This test relies on the local Java installation's own store of trusted certificate authorities, so this test is best run from systems that you plan to connect to your application, e.g. Add around the default connector. apache apachecon This section describes how to update the proxy configuration of the Tomcat (or Jetty in the case of Fisheye or Crucible) web server bundled with each Atlassian application to run behind an SSL-enabled reverse proxy. Windows refers to Apache as 'httpd',with the configuration file stored in the location \conf\httpd.conf. You can find additional documentation that explains how to use. Confluence 6.0, must use Apache 2.4.10 and up.). If you're proxying any of these Atlassian server applications, configurethe context path in the Tomcatserver.xmlfile as follows. This can cause failures in systems that connect to your application. It's possible for SSL to work fine in a browser, but fail when other applications connect. In the sameconf/server.xmlfile, use the example connectorsas a starting point. The last stage is to set theBase URLto the address you're using within the proxy, for examplehttp://www.example.com/confluence. Use these commands from the Crowd installation directory: See also Installing Crowd as a Windows Service. Once the service has stopped select the start button (triangle) and wait for the status to change to 'Started'. Enable the SSL module with the following command: In Fedora and Centos systems, the SSL module may need to be installed. You need to modify your existing VirtualHost configuration to listen for HTTPS connections instead of HTTP connections. Use these commands from the Crucible installation directory: See also Running Crucible as a Windows service. howto balancer configure As in the previous example, users will connect to Synchrony, which is required for collaborative editing, directly via WebSockets. In this example, users will connect to Synchrony, which is required for collaborative editing, directly via WebSockets. Without this, data encrypted with your Certificate file can't be read, which means people can't use your public Certificate to impersonate you. The new directives inside the virtual host blocks perform these functions: Use the character*as a wildcard to match all IP addresses, with the default https port of 443. Internet Information Services (IIS)is one of the most popular web servers in use in the Windows ecosystem. Some examples of things that might be connecting to your application: These kinds of failures may not be immediately obvious, and by the time they are discovered it can be much more difficult to narrow down the cause. That means without using SSL which means that all communication between the user's browser and your Atlassian application will be unsecured. apache nginx If your VirtualHost directives are contained inside your own, file in this directory, you simply need to make sure your. Use these commands from the Crowd installation directory: See also Installing Crowd as a Windows Service. Please read through, Use your Apache reverse proxy to be a gateway through which users outside the firewall can access your Atlassian application, Use a different port number to access your hosted Atlassian application, particularly if you are integrating your Atlassian Server application with any of our Cloud applications. JIRA server, Bitbucket server, Bamboo server, Confluence server) behind a reverse proxy on a self-hosted environment. The Certificate file is the public part of your SSL certificate that anyone connecting will see, and tells clients how to encrypt their data so only your certificate files can decrypt it. The order of directives in the config is important. In this case you'll see a "permission denied" message in thehttpderror_log similar to this: You need to manually modify the SELinux policy for thehttpdprocess using the following command: This is an optional step that ensures the origin IP (ie the user connecting to the proxy) is sent to the Atlassian application rather than the proxy IP. For example: You should only use a trailing slash if you see problems with DNS failures (due to a missing slash) in your Apache Log files. reverse proxy apache guide implementation typical below Enable mod_proxyand supporting modules in the Apache httpd.conf configuration file by uncommenting (i.e. Use the default values for the other attributes,including forport,unless you have a particular reason to change them, and use your own domain name for theproxyNamevalue: Note that theproxyNameparameter should be set to theFQDNthat Apache HTTP Server will be configured to serve. This is the full path to your certificate private key file on disk. The following guides will cover an overview of how to integrate Atlassian's tool set with proxy technologies with further instructions on basic working set ups on both Windows and Linux platforms. Apache includes some supplemental configuration files by default, including default SSL configuration.

JIRA server applications (JIRA Software Server, JIRA Core, JIRA Service Desk), Confluence Server (there are some additional steps and examples in this guide for Confluence 6.0 and later), Note that for CentOS, the preferred approach is toadd the virtual host block to a separateconfigurationfilefor each application in, Note that for Debian, the preferred approach is to add the virtual host block to a separateconfigurationfilefor each applicationin. If your VirtualHost directives are contained inside your own.conffile in this directory, you simply need to make sure your.conffile appears alphabetically beforessl.conf, as files from this directory are loaded in alphabetical order. Much in the same way that the Certificate file verifies your site's identity, the Certificate Chain file verifies the CA's identity. You should check, perhaps with your system or network administrator, whether the current DNS configuration for your organization will need changes to support the proxy topology you wish to set up. If you're usingFisheye or Crucible,update the proxy host, proxy scheme and the proxy port from the Admin area. This section describes how to configure the Tomcat (or Jetty) web server bundled with each Atlassian application to run behind a reverse proxy. servers hosting existing Atlassian applications. Note that any changes you make to thehttpd.conffile will only be effective after restarting Apache HTTP Server. We recommend disabling HTTP compression for JIRA applications and Confluence: Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http), This article only applies to Atlassian products on the. apache nginx abstractions See the "stopping and starting"instructions above. Now,restart each Atlassian application. Note: It's not possible to use Apache HTTP Server 2.2 with Confluence 6.0 or later. You will need to enable the following required Apache modules if they are not already enabled: (proxy_wstunnel and mod_rewrite are new requirements in Confluence 6.0). For each application, find the normal (non-SSL)Connectordirective in the Tomcat /conf/server.xmlfile, and add thescheme,proxyName,andproxyPortattributes inside theConnectordirective, as below. , look for "Apache2" and select it. jira seizure conf incorrect confluence Note that Atlassian applications do not need to run behind a web server they are capable of serving web requests directly using the bundled Tomcat application server but that's a fairly common set up amongst our customers. Other third-party servers (for example nginx or IIS) are not yet documented here. It should now look like this. There are a few files that make up a typical SSL certificate: These files need to be copied somewhere on your server where Apache can access them, and should be owned by therootuser. Once the service has stopped select the start button (triangle) and wait for the status to change to 'Started'. Restart Confluence, and check you can access it at http://example:8090/confluence. Your Certificate file contains the information required to decrypt the data received from clients that encrypted their data with your public-facing certificate. server.xml configurations have been replaced by/shared/bitbucket.properties. Now, on the menu bar select the stop button (square) and wait for the status of the service to change to 'Stopped'. The default SSL configuration file is located in/etc/httpd/conf.d/ssl.conf. , it is not possible to configure AJP between your proxy and Tomcat server. nginx apache This causes Apache to match requests on the ServerName values of the virtual hosts. In this example the context path will be/confluence. See the Apache 2.4When not to usemod_rewritedocumentation. : It's not possible to use Apache HTTP Server 2.2 with Confluence 6.0 or later. Check you can access them using the new URLs.

apache easiest For more information about how the configuration files are processed, see: If you're using Confluence 6.0 or later with Synchrony (required for collaborative editing), you'll need to use Apache 2.4.10 or later, and also check that the mod_proxy_wstunnel and mod_rewrite modules are enabled. remove the leading '#') the following lines if necessary: If these lines don't exist in the configuration file, just add them. Most unix-like systems should have OpenSSL binaries installed, and binaries are also available for Windows. If you'reproxyingFisheye or Crucible, configurethe web context path for Jetty from the admin area. See the Apache 2.4 VirtualHostdocumentation. You have two or more Java applications, each running in their own application server on different ports, for example. After finishing the mapping to bitbucket.properties got to Part B. Configure SSL. Install the SSL module with the following command: Installing mod_ssl will enable the module automatically. When browsers load content from an HTTPS URL, if any non-HTTPS content is included the browser will block the non-HTTPS content for security reasons. This page explains how to establish a network topology in which Apache HTTP Server acts as a. forAtlassian server applications. ), A lock icon appears next to the website address in the address bar. Maintenance page for JIRA, Confluence at proxy level, Changing port that your Atlassian application listens on, How to Configure Outbound HTTP and HTTPS Proxy for your Atlassian application, Setting properties and options on startup for Atlassian applications, Set a context path for Atlassian applications, Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http), Proxying Atlassian server applications with Microsoft Internet Information Services (IIS), How to create a Tomcat unproxied connector (backdoor), Connect to your application via a Reverse Proxy over HTTP, JIRA application Startup and Shutdown Scripts, Starting Confluence Automatically on System Startup, Migrate server.xml customizations to bitbucket.properties, Apache Tomcat 8.0 HTTP Connector Reference, Unable to connect to SSL services due to "PKIX Path Building Failed" error, Jira, Confluence, Bamboo, Bitbucket, Fisheye, Crucible, Crowd, JIRA server applications (JIRA Software Server, JIRA Core, JIRA Service Desk). This 3rd party blog explains the problem in more detail, and provides additional information on how to resolve it. You have an existing Apache website, and want to add Confluence (for example. Atlassian applications allow the use of reverse-proxies with our products; however, Atlassian Support does not provide assistance for configuring them. Database Troubleshooting and How-to Guides, Best practices for performance troubleshooting tools, How to capture HTTP traffic using Wireshark, Fiddler, or tcpdump, Cross Site Request Forgery (CSRF) protection changes in Atlassian REST, Single Sign-on Integration with Atlassian products, Test disk access speed for a Java application, User Management Troubleshooting and How-To Guides, How to set the timezone for the Java environment, Websudo is disabled after migration from JIRA cloud to JIRA server, Health Check: Lucene index files location, Editor Window is Small After Upgrading where as the preview is Normal window size, Basic authentication fails for outgoing proxy in Java 8u111, Creating A Jira Administrator That Does Not Count Towards License, Users are unable to log in to JIRA (LDAP: error code 49, data 52e), User unable to login into Crowd after Crowd was upgraded, How to use the Performance Data Collector, How to log in to my Atlassian cloud site for the first time, How to block access to a specific URL at Tomcat, User-installed apps health check fails in Data Center when configuring CDN, HTTP2 health check fails in Data Center when configuring CDN, How to configure Apache for caching and HTTP/2, How to Unsubscribe from Jira Server or Confluence Server apps on TestFlight, Unable to synchronize with Active Directory due to SSL requirement, Jira Align - Jira Connector pages do not load completely, Jira Align - Work In Process by Value Stream is missing work items, JVM is not reachable with jstat and jstack, Using JDK 11 to develop apps with the Atlassian SDK is not yet supported, How to download Atlassian Marketplace apps through the command line, How to manage Premier Support named contacts, Bidirectional characters warning in Atlassian products, Jira is logging multiple cache flushes in the application logs, FAQ for CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105, Jira integrated with OKTA fails to start after upgraging to 8.22.2, How Configure Fields works and how to debug common errors, How to disable custom Configure Fields in Create Issue screen, Maintenance page for JIRA, Confluence at proxy level, Changing port that your Atlassian application listens on, How to Configure Outbound HTTP and HTTPS Proxy for your Atlassian application, Setting properties and options on startup for Atlassian applications, Set a context path for Atlassian applications, Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http), Securing your Atlassian applications with Apache using SSL, Proxying Atlassian server applications with Microsoft Internet Information Services (IIS), How to create a Tomcat unproxied connector (backdoor), Connect to your application directly via HTTP, Connect to your application via a Reverse Proxy over HTTP, Reverse Proxy and Application Link Troubleshooting Guide, Secure your Atlassian applications with Apache using SSL. To do so: Add the below to the appropriate virtual host: Now,restart each application and ensure you can access them using new URLs. Restart Apache from the command line using: You can also usesystemdto restart Apache. You need to changeschemeto "https" andproxyPort to the port that Apache is listening for SSL on, e.g. See the Apache 2.4 SSLCertificateKeyFiledocumentation. If you plan to enable HTTPS, seeSecuring your Atlassian applications with Apache using SSL, andmake sure you choose the HTTPS sample connector. Because of this it's essential to test your SSL configuration immediately so you can correct configuration issues that would otherwise be difficult to detect and diagnose later on. nginx journaldev Stopping the application also stops Tomcat. The Certificate Key file is the private part of your SSL certificate. You may wish to do this if you want to: When set up this way, any external access request to your Atlassian application is done via the reverse proxy using HTTP. The KB articleUnable to connect to SSL services due to "PKIX Path Building Failed" error covers the steps to download and run the SSLPoke utility. configuring subdomains subfolders For each application, find the normal (non-SSL)Connectordirective in the Tomcatserver.xmlfile, and update theschemeandproxyPort attributes inside the Connector directive, as below. SeeConfiguring the Fisheye web server. For example: For more information about configuring the Tomcat Connector, refer to theApache Tomcat 7.0 HTTP Connector Reference. An SSL certificate is a set of files that are used to encrypt the communication between a visitor's web browser and your server. configure debian For the purpose of documenting this set up, we used Apache httpd. The most important step of configuring SSL is thoroughly testing your configuration to make sure it is compatible across browsers and other applications. The format of the http.conffile, and location of the modules may differ on your operating system. See, Use a different context pathto access your Atlassian application, No additional configuration on the AJP connector (, If you are already using one of these modules then changing is likely to cause more hassle than it saves. Use these instructions toRemoving the 'crowd' Context from the Application URL. On CentOS, for example, use: You can stop and start the Apache service by going toControl Panel>Administrative Tools>Services, look for "Apache2" and select it. You will need to have completed the steps inConnect to your application via a Reverse Proxy over HTTPbefore continuing. implements a proxy, gateway or cache for Apache while also allowing multiple virtual hosts on a single client. For most Atlassian applications, the bundled web server isApache Tomcat(Fisheye and Crucible useJetty). For each Atlassian application, set theBase URLto the address you configured in the proxy, which is the URL that Apache HTTP Server will be serving(such ashttp://www.example.com/). The simplest test is to access your application via a web browser. Set your Confluence application path (the part after hostname and port) in Tomcat. If necessary, you can find the configuration files in the /etc/httpd/conf/, /etc/httpd/conf.d/ and /etc/httpd/conf.modules.d/ directories. When set up this way, the user accesses the applications directly over HTTP. If there are other Atlassian applications that will be connecting to your application, we recommend you set up all apps to run over HTTPS, as some integration functions require loading content from the remote app. This page describes one possible way to use Apache HTTP Server 2.4 to proxy requests for Confluence running in a standard Tomcat container. For example: Use multiple name-based virtual hostsif each application is on a different domain. If you plan to use SSL, you will need version 2.4.10 or later. Check that the following items are true: SSLPoke is a simple Java utility created by Atlassian to help diagnose SSL issues. Install the Atlassian applications in the usual way. To restart Apache, run the following command: Having compression run on both the proxy and Tomcat can cause problems integrating with other Atlassian applications, such as Jira. This is the full path to your certificate private key file on disk.

configure conf apache2 , as files from this directory are loaded in alphabetical order. Below are three tests that we recommend you run. Note: If your reverse proxy is set up usingmod_proxy_ajp, you can skip this step and move on to Part B below. Use this example if you set a context path in step 1, and will access Confluence with a context path like thishttp://www.example.com/confluence. apache servers If you are configuring Bitbucket Server 5.0. configurations have been replaced by /shared/bitbucket.properties. See the Apache 2.4 SSLEnginedocumentation. This article only applies to Atlassian products on the server and data center platforms. In Ubuntu and Debian systems, the SSL module should be installed by default. If you are running a single Atlassian application behind an Apache reverse proxy, use a virtual host block with the following directives: In some cases, you may need to add a trailing slash to your ProxyPass and ProxyPassReverse directives. Use these commands from the JIRA installation directory: See also JIRA application Startup and Shutdown Scripts. If you're usingFisheye or Crucible,configurethe proxy host, proxy scheme and the proxy port from the Admin area. The steps to update your VirtualHost configuration with SSL support are identical for either proxy type. In XML a comment starts with, and is used to make sure only the relevant portions of the file are read by the application. If your VirtualHost directives have been written directly to. webserver Consequently, Atlassian can not guarantee providing any support for them. For each Atlassian application, update theBase URLto use thehttpsprotocol instead ofhttp(such ashttps://www.example.com/). See the Apache 2.4 SSLCertificateChainFiledocumentation. Use these commands from the Confluence installation directory: See also Starting Confluence Automatically on System Startup. This is the address a user would type into their browser to access the application. Please read throughMigrate server.xml customizations to bitbucket.properties to check the corresponding properties and and to translate the configuration below. The main benefit of using a certificate issued by a CA is that visitors and other applications connecting to your website will be able to verify your site's identity without errors occurring. "443", like this: For more information about configuring the Tomcat Connector, refer to theApache Tomcat 8.0 HTTP Connector Reference. Confluence 6.0.x and above no longer supports AJPproxy connections due to Collaborate Editing. Atlassian applications allow the use of SSL with our products, however Atlassian Support does not provide assistance for configuring them. This page explains how to configureHTTPS (HTTP over SSL) when using Apache as a reverse proxy. For more information aboutmod_proxysee: If necessary, enable the required modules in Apache as follows: Debian and Ubuntu distributions refer to Apache as 'Apache2', with the apache2.conf configuration file stored in the/etc/apache2/directory. , look for "Apache2" and select it. Use this example if you skipped step 1, and will access Confluence without a context path like thishttp://www.example.com. In this instance it tells browsers or other software that might connect to Apache that your application has moved from itshttpURL to its newhttpsURL. To uncomment a section, remove the surrounding the connector. Note that you can't use/resourcesas your context path, as this is used by Confluence, and will cause problems later on. howto balancer configure If the default SSL configuration is loadedbeforeyour VirtualHost it can cause issues with how the certificate chain is presented to clients. If you want to access Confluence without a context path, such aswww.example.com,skip this step. Once the service has stopped select the start button (triangle) and wait for the status to change to 'Started'. This is needed to pick up on the new configuration. You'll need to replace these URLs with your own URLs. Stopping the application also stops Tomcat. If the path to your private key file contains spaces, the path should be enclosed in double quotes. It's also possible to configure http to https redirection in Apache using themod_rewritemodule instead ofRedirect permanent, however Apache recommends usingRedirectovermod_rewritewhere possible. It's important that you runallof the tests, as in many cases only one out of three tests will detect a failure. You would have already added these attributes when configuring the reverse proxy. For CentOS, the SELinux policy blockshttpdfrom connecting with the network by default. If your VirtualHost directives have been written directly to/etc/httpd/conf/httpd.confthen you need to locate the following lines and make sure they appearafteryour VirtualHost entries, and not before: Restart Apache from the command line using: You can also usesystemdto restart Apache. If you have multiple applications running behind the same proxy, you can use name-based virtual hosts: Use a single name-based virtual host if the Atlassian applications are under the same domain but have different context paths. configuration wso2 The first step is to change the VirtualHost's listening port to the HTTPS port to the port you will be listening for HTTPS connections on,443by default: To activate SSL inside your VirtualHost and attach your certificate files, add the following lines to the end of your VirtualHost configuration: To enforce the use of secure connections to your server, you should redirect HTTP to HTTPS. All communication between the user's browser and Apache, and so your Atlassian application, will be unsecured, but users can only browse your Atlassian application via proxy and not directly. This step is only required if you want an application to be accessed on a context path, such ashttp://ourcompany.com/. Please disable HTTP compression as per ourCompressing an HTTP Response within Confluencedocs. Do not change the order. For full details about configuring virtual hosts and how to use each directive seehttps://httpd.apache.org/docs/2.4/vhosts/. This page provides an overview of some common network topology options for running any of the Atlassian Server applications (i.e. Insert your proxyNameandproxyPortas shown in the last line below: If you plan to enable HTTPS, use the connector underHTTPS - Proxying Confluence via Apache or Nginx over HTTPS. As of Bitbucket Server 5.0, you can't configure any Tomcat connectors directly, therefore the configurations in this section only apply for Bitbucket server 4.14 or earlier.