Webhook source IP not in published list
Asked by Mattias.Sjostrom:

Hello, we've configured a webhook in a bitbucket cloud repo to call our on-prem jenkins instance. We've exposed the webhook endpoint using a whitelist for source IPs taken from <https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/#AtlassiancloudIPrangesanddomains-OutgoingConnections> - the "subset of ranges" in the doc.

The integration is not working, the webhook requests report a "connection timed out" and "X-Squid-Error ERR_CONNECT_FAIL 110". In our firewall we see incoming connection attempts correlating in time with the failed webhook delivery from these four IPs: 104.140.188.6, 89.248.165.201, 89.246.165.104 and 39.184.152.161. We can't easily tell if they are webhook deliveries as the intital connection attempts are dropped.

As far as I can tell, these adresses aren't covered by the more extensive list at <https://ip-ranges.atlassian.com/> either.

What are we missing here?


Answers:
author: Mark C
body: Hi [@Mattias.Sjostrom](/t5/user/viewprofilepage/user-id/4548940)

Welcome to the community.  
I checked those 4 IPs you've got, however, I couldn't find it on [this list](https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/) as well.

For this, may I kindly ask if you feel comfortable sharing your masked repository URL here where you've added the webhook for me to further check?  

You can mask it to something these:

```
https://bitbucket.org/w*******e/n**e
```

![](https://getsupport.atlassian.com/images/icons/emoticons/information.png) You can provide the first and last character of your workspace and repository name.

Otherwise, I can create a support request for you.

Thanks and looking forward to your response.

Regards,  
Mark C

comments: author: Mattias.Sjostrom
body: Hi Mark,

That would work out to something like https//bitbucket.org/d\*\*\*\*\*\*m/h\*\*\*\*t

Thanks,

-Mattias


author: Mark C
body: Hi [@Mattias.Sjostrom](/t5/user/viewprofilepage/user-id/4548940)

Thank you for providing your masked repository URL.  
I've checked your repository with our developers and we noticed the below error message in our internal logs:

```
unable to find valid certification path to requested target
```

For this, I'm suspecting that this is about the Webhook URL where it doesn't have a valid SSL certificate.  
I'm afraid we don't allow an HTTPS Webhook URL with a self-signed certificate to be used on Bitbucket Cloud.  
You can check out [this documentation](https://support.atlassian.com/bitbucket-cloud/docs/manage-webhooks/#If-you-use-self-signed-certificates) for some options.  

Let me know if you have further questions that I can help with.

Regards,  
Mark C


author: Mattias.Sjostrom
body: Hi Mark,

Thank you for assisting with this. We are however not using a self-signed certificate. Our webhook URL is served with a DigiCert issued certificate for a wildcard pattern under our domain.

I can only assume this is due to our server not presenting a complete certificate chain. I'll try to adjust the configuration to rectify this.

Thanks,

-Mattias


author: Mark C
body: I see. Thanks for the confirmation.  
Sure, let me know how it goes.  

Regards,  
Mark C


author: Mattias.Sjostrom
body: I added the full certificate chain to the configuration and I can see that it's served properly using openssl s_client from a whitelisted client over the Internet.

The webhook delivery still doesn't work though.

My next hypothesis would be missing SNI support in the bitbucket webhook delivery mechanism. Unless SNI is used by the TLS client to indicate the server name, our server side will not present the correct certificate for the site. Could you offer any insight on the subject?

Thanks,

-Mattias

PS. I also validated that checking the "Skip certificate validation" box in the webhook config indeed makes the webhook deliveries successful.


author: Mark C
body: Hi [@Mattias.Sjostrom](/t5/user/viewprofilepage/user-id/4548940)

Thank you for the confirmation that checking the "Skip certificate validation" works fine.  

You're correct. I'm afraid Bitbucket Cloud Webhooks does not support SNI.

We do have an existing feature request for it that can be located through this [link](https://jira.atlassian.com/browse/BCLOUD-18691).  
Also, the feature request ticket has been closed as "Won't fix", however, I would recommend adding our comments/suggestions there to re-open the feature request.  

Right now, the best I can suggest is for you to consider other option for SSL certificates.  

Let me know if you have further questions that I can help with.

Regards,  
Mark C


author: Mattias.Sjostrom
body: Hi [@Mark C](/t5/user/viewprofilepage/user-id/1210823)

Thanks, I've added a comment to the feature request.

-Mattias


author: Mark C
body: Thanks for that.  

Regards,  
Mark C


Tags: bitbucket-cloud

cloud