Non-FQDN requests with SSL not working
Asked by Matthias Flesch?tz:

I set up our Confluence server with SSL following mainly <https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html> (except using a CSR with our own internal CA). The certificate is valid for the configured base URL as well as DNS aliases (shortname without FQDN domain).

I also set up a HTTP to HTTPS redirect within tomcat, using <https://community.atlassian.com/t5/Confluence-questions/Confluence-Redirect-HTTP-Requests-to-HTTPS/qaq-p/219942>

After everything works I changed the base URL from <http://confluence.my.domain.com> to <https://confluence.my.domain.com>

My issue:

Everything works fine when using the FQDN (long base URL).

Confluence behaves strange when using the short DNS alias (https://confluence/):

* Home is showing well
* Space homes have no menu anymore
* Page editor will not load
* ...

We tried this with different browsers, cleaned cache/cookies and so on.

Any idea? I just wanted to avoid setting up a reverse proxy just for DNS alias resolving.

Best,

Matthias


Answers:
author: JP _AC Bielefeld Leader_
body: Well,

you are terminating SSL directly at the application server. I assume you're using the latest Confluence version 6.12.x

You need a rewrite rule to rewrite your short name to rewrite to the base URL, otherwise your users will run into problems.

With Tomcat 9 you could try:

<https://tomcat.apache.org/tomcat-9.0-doc/rewrite.html>

My best practice is to terminate SSL at the front end proxy (Apache, ngnix) and reverse proxy to Confluence / Jira by AJP protocol: Easier, more flexible setup, can run on the same and/or different machine.

Best

JP

comments: author: Matthias Flesch?tz
body: Hi JP,

we have 6.11.2 running.

Your suggestion would mean, that everything would work fine, when I change the baseurl of my installation to the non-FQDN short version https://confluence instead of <https://confluence.my.domain.com>

Unfortunately the behaviour is the same, even when changing baseURL and restarting.  
What makes it even more strange is that the problem only occur with fixed URLs (e.g. https://confluence/display/SPACE by accessing via menu / navigation). When accessing via breadcrumps it works as the links are like https://confluence/pages/viewpage.action?pageId=4128873...

If it would be just a baseurl problem, I would assume that the problem should occur always, not only with fixed URLs and that it should be solved by changing baseurl.

Best,

Matthias


author: JP _AC Bielefeld Leader_
body: Your SSL cert is only working correctly for [https://confluence.my.domain.com](http://confluence.my.domain.com/)/... and not https://confluence/.... As Confluence accesses certain URLs internally by using the base (matching the SSL cert) URL there might be certificate errors or other unforeseen behavior.

Do the logs tell you anything? (application \& tomcat)

Best

JP


author: Matthias Flesch?tz
body: As we have created the certificate with SAN extension for all our long and short URLs it is working. The certificate chain is also working and checked OK internally as our internal CA is imported in the given truststore and Javas lib/security/cacerts as well. Before I did the last one I had PKIX errors in the log. The clients handle the certificate quite good aswell.

catalina log doesn't have any error at all.

atlassian-confluence logs tells:

```
2018-10-17 19:46:49,238 ERROR [pool-11-thread-2] [atlassian.hibernate.util.ThreadSafeCheckingSessionEventListener] checkThread Session called from wrong thread
 -- url: /pages/viewpage.action | page: 4128873 | traceId: df92d3d13125bddd | userName: firstname.lastnae@domain.com | referer: https:/confluence/display/RnD/Asana+Plugin+Test | action: viewpage
java.lang.Exception
 at com.atlassian.hibernate.util.ThreadSafeCheckingSessionEventListener.checkThread(ThreadSafeCheckingSessionEventListener.java:125)
 at com.atlassian.hibernate.util.ThreadSafeCheckingSessionEventListener.cacheGetStart(ThreadSafeCheckingSessionEventListener.java:79)
 at org.hibernate.engine.internal.SessionEventListenerManagerImpl.cacheGetStart(SessionEventListenerManagerImpl.java:181)
 at org.hibernate.engine.internal.CacheHelper.fromSharedCache(CacheHelper.java:30)
 at org.hibernate.event.internal.DefaultLoadEventListener.getFromSharedCache(DefaultLoadEventListener.java:651)
 at org.hibernate.event.internal.DefaultLoadEventListener.loadFromSecondLevelCache(DefaultLoadEventListener.java:595)
 at org.hibernate.event.internal.DefaultLoadEventListener.doLoad(DefaultLoadEventListener.java:462)
 at org.hibernate.event.internal.DefaultLoadEventListener.load(DefaultLoadEventListener.java:219)
 at org.hibernate.event.internal.DefaultLoadEventListener.doOnLoad(DefaultLoadEventListener.java:116)
 at org.hibernate.event.internal.DefaultLoadEventListener.onLoad(DefaultLoadEventListener.java:89)
 at org.hibernate.internal.SessionImpl.fireLoad(SessionImpl.java:1230)
 at org.hibernate.internal.SessionImpl.immediateLoad(SessionImpl.java:1088)
 at org.hibernate.proxy.AbstractLazyInitializer.initialize(AbstractLazyInitializer.java:155)
 at org.hibernate.proxy.AbstractLazyInitializer.getImplementation(AbstractLazyInitializer.java:259)
 at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:73)
 at com.atlassian.hibernate.adapter.proxy.JavassistLazyInitializer_ImplementV2Proxy.invoke(JavassistLazyInitializer_ImplementV2Proxy.java:68)
 at com.atlassian.confluence.spaces.Space_$$_jvst95e_7.getKey(Space_$$_jvst95e_7.java)
 at com.atlassian.confluence.core.SpaceContentEntityObject.getSpaceKey(SpaceContentEntityObject.java:45)
 at com.atlassian.confluence.util.ContentUtils.getSpaceKeyFromCeo(ContentUtils.java:76)
 at com.atlassian.confluence.renderer.PageContext.getSpaceKey(PageContext.java:155)
 at com.atlassian.confluence.content.render.xhtml.DefaultConversionContext.getSpaceKey(DefaultConversionContext.java:268)
 at com.comalatech.confluence.workflow.transformer.UpdateMacroDefinitionsTransformer.transform(UpdateMacroDefinitionsTransformer.java:64)
 at com.comalatech.confluence.workflow.transformer.AbstractTransformer.transform(AbstractTransformer.java:24)
 at com.atlassian.confluence.content.render.xhtml.TransformerChain.transform(TransformerChain.java:33)
 at com.atlassian.confluence.content.render.xhtml.PluggableTransformerChain.transform(PluggableTransformerChain.java:39)
 at com.atlassian.confluence.content.render.xhtml.DefaultRenderer.renderWithoutMetrics(DefaultRenderer.java:194)
 at com.atlassian.confluence.content.render.xhtml.DefaultRenderer.renderWithResult(DefaultRenderer.java:153)
 at com.atlassian.confluence.content.render.xhtml.DefaultRenderer.render(DefaultRenderer.java:134)
 at com.atlassian.confluence.content.render.xhtml.DeviceTypeAwareRenderer.render(DeviceTypeAwareRenderer.java:55)
 at com.atlassian.confluence.content.render.xhtml.DefaultXhtmlContent.convertStorageToView(DefaultXhtmlContent.java:135)
 at sun.reflect.GeneratedMethodAccessor804.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.util.ContextClassLoaderSettingInvocationHandler.invoke(ContextClassLoaderSettingInvocationHandler.java:26)
 at com.sun.proxy.$Proxy422.convertStorageToView(Unknown Source)
 at sun.reflect.GeneratedMethodAccessor804.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.osgi.bridge.external.HostComponentFactoryBean$DynamicServiceInvocationHandler.invoke(HostComponentFactoryBean.java:136)
 at com.sun.proxy.$Proxy422.convertStorageToView(Unknown Source)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.renderDetailRows(DetailsSummaryBuilder.java:328)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.lambda$renderDetailRowsWithTransaction$6(DetailsSummaryBuilder.java:296)
 at com.atlassian.sal.core.transaction.HostContextTransactionTemplate$1.doInTransaction(HostContextTransactionTemplate.java:21)
 at com.atlassian.sal.spring.component.SpringHostContextAccessor$1.doInTransaction(SpringHostContextAccessor.java:71)
 at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:133)
 at com.atlassian.sal.spring.component.SpringHostContextAccessor.doInTransaction(SpringHostContextAccessor.java:68)
 at com.atlassian.confluence.spring.transaction.interceptor.ConfluenceSpringHostContextAccessor.access$001(ConfluenceSpringHostContextAccessor.java:21)
 at com.atlassian.confluence.spring.transaction.interceptor.ConfluenceSpringHostContextAccessor.lambda$doInTransaction$3(ConfluenceSpringHostContextAccessor.java:72)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContextInternal(VCacheRequestContextManager.java:87)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContext(VCacheRequestContextManager.java:71)
 at com.atlassian.confluence.spring.transaction.interceptor.ConfluenceSpringHostContextAccessor.doInTransaction(ConfluenceSpringHostContextAccessor.java:72)
 at sun.reflect.GeneratedMethodAccessor237.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.util.ContextClassLoaderSettingInvocationHandler.invoke(ContextClassLoaderSettingInvocationHandler.java:26)
 at com.sun.proxy.$Proxy316.doInTransaction(Unknown Source)
 at sun.reflect.GeneratedMethodAccessor237.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.plugin.osgi.bridge.external.HostComponentFactoryBean$DynamicServiceInvocationHandler.invoke(HostComponentFactoryBean.java:136)
 at com.sun.proxy.$Proxy316.doInTransaction(Unknown Source)
 at com.atlassian.sal.core.transaction.HostContextTransactionTemplate.execute(HostContextTransactionTemplate.java:18)
 at sun.reflect.GeneratedMethodAccessor238.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invokeUnprivileged(ServiceTCCLInterceptor.java:70)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invoke(ServiceTCCLInterceptor.java:53)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)
 at com.sun.proxy.$Proxy1489.execute(Unknown Source)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.renderDetailRowsWithTransaction(DetailsSummaryBuilder.java:296)
 at com.atlassian.confluence.extra.masterdetail.DetailsSummaryBuilder.lambda$null$4(DetailsSummaryBuilder.java:265)
 at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1590)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)
```

and

```
2018-10-17 19:45:55,787 ERROR [AtlassianEvent::CustomizableThreadFactory-1] [renderer.internal.http.HttpClientFetcher] fetch Unable to perform a request to: https://kms/rest/gadgets/1.0/g/messagebundle/und/gadget.common%2Cgadget.activity.stream
org.apache.http.conn.ConnectTimeoutException: Connect to confluence:443 [confluence/1.2.3.4] failed: Read timed out
 at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)
 at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373)
 at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
 at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
 at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
 at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
 at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
 at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
 at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
 at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
 at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
 at com.atlassian.gadgets.renderer.internal.http.WhitelistAwareHttpClient.execute(WhitelistAwareHttpClient.java:49)
 at com.atlassian.gadgets.renderer.internal.http.ShindigApacheClientAdapter.execute(ShindigApacheClientAdapter.java:41)
 at com.atlassian.gadgets.renderer.internal.http.HttpClientFetcher.fetch(HttpClientFetcher.java:47)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.fetchBundle(DefaultMessageBundleFactory.java:138)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getNestedBundle(DefaultMessageBundleFactory.java:111)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getBundle(DefaultMessageBundleFactory.java:79)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getParentBundle(DefaultMessageBundleFactory.java:124)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getNestedBundle(DefaultMessageBundleFactory.java:101)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getBundle(DefaultMessageBundleFactory.java:79)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getParentBundle(DefaultMessageBundleFactory.java:127)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getNestedBundle(DefaultMessageBundleFactory.java:101)
 at org.apache.shindig.gadgets.DefaultMessageBundleFactory.getBundle(DefaultMessageBundleFactory.java:79)
 at org.apache.shindig.gadgets.variables.VariableSubstituter.substitute(VariableSubstituter.java:47)
 at com.atlassian.gadgets.renderer.internal.GadgetSpecFactoryImpl.getGadgetSpec(GadgetSpecFactoryImpl.java:127)
 at com.atlassian.gadgets.renderer.internal.GadgetSpecFactoryImpl.getGadgetSpec(GadgetSpecFactoryImpl.java:83)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.doInvoke(ServiceInvoker.java:56)
 at org.eclipse.gemini.blueprint.service.importer.support.internal.aop.ServiceInvoker.invoke(ServiceInvoker.java:60)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invokeUnprivileged(ServiceTCCLInterceptor.java:70)
 at org.eclipse.gemini.blueprint.service.util.internal.aop.ServiceTCCLInterceptor.invoke(ServiceTCCLInterceptor.java:53)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.eclipse.gemini.blueprint.service.importer.support.LocalBundleContextAdvice.invoke(LocalBundleContextAdvice.java:57)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133)
 at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
 at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)
 at com.sun.proxy.$Proxy1937.getGadgetSpec(Unknown Source)
 at com.atlassian.confluence.plugins.gadgets.metadata.GadgetsMacroMetadataProvider.getGadgetSpecs(GadgetsMacroMetadataProvider.java:193)
 at com.atlassian.confluence.plugins.gadgets.metadata.GadgetsMacroMetadataProvider.getMacroMetadata(GadgetsMacroMetadataProvider.java:89)
 at com.atlassian.confluence.plugins.gadgets.metadata.CachingGadgetsMacroMetadataProvider.loadOnMiss(CachingGadgetsMacroMetadataProvider.java:168)
 at com.atlassian.vcache.internal.core.metrics.TimedSupplier.get(TimedSupplier.java:32)
 at com.atlassian.vcache.internal.legacy.LegacyJvmCache.lambda$get$4(LegacyJvmCache.java:52)
 at java.util.Optional.orElseGet(Optional.java:267)
 at com.atlassian.vcache.internal.legacy.LegacyJvmCache.get(LegacyJvmCache.java:50)
 at com.atlassian.vcache.internal.core.metrics.TimedLocalCacheOperations.get(TimedLocalCacheOperations.java:64)
 at com.atlassian.confluence.plugins.gadgets.metadata.CachingGadgetsMacroMetadataProvider.getData(CachingGadgetsMacroMetadataProvider.java:133)
 at com.atlassian.confluence.macro.browser.DefaultMacroMetadataManager.buildMacroMetadata(DefaultMacroMetadataManager.java:144)
 at com.atlassian.confluence.macro.browser.DefaultMacroMetadataManager.onPluginFrameworkStartedEvent(DefaultMacroMetadataManager.java:72)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at com.atlassian.event.internal.SingleParameterMethodListenerInvoker.invoke(SingleParameterMethodListenerInvoker.java:40)
 at com.atlassian.confluence.event.ConfluenceListenerHandlersConfiguration$TimingListenerHandler$1$1.invoke(ConfluenceListenerHandlersConfiguration.java:69)
 at com.atlassian.confluence.event.ConfluenceEventDispatcher$VCacheRequestContextRunnableFactory$1.lambda$run$0(ConfluenceEventDispatcher.java:93)
 at com.atlassian.confluence.vcache.VCacheRequestContextOperations.lambda$doInRequestContext$0(VCacheRequestContextOperations.java:50)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContextInternal(VCacheRequestContextManager.java:87)
 at com.atlassian.confluence.impl.vcache.VCacheRequestContextManager.doInRequestContext(VCacheRequestContextManager.java:71)
 at com.atlassian.confluence.vcache.VCacheRequestContextOperations.doInRequestContext(VCacheRequestContextOperations.java:49)
 at com.atlassian.confluence.event.ConfluenceEventDispatcher$VCacheRequestContextRunnableFactory$1.run(ConfluenceEventDispatcher.java:93)
 at com.atlassian.confluence.event.ConfluenceEventDispatcher$1.run(ConfluenceEventDispatcher.java:61)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)
```


author: Matthias Flesch?tz
body: Hi JP,

before playing around and get stucked in more unlogic Confluence architecture I decided to follow your hint by using Tomcat redirect...works great.

Although it is really disappointing that Confluence can't handle it in another way as now we have one update-problematic component more :-(

Thanks,

Matthias


Tags: confluence-server

https

server

ssl