Jira - Can't Connect Externally (Incorrect SERVER.XML?)

[Matt]

I’m using Cloudflare with the ports set to 2052 (HTTP) and 2053 (HTTPS). In the server.xml file, I redirect from 2052 to 2053 and it’s been working fine for years, except when I reinstalled Jira and updated to version 9.17.1 I cannot access it remotely anymore.

Rolling back to my previous version is also broken now too and I have no idea why or what's going on. I do not see any warnings or errors in the Catalina logs either. I am able to access Jira by localhost but not by the domain (EG: jira.mywebsite.com) so Jira is in fact running and working but the outside world cannot reach it.

The ports 2052 and 2053 are open on my modem/router (have been for years).

SERVER.XML 

[Jim Knepley - ReleaseTEAM]

Hi @Matt 

Can you be more specific about the symptoms of being unable to access it remotely?

For example, is it broken on both your HTTP and HTTPS connectors? When you reinstalled Jira, did you migrate your keystore (jira.p12) to the new installation? I notice that your connector configuration for port 2053 refers to a PKCS#12 keystore but keystoreType is JKS, that might be an issue, too.

[Matt]

Well HTTP redirects to HTTPS in my server.xml above. When I browse to the localhost, the SSL is broken because the name doesn't match what is in the certificate but I mean, even if it was broken I'd still be able to connect to the site but it would prompt me with a certificate error.

I will try switching to "PKCS12" and see what happens nonetheless.

[Matt]

Okay that wasn't changing anything for me and I had spent about 3 days trying to figure out why, so instead what I've done is I've configured Jira to run in a proxy on IIS (Windows Server 2019) which is actually much cleaner because now there isn't a silly port number on the URL. This seems to have fixed the external connection issue as well.

However, a new problem is facing me which is that my SSL certificate isn't being accepted which is rather odd because all my other CNAME sites are working fine with the same certificate.

Would you happen have any suggestions about this new issue for me? I have included my server.xml file for you (so you can check the proxy settings) which is now the only connector present.

SERVER.XML 

[Matt]

Ah, never mind. I'm stupid. I forgot to re-enable the proxy in Cloudflare since I'm using their certificate and without it going through their proxy, the certificate won't authenticate.

Thanks for your help Jim. Greatly appreciated!

[Jim Knepley - ReleaseTEAM]

I'm assuming that "isn't being accepted" translates to "fails to validate" in nerd-speak.

There's any number of reasons a certificate can fail to validate. Common issues are that the certificate...

• has expired (valid to is in the past)
• is self-signed (the issuer and the subject are the same)
• was signed by an issuer that isn't trusted by the client/browser, such as an internal CA
• doesn't have a CN or SAN entry that exactly matches the requested hostname

Less frequently, the certificate...

• has been revoked
• isn't yet valid ("valid from" is in the future)
• does not include "server authentication" in its key usage field