Plugin Update: Error downloading plugin from https://marketplace.atlassian.com

[Domi]

When I try to update (or install) a plugin via web interface an error is shown:

Problem accessing the file Support Tools Plugin.

There is only this entry in the log file - no java exception/stacktrace:

Error downloading plugin from https://marketplace.atlassian.com/download/plugins/com.atlassian...

wget works fine for the URL

EDIT:

Also the Log analyzer does not work

thank you

[asasse · Accepted solution]

Hi Dominik,

we had the same problem on our side.  Additionally, the log scanner in our Jira didn't work. 

Solution: Our Jira service (7.5.2, Windows installation) used the JVM parameter
-Djsse.enableSNIExtension=false.
After removing this parameter and restarting Jira, the update function in the plugin manager works again and the log scanner too. 

This might be the solution on your side as well.

Regards,

Andreas

[Domi]

Hello Andreas

Thanks for this solution - removing this from setenv.sh and reboot the server everything works fine

Thank you

Domi

[Domi]

 Hi Shannon

Universal Plugin Manager (v2.22.6)

Pluginupdate worked fine for 3 years and "suddenly" stopped about one week ago - only the described error can be found.

Jira server is behind a firewall

[Shannon S]

Dominik, 

I've seen users correct this error by allowing access in the firewall for the UPM to access our Cloudfront.

If you view Developer Tools > Network in Chrome, you should see the URLs in red that the UPM is trying to access.

Can you have a look at that and make sure they're not being blocked in your Firewall? 

Kind regards,

Shannon

[Shannon S]

Hi Dominik,

Can you let me know your Jira version?

Please also see if you have an update for UPM and let me know if you're able to update it. If an automatic update does not work please also try updating it manually.

Kind regards,

Shannon

[Patrick Cornaz]

Hi,

I had the exact same issue and solved it by actually explicitely enabling SNI, i.e. setting this in setenv.bat:

set JVM_SUPPORT_RECOMMENDED_ARGS=-Djsse.enableSNIExtension=true

[zyc]

Hi Dominik,

look at this 

curl https://marketplace.atlassian.com/download/apps/1214475/version/100000370 -v
* Trying 34.193.88.221...
* TCP_NODELAY set
* Connected to marketplace.atlassian.com (34.193.88.221) port 443 (#0)
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 190 bytes...
* schannel: sent initial handshake data: sent 190 bytes
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 2/3)
* schannel: encrypted data got 4096
* schannel: encrypted data buffer: offset 4096 length 4096
* schannel: encrypted data length: 4030
* schannel: encrypted data buffer: offset 4030 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 2/3)
* schannel: encrypted data got 1024
* schannel: encrypted data buffer: offset 5054 length 5054
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 2/3)
* schannel: encrypted data got 1024
* schannel: encrypted data buffer: offset 6078 length 6078
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 2/3)
* schannel: encrypted data got 401
* schannel: encrypted data buffer: offset 6479 length 7102
* schannel: sending next handshake data: sending 126 bytes...
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 2/3)
* schannel: encrypted data got 274
* schannel: encrypted data buffer: offset 274 length 7102
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with marketplace.atlassian.com port 443 (step 3/3)
* schannel: stored credential handle in session cache
> GET /download/apps/1214475/version/100000370 HTTP/1.1
> Host: marketplace.atlassian.com
> User-Agent: curl/7.55.1
> Accept: */*
>
* schannel: client wants to read 102400 bytes
* schannel: encdata_buffer resized 103424
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: encrypted data got 373
* schannel: encrypted data buffer: offset 373 length 103424
* schannel: decrypted data length: 344
* schannel: decrypted data added: 344
* schannel: decrypted data cached: offset 344 length 102400
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: decrypted data buffer: offset 344 length 102400
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 344
* schannel: decrypted data buffer: offset 0 length 102400
< HTTP/1.1 403 Forbidden
< Date: Wed, 11 Dec 2019 02:47:00 GMT
< Content-Type: text/html;charset=UTF-8
< Content-Length: 0
< Connection: keep-alive
< Server: Jetty(8.y.z-SNAPSHOT)
< Strict-Transport-Security: max-age=31536000
< X-Varnish: 414693095
< Age: 0
< Via: 1.1 varnish (Varnish/5.2)
< Access-Control-Allow-Origin: *
< Vary: Origin
< X-Cache: MISS

<
* Connection #0 to host marketplace.atlassian.com left intact

em I got 403 in this way.

zhang

[Shannon S]

Hello Zhang,

Welcome to Atlassian Community! It's nice to meet you.

I would recommend first that you check Network and Connectivity Troubleshooting Guide on 403 errors.

HTTP 403: Forbidden

This usually indicates an authentication failure. However application links report authentication failures differently from a 403, so this suggests a problem with the proxy configuration instead.

• The remote application is behind a misconfigured proxy. Check the local application logs for the <response body>.
• If the application has been configured with an outbound proxy, the remote application URL can be added to the nonProxyHosts to allow the application link to bypass it.
  • See How to Configure Outbound HTTP and HTTPS Proxy for your Atlassian application
• nonProxyHosts may be configured incorrectly and non-functional. See:
  • Jira server ignores http.nonProxyHosts JVM option
  • JAVA Option '-Dhttp.nonProxyHosts' Does Not Work on Windows OS

If you continue to have issues, then please raise a new question and we can assist you there.

Regards,

Shannon 

[g]

Hi Dominik,

Let us try to verify the connection as the application would, with use of Java and Javas cacert trust store.

Firs, we need to download httpdclient Java class. You can find more information in the httpdclient repository.

Then we need to find out which Java is used by executing the command "ps aux | grep java".

And once you get that information, modify bottom command acodingly and let us know what you see:

<path to java>/java -jar httpclienttest-1.0.2.jar https://marketplace.atlassian.com

It is possible that you are using different cacert keystore, and because of that, your application cannot establish secure https connection with the marketplace.

Regards,

Gojko

[Domi]

Hi

SSL seems to work fine -

http client output:

[xxx@yyyy bin]# ./java -jar httpclienttest-1.0.2.jar https://marketplace.atlassian.com 
DEBUG 2017-11-29 09:46:52,570 [main] org.apache.http.client.protocol.RequestAddCookies - CookieSpec selected: default 
DEBUG 2017-11-29 09:46:52,583 [main] org.apache.http.client.protocol.RequestAuthCache - Auth cache not set in the context 
DEBUG 2017-11-29 09:46:52,584 [main] org.apache.http.impl.conn.PoolingHttpClientConnectionManager - Connection request: [route: {s}->https://marketplace.atlassian.com:443][total kept alive: 0; route allocated: 0 of 2; total allocated: 0 of 20] 
DEBUG 2017-11-29 09:46:52,602 [main] org.apache.http.impl.conn.PoolingHttpClientConnectionManager - Connection leased: [id: 0][route: {s}->https://marketplace.atlassian.com:443][total kept alive: 0; route allocated: 1 of 2; total allocated: 1 of 20] 
DEBUG 2017-11-29 09:46:52,604 [main] org.apache.http.impl.execchain.MainClientExec - Opening connection {s}->https://marketplace.atlassian.com:443 
DEBUG 2017-11-29 09:46:52,645 [main] org.apache.http.impl.conn.DefaultHttpClientConnectionOperator - Connecting to marketplace.atlassian.com/52.2.89.223:443 
DEBUG 2017-11-29 09:46:52,645 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - Connecting socket to marketplace.atlassian.com/52.2.89.223:443 with timeout 0 
DEBUG 2017-11-29 09:46:53,046 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - Enabled protocols: [TLSv1, TLSv1.1, TLSv1.2] 
DEBUG 2017-11-29 09:46:53,047 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - Enabled cipher suites:[TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] 
DEBUG 2017-11-29 09:46:53,047 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - Starting handshake 
DEBUG 2017-11-29 09:46:53,370 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - Secure session established 
DEBUG 2017-11-29 09:46:53,370 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - negotiated protocol: TLSv1.2 
DEBUG 2017-11-29 09:46:53,370 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - negotiated cipher suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 
DEBUG 2017-11-29 09:46:53,371 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - peer principal: CN=*.atlassian.io 
DEBUG 2017-11-29 09:46:53,371 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - peer alternative names: [*.atlassian.io, *.internal.atlassian.io, *.useast.atlassian.io, *.internal.useast.atlassian.io, *.uswest.atlassian.io, *.internal.uswest.atlassian.io, *.uswest2.atlassian.io, *.internal.uswest2.atlassian.io, *.euwest.atlassian.io, *.euwest-beta.atlassian.io, *.internal.euwest.atlassian.io, *.internal.euwest-beta.atlassian.io, *.atl-paas.net, *.prod.atl-paas.net, *.prod.public.atl-paas.net, *.us-east-1.prod.atl-paas.net, *.us-east-1.prod.public.atl-paas.net, *.us-west-1.prod.atl-paas.net, *.us-west-1.prod.public.atl-paas.net, *.us-west-2.prod.atl-paas.net, *.us-west-2.prod.public.atl-paas.net, *.eu-west-1.prod.atl-paas.net, *.eu-west-1.prod.public.atl-paas.net, *.eu-west-1-beta.prod.atl-paas.net, *.eu-west-1-beta.prod.public.atl-paas.net, *.atlassian.com, *.internal.atlassian.com] 
DEBUG 2017-11-29 09:46:53,372 [main] org.apache.http.conn.ssl.SSLConnectionSocketFactory - issuer principal: CN=Amazon, OU=Server CA 1B, O=Amazon, C=US 
DEBUG 2017-11-29 09:46:53,397 [main] org.apache.http.impl.conn.DefaultHttpClientConnectionOperator - Connection established 172.21.200.105:56530<->52.2.89.223:443 
DEBUG 2017-11-29 09:46:53,397 [main] org.apache.http.impl.execchain.MainClientExec - Executing request GET / HTTP/1.1 
DEBUG 2017-11-29 09:46:53,397 [main] org.apache.http.impl.execchain.MainClientExec - Target auth state: UNCHALLENGED 
DEBUG 2017-11-29 09:46:53,398 [main] org.apache.http.impl.execchain.MainClientExec - Proxy auth state: UNCHALLENGED 
DEBUG 2017-11-29 09:46:53,400 [main] org.apache.http.headers - http-outgoing-0 >> GET / HTTP/1.1 
DEBUG 2017-11-29 09:46:53,400 [main] org.apache.http.headers - http-outgoing-0 >> Accept-Encoding: gzip, deflate 
DEBUG 2017-11-29 09:46:53,400 [main] org.apache.http.headers - http-outgoing-0 >> Host: marketplace.atlassian.com 
DEBUG 2017-11-29 09:46:53,400 [main] org.apache.http.headers - http-outgoing-0 >> Connection: Keep-Alive 
DEBUG 2017-11-29 09:46:53,400 [main] org.apache.http.headers - http-outgoing-0 >> User-Agent: Apache-HttpClient/4.4.1 (Java/1.8.0_102) 
DEBUG 2017-11-29 09:46:53,401 [main] org.apache.http.wire - http-outgoing-0 >> "GET / HTTP/1.1[\r][\n]" 
DEBUG 2017-11-29 09:46:53,401 [main] org.apache.http.wire - http-outgoing-0 >> "Accept-Encoding: gzip, deflate[\r][\n]" 
DEBUG 2017-11-29 09:46:53,401 [main] org.apache.http.wire - http-outgoing-0 >> "Host: marketplace.atlassian.com[\r][\n]" 
DEBUG 2017-11-29 09:46:53,401 [main] org.apache.http.wire - http-outgoing-0 >> "Connection: Keep-Alive[\r][\n]" 
DEBUG 2017-11-29 09:46:53,401 [main] org.apache.http.wire - http-outgoing-0 >> "User-Agent: Apache-HttpClient/4.4.1 (Java/1.8.0_102)[\r][\n]" 
DEBUG 2017-11-29 09:46:53,401 [main] org.apache.http.wire - http-outgoing-0 >> "[\r][\n]" 
DEBUG 2017-11-29 09:46:53,572 [main] org.apache.http.wire - http-outgoing-0 << "HTTP/1.1 200 OK[\r][\n]" 
DEBUG 2017-11-29 09:46:53,572 [main] org.apache.http.wire - http-outgoing-0 << "Date: Wed, 29 Nov 2017 08:46:47 GMT[\r][\n]" 
DEBUG 2017-11-29 09:46:53,572 [main] org.apache.http.wire - http-outgoing-0 << "Content-Type: text/html;charset=UTF-8[\r][\n]" 
DEBUG 2017-11-29 09:46:53,572 [main] org.apache.http.wire - http-outgoing-0 << "Transfer-Encoding: chunked[\r][\n]" 
DEBUG 2017-11-29 09:46:53,572 [main] org.apache.http.wire - http-outgoing-0 << "Connection: keep-alive[\r][\n]" 
DEBUG 2017-11-29 09:46:53,572 [main] org.apache.http.wire - http-outgoing-0 << "Set-Cookie: JSESSIONID=1k67ai988yf1ih1yygnrqapcd;Path=/[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Last-Modified: Wed, 29 Nov 2017 08:46:47 GMT[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "X-Frame-Options: DENY[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Content-Encoding: gzip[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Vary: Accept-Encoding, User-Agent[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Server: Jetty(8.y.z-SNAPSHOT)[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Strict-Transport-Security: max-age=31536000[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "X-Varnish: 668318546[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Age: 0[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Via: 1.1 varnish (Varnish/5.0)[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "X-Cache: MISS[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "Accept-Ranges: bytes[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "[\r][\n]" 
DEBUG 2017-11-29 09:46:53,573 [main] org.apache.http.wire - http-outgoing-0 << "a[\r][\n]" 
DEBUG 2017-11-29 09:46:53,574 [main] org.apache.http.wire - http-outgoing-0 << "[0x1f][0x8b][0x8][0x0][0x0][0x0][0x0][0x0][0x0][0x0][\r][\n]" 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << HTTP/1.1 200 OK 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << Date: Wed, 29 Nov 2017 08:46:47 GMT 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << Content-Type: text/html;charset=UTF-8 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << Transfer-Encoding: chunked 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << Connection: keep-alive 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << Set-Cookie: JSESSIONID=1k67ai988yf1ih1yygnrqapcd;Path=/ 
DEBUG 2017-11-29 09:46:53,579 [main] org.apache.http.headers - http-outgoing-0 << Last-Modified: Wed, 29 Nov 2017 08:46:47 GMT 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << X-Frame-Options: DENY 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Content-Encoding: gzip 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Vary: Accept-Encoding, User-Agent 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Server: Jetty(8.y.z-SNAPSHOT) 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Strict-Transport-Security: max-age=31536000 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << X-Varnish: 668318546 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Age: 0 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Via: 1.1 varnish (Varnish/5.0) 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << X-Cache: MISS 
DEBUG 2017-11-29 09:46:53,580 [main] org.apache.http.headers - http-outgoing-0 << Accept-Ranges: bytes 
DEBUG 2017-11-29 09:46:53,590 [main] org.apache.http.impl.execchain.MainClientExec - Connection can be kept alive indefinitely 
DEBUG 2017-11-29 09:46:53,597 [main] org.apache.http.client.protocol.ResponseProcessCookies - Cookie accepted [JSESSIONID="1k67ai988yf1ih1yygnrqapcd", version:0, domain:marketplace.atlassian.com, path:/, expiry:null]

HTTPClient: Connection Successful to https://marketplace.atlassian.com

[g]

Hi Dominik,

Can you confirm that you are using the same Java as the confluence does?

Regards,

Gojko

[Domi]

Hi

FW don't block the request - wget works fine and loads the requested jar file

thx

Domi

[Shannon S]

Domi,

Are you still able to show me what comes up on the Network Tools and your logs when you encounter the error?

Kind regards,

Shannon

[Domi]

Log Entry and curl call 

[Shannon S]

Thank you Dominik,

I will still also need to see what's actually occurring in your Jira logs when you encounter the error as well as what showed up in your Developer Tools in your browser, as this will tell us exactly what your instance was not able to access when attempting to install the add-on.

As soon as you have that information, please provide it.

Kind regards,

Shannon

[Domi]

Jira log is at the top of the screenshot

there is no error in the browser dev tools - the error occurs on the server:

Error downloading plugin from https://marketplace.atlassian.com/download/support/com.atlassian.support.stp/version/3010042

thx

Domi

[Shannon S]

Thank you Domi,

There should have been more in the logs after initial error you sent, such as a "caused by" lines that would have given us more insight to the actual problem.

If your log stops there, can you please go through the steps at Problems Connecting to the Atlassian Marketplace? 

Thank you.

Kind regards,

Shannon

[Domi]

That's exactly the problem - if there would more error details or even an stack trace I would have tried to solve the problem - but that's the only info:

Error downloading plugin from https://marketplace.atlassian.com/download/support/com.atlassian.support.stp/version/3010042

[Shannon S]

Understood, Domi. I just wanted to be sure because it looks like you might have exited out of the log file before it had completed. Thank you for verifying that.

Have you had a chance to read over the article I sent you about troubleshooting UPM issues? It also mentions some more details on Configuring Marketplace Connectivity, so please be sure to read that as well.

Kind regards,

Shannon

[Domi]

Hi

Actual version:

JIRA Software 7.3.8

JIRA Core 7.3.8

UPM automatic update was not possible - manuell update already done

thx

Domi

[Shannon S]

Hi Domi,

In that case, what is your UPM version?

Are you working behind a proxy or firewall? 

Kind regards,

Shannon