JIRA LOCAL SERVER: SSl not working after upgrade

[Arkim]

Hello.
I wanted to upgrade jira server from 8.7.1 to 8.19.1 (because the newer one does not support TESTFLO ).
Jira at my company is running as a local ubuntu 18 server and is running SSL. Eventually I would have to do an upgrade

I upgraded Jira to this version.
I replaced the files overwritten by the installer:

Modified files:
atlassian-jira/WEB-INF/web.xml
conf/server.xml
jre/lib/security/cacerts
conf/logging.properties
bin/setenv.sh

Everything is as in the previous version, but SSL does not work. Over 8080 it works normally.
I set permissions to files and folders in the whole jira folder as user "jira".

file server.xml :

        <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"

              relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"

              maxHttpHeaderSize="8192" SSLEnabled="true"

              maxThreads="150" minSpareThreads="25"

              enableLookups="false" disableUploadTimeout="true"

              acceptCount="100" scheme="https" secure="true"

              sslProtocol="TLS"

              clientAuth="false" useBodyEncodingForURI="true"

              keyAlias="esysco" keyPass="xxxxxxxxxxxxx"

              keystoreFile="/opt/atlassian/jira/xxxxx.jks" keystorePass="xxxxxx"/>

catalina.out only reports :

10-Nov-2021 09:30:34.594 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.io.tmpdir=/opt/atlassian/jira/temp
10-Nov-2021 09:30:34.594 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The Apache Tomcat Native library which allows using OpenSSL was not found on the java.library.path: [/usr/java/packages/lib:/usr/lib64:/lib64:/lib:/usr/lib]
10-Nov-2021 09:30:35.341 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"]
10-Nov-2021 09:30:35.384 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["https-jsse-nio-443"]
10-Nov-2021 09:30:35.419 SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-443]]
org.apache.catalina.LifecycleException: Protocol handler initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:1076)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:552)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:846)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.startup.Catalina.load(Catalina.java:639)
at org.apache.catalina.startup.Catalina.load(Catalina.java:662)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:302)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472)
Caused by: java.net.SocketException: Permission denied
at java.base/sun.nio.ch.Net.bind0(Native Method)
at java.base/sun.nio.ch.Net.bind(Unknown Source)
at java.base/sun.nio.ch.Net.bind(Unknown Source)
at java.base/sun.nio.ch.ServerSocketChannelImpl.bind(Unknown Source)
at java.base/sun.nio.ch.ServerSocketAdaptor.bind(Unknown Source)
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:222)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1143)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:222)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:599)
at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:80)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:1074)
... 13 more
10-Nov-2021 09:30:35.422 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 3131 ms
10-Nov-2021 09:30:35.539 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina]
10-Nov-2021 09:30:35.540 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet engine: [Apache Tomcat/8.5.65]
2021-11-10 09:31:32,444+0100 localhost-startStop-1 INFO [c.a.jira.startup.JiraHomeStartupCheck] The jira.home directory '/var/atlassian/application-data/jira' is validated and locked for exclusive use by this instance.
2021-11-10 09:31:32,904+0100 JIRA-Bootstrap INFO [c.a.jira.startup.JiraStartupLogger]

****************
Jira starting...
****************

I don't know what it can't permission denied.

Can anyone help?

thank you in advance.

Adam

[Fabio Racobaldo _Herzum_ · Accepted solution]

Hi @Arkim ,

try to use another port instead of 443 for example 18080.

<Connector port="18080" protocol="org.apache.coyote.http11.Http11NioProtocol"

              relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"

              maxHttpHeaderSize="8192" SSLEnabled="true"

              maxThreads="150" minSpareThreads="25"

              enableLookups="false" disableUploadTimeout="true"

              acceptCount="100" scheme="https" secure="true"

              sslProtocol="TLS"

              clientAuth="false" useBodyEncodingForURI="true"

              keyAlias="esysco" keyPass="xxxxxxxxxxxxx"

              keystoreFile="/opt/atlassian/jira/xxxxx.jks" keystorePass="xxxxxx"/>

Are u using a reverse proxy in front of JIRA?

Let me know,

Fabio

[Arkim]

Thank you for your reply.
I changed it to port 18080, restart ubuntu and 

http://192.168.2.10:18080 not work.

http://192.168.2.10:8080  is working 

Unfortunately I did not install jira on the server. I do not know if there is no a reverse proxy.

how can i check that ?

Thx 

[Fabio Racobaldo _Herzum_]

Hi @Arkim ,

how users access Jira? Through ip or what?

[Arkim]

Hi @Fabio Racobaldo _Herzum_ 

We are using crowd on another local server and connecting to Microsoft.

Locally on my laptop with Windows 10 I have an entry added to HOSTS as
192.168.2.10 jira.xxxx.eu (xxxx = company name)
I test the connection to jira via Chrome by typing https://jira.xxxx.eu

just now
I added port 18080 to the firewall and added an entry in server.xml :
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2,TLSv1.3"

It started working as https://jira.xxxx.eu:18080

When I changed again in server.xml to port 443 , reset the server , it does not work again.
I even turned off the firewall and the same thing.

When I set the port to 18080, I check with the command:
netstat -tulnp 

I do not see port 443, which means nothing is using it.

I also did a test with port 1443 and SSL works there too.

But why it does not work on 443 ?

Please give me a hint 

Thx A

[Arkim]

I already know where the problem is.
If I set a port in server.xml smaller than 1024 it does not work.
I found an article, set it like that and it works.

https://confluence.atlassian.com/jirakb/use-port-80-or-443-for-jira-server-in-linux-when-running-as-a-non-root-user-890079490.html

I just don't understand why before the upgrade SSL was working on port 443.