API with HTTP

[Aviv Cohen]

Hi all,

We moved our staging Jira machine to HTTPS (8443) with RootCA certificate recently 

For some reason Rest API still accessible only with HTTP on port 8080. How it can be changed to work with HTTPS ? Is it a must ?

It's important for me to understand because we're using servers out of our domain 

Any idea?

10x in advance ! 

[Aviv Cohen]

@josh it works ! Tnx man

BUT:

1. My redirect configuration is not working now from HTTP port 80 to HTTPS port 8443
2. I took the name that I mentioned before from my FQDN

[Josh Steckler]

Is port 80 currently redirecting to 8080? I'm curious how that is occurring if it is.

Honestly the most robust method for securing Atlassian applications is to use a web server & proxy in front of Jira. That way Apache (or any other web server) could handle the redirects, and you'd be able to use port 443 on linux.

https://confluence.atlassian.com/adminjiraserver071/integrating-jira-with-apache-using-ssl-802593043.html

This is what I do. My only server.xml connector listens on port 8081.

Then on apache, I listen on 80, 8080 and 443. 80 and 8080 rewrite to https and the proxy. I understand that this is another piece of overhead to administer but it's ultimately going to provide you the most functionality and speed. Apache is better than Tomcat at SSL resolution.

[Aviv Cohen]

Is port 80 currently redirecting to 8080? I'm curious how that is occurring if it is.

Sorry I meant port 8080

[Josh Steckler]

Ah OK.

https://confluence.atlassian.com/adminjiraserver070/running-jira-applications-over-ssl-or-https-749383630.html#RunningJIRAapplicationsoverSSLorHTTPS-Advancedconfiguration

See step 5 under Advanced Configuration, subsection "Update Tomcat with Keystore"

If redirection to HTTPS will be used (this is recommended), edit the <JIRA_INSTALL>/WEB-INF/web.xml file and add the following section at the end of the file, before the closing </web-app>. In this example, all URLs except attachments are redirected from HTTP to HTTPS.

[Aviv Cohen]

Ok .... I'm familiar with that 

I'll get back to you if problems pops :) 

@josh 10x a lot man !!! All the best 

[Josh Steckler]

Thanks, this is what I thought. 

Are you getting certificate errors in the browser? Bypassing them perhaps?

Or maybe your organization has added the root CA to the trust store on your computer, which would bypass this as well.

You may need to add the ca cert to the trust store on the system you're using to bypass the error. Most scripting http libraries have an option to override errors, and cURL does too, using the -k option mentioned in the error message.

If you are using a self-signed certificate, the best solution may be to purchase a trusted certificate from a reputable vendor. 

[Aviv Cohen]

This will be useful for me in the next phase

At this point, I want to understand why I can use HTTP port 8080 when using the REST API while the server configured to be HTTPS port 8443 (in my local machine in IT domain)

the CURL looks as follows: 

curl -k -D- -u user:key -X POST --data @path_to_json_file -H "Content-Type: application/json" https://hostname:8443/Dashboard.jspa/rest/api/2/issue/

I'm getting 404 error

using HTTP with port 8080 works fine. Port 8443 is available in my domain 

[Josh Steckler]

Well, for one thing it should be https://hostname:8443/rest/api/2/issue/

[Josh Steckler]

What happens when you try 8443? Error message?

And please post the <connector> object(s) in your server.xml as well.

-Josh

[Aviv Cohen]

HI @josh

What happens when you try 8443?

Error 404

And please post the <connector> object(s) in your server.xml as well

I updated the Connector in the server.xml step-by-step like in the tutorial

-->
 <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
 maxHttpHeaderSize="8192" SSLEnabled="true"
 maxThreads="150" minSpareThreads="25"
 enableLookups="false" disableUploadTimeout="true"
 acceptCount="100" scheme="https" secure="true"
 clientAuth="false" sslProtocol="TLS" useBodyEncodingForURI="true"
 keyAlias="jira1" keystoreFile="/opt/atlassian/jira/jira.jks" keystorePass="<my pwd>" keystoreType="JKS"/>
 <!--

<Connector port="8080"

maxThreads="150"
 minSpareThreads="25"
 connectionTimeout="20000"

enableLookups="false"
 maxHttpHeaderSize="8192"
 protocol="HTTP/1.1"
 useBodyEncodingForURI="true"
 redirectPort="8443"
 acceptCount="100"
 disableUploadTimeout="true"
 bindOnInit="false"/>

<!--

[Josh Steckler]

Connectors look fine. Make sure your base url is changed to https://hostname.domain.com:8443

Can you give more information on the exact API endpoint you're using and the whole http response including headers?

I would recommend if you're trying this in a script to isolate the problem by using cURL.

For instance, run these commands:

curl -i https://jirahostname.domain.com:8443/rest/api/latest/serverInfo

curl -i http://jirahostname.domain.com:8080/rest/api/latest/serverInfo

These commands should have nearly identical response, looking like:

HTTP/1.1 200
Date: Mon, 02 Apr 2018 16:32:39 GMT
X-AREQUESTID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-ASEN: SEN-XXXXXXXXXX
X-AUSERNAME: anonymous
Cache-Control: no-cache, no-store, no-transform
Content-Type: application/json;charset=UTF-8
Set-Cookie: atlassian.xsrf.token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx|lout;path=/;Secure
Transfer-Encoding: chunked

{"baseUrl":"https://XXXXX.XXXXX.com:8443","version":"7.6.2","versionNumbers":[7,6,2],"deploymentType":"Server","buildNumber":76004,"buildDate":"2017-12-20T00:00:00.000-0500","scmInfo":"a2a9d7db0ecab4541c2f15c5625050b2b216894f","serverTitle":"JIRA"}

[Aviv Cohen]

I want 1st to understand why I can use REST API with HTTP port 8080 while Jira runs in browser on HTTPS with the new certificate?

Is it something else I need to configure ?

[Josh Steckler]

Doing the curl tests I mentioned will help answer that.

[Aviv Cohen]

Doing the curl tests I mentioned will help answer that

curl -i https://jirahostname.domain.com:8443/rest/api/latest/serverInfo:

curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.


curl -i http://jirahostname.domain.com:8080/rest/api/latest/serverInfo:

HTTP/1.1 200
X-AREQUESTID: cxxxxxxxxxxxx
X-ASEN: SEN-xxxxxxx
Set-Cookie: atlassian.xsrf.token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-AUSERNAME: xxxxxxxx
Cache-Control: no-cache, no-store, no-transform
X-Content-Type-Options: nosniff
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked
Date: Tue, 03 Apr 2018 06:07:19 GMT

{"baseUrl":"http://jirahostname:8080","version":"7.3.1","versionNumbers":[7,3,1],"deploymentType":"Server","buildNumber":xxxxx,"buildDate":"2017-02-03T00:00:00.000+0200","scmInfo":"xxxxxxxxx","serverTitle":"JIRA Cloud"}admin@jirahostname:/tmp/jira_api_events$