedScheme(Diagnostics.java:52)
at com.atlassian.gadgets.dashboard.internal.diagnostics.Diagnostics.check(Diagnostics.java:31)
at com.atlassian.gadgets.dashboard.internal.diagnostics.DiagnosticsServlet.executeDiagnostics(DiagnosticsServlet.java:82)
at com.atlassian.gadgets.dashboard.internal.diagnostics.DiagnosticsServlet.doPost(DiagnosticsServlet.java:58)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at com.atlassian.plugin.servlet.DelegatingPluginServlet.service(DelegatingPluginServlet.java:37)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at com.atlassian.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:45)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
... 44 filtered
at com.atlassian.servicedesk.internal.web.ExternalCustomerLockoutFilter.doFilter(ExternalCustomerLockoutFilter.java:56)
... 13 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 58 filtered
at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66)
... 1 filtered
at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64)
... 36 filtered
at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30)
... 5 filtered
at com.atlassian.servicedesk.internal.web.CustomerContextSettingFilter.lambda$invokeFilterChain$0(CustomerContextSettingFilter.java:181)
at com.atlassian.servicedesk.internal.api.util.context.ReentrantThreadLocalBasedCodeContext.rteInvoke(ReentrantThreadLocalBasedCodeContext.java:137)
at com.atlassian.servicedesk.internal.api.util.context.ReentrantThreadLocalBasedCodeContext.runOutOfContext(ReentrantThreadLocalBasedCodeContext.java:90)
at com.atlassian.servicedesk.internal.utils.context.CustomerContextServiceImpl.runOutOfCustomerContext(CustomerContextServiceImpl.java:47)
at com.atlassian.servicedesk.internal.web.CustomerContextSettingFilter.outOfCustomerContext(CustomerContextSettingFilter.java:174)
at com.atlassian.servicedesk.internal.web.CustomerContextSettingFilter.doFilterImpl(CustomerContextSettingFilter.java:130)
at com.atlassian.servicedesk.internal.web.CustomerContextSettingFilter.doFilter(CustomerContextSettingFilter.java:121)
... 4 filtered
at com.atlassian.jwt.internal.servlet.JwtAuthFilter.doFilter(JwtAuthFilter.java:32)
... 8 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 4 filtered
at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36)
... 26 filtered
at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25)
... 24 filtered
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

And after configure, when i tried my Jira link with http:And also when i tried my Jira link with http:

Please let me know what's wrong i did and how to solve it?

Thanks
Fayaz

[Jack Nolddor _Sweet Bananas_]

Have you correctly Configuring the Server Base URL in the UI?

If you cannot log in to the application, you can also Manually Change The Base URL.

[Fayaz Abdul]

@Jack Nolddor _Sweet Bananas_ 

Is this necessary to give context like /jira?

[Jack Nolddor _Sweet Bananas_]

No, application context is optional.

[Fayaz Abdul]

Hi @Jack Nolddor _Sweet Bananas_ 

I have solved my problem.

Thanks

Fayaz