How can i use confluence over SSL?
Asked by Tomas Tudja:

Hello all,

we have read and implemented

Running Confluence Over SSL or HTTPS from: {#toc-hId--1323897935}
-----------------------------------------------------------------

<https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html>

We are running jira and confluence on 1 VM with 2 NICs:

ens192: flags=4163\<UP,BROADCAST,RUNNING,MULTICAST\> mtu 1500  
inet 10.10.1.13 netmask 255.255.255.0 broadcast 10.10.1.255  
ether 00:0c:29:e7:b7:71 txqueuelen 1000 (Ethernet)  
RX packets 1381613 bytes 362204221 (345.4 MiB)  
RX errors 0 dropped 11 overruns 0 frame 0  
TX packets 1812036 bytes 313669051 (299.1 MiB)  
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

ens192:0: flags=4163\<UP,BROADCAST,RUNNING,MULTICAST\> mtu 1500  
inet 10.10.1.10 netmask 255.255.255.0 broadcast 10.10.1.255  
ether 00:0c:29:e7:b7:71 txqueuelen 1000 (Ethernet)

lo: flags=73\<UP,LOOPBACK,RUNNING\> mtu 65536  
inet 127.0.0.1 netmask 255.0.0.0  
loop txqueuelen 1000 (Local Loopback)  
RX packets 4413 bytes 707965 (691.3 KiB)  
RX errors 0 dropped 0 overruns 0 frame 0  
TX packets 4413 bytes 707965 (691.3 KiB)  
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

virbr0: flags=4099\<UP,BROADCAST,MULTICAST\> mtu 1500  
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255  
ether 52:54:00:9a:d4:5d txqueuelen 1000 (Ethernet)  
RX packets 0 bytes 0 (0.0 B)  
RX errors 0 dropped 0 overruns 0 frame 0  
TX packets 0 bytes 0 (0.0 B)  
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Jira is running fine (over ssl) on address 10.10.1.13, but when we try to access confluence on 10.10.1.10, the tomcat is using jiras security certificate.

We have correctly set DNS entries for jira and for confluence:

\[root@jira logs\]# nslookup jira.git  
Server: 10.10.1.1  
Address: 10.10.1.1#53

Non-authoritative answer:  
Name: jira.git  
Address: 10.10.1.13

\[root@jira logs\]# nslookup confluence.git  
Server: 10.10.1.1  
Address: 10.10.1.1#53

Non-authoritative answer:  
Name: confluence.git  
Address: 10.10.1.10

We have implemented firewalld rules that allow ports 8080 and 8443 (for jira) and 8090 and 8443 (for confluence). We have also implemented port forwarding on firewalld from port 80 to port 8080 and, respectively, 443 to 8443 for both zones:

\[root@jira logs\]# firewall-cmd --zone=public --list-all  
public (active)  
target: default  
icmp-block-inversion: no  
interfaces: ens192  
sources:  
services: cockpit dhcpv6-client http https ssh  
ports: 8080/tcp 8081/tcp 8443/tcp  
protocols:  
masquerade: yes  
forward-ports: port=80:proto=tcp:toport=8080:toaddr=  
port=443:proto=tcp:toport=8443:toaddr=  
source-ports:  
icmp-blocks:  
rich rules:

\[root@jira logs\]# firewall-cmd --zone=work --list-all  
work (active)  
target: default  
icmp-block-inversion: no  
interfaces: ens192:0  
sources:  
services: cockpit dhcpv6-client ssh  
ports: 8090/tcp 8443/tcp  
protocols:  
masquerade: yes  
forward-ports: port=80:proto=tcp:toport=8090:toaddr=  
port=443:proto=tcp:toport=8443:toaddr=  
source-ports:  
icmp-blocks:  
rich rules:

We have issued SSL certificates for both jira (running on 10.10.1.13) and confluence (running on 10.10.1.10) by our internal authority.

The current behavior is that when we are trying to reach confluence on <https://confluence.git>, we are getting the certificate from jira. The message is that the certificate was issued for a different hostname/IP and when we look into the certificate, it really tells the browser that it is for jira IP address and DNS entry.

Has anyone seen this before? What are we doing wrong?

Please let me know if you need any more specific details.


Answers:
author: Nic Brough -Adaptavist-
body: Where did you install the certificates?

comments: author: Tomas Tudja
body: Hi Nic,

first of all, thanks a bunch for a quick reply.

The certificate is installed in /opt/atlassian/confluence/confluence.jks:

\[root@jira confluence\]# keytool -list -keystore confluence.jks -storepass \<PASSWORD\> -v  
Keystore type: PKCS12  
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: confluence.git  
Creation date: Sep 9, 2020  
Entry type: PrivateKeyEntry  
Certificate chain length: 2  
Certificate\[1\]:  
Owner: EMAILADDRESS=jan.daniel@osc.cz, CN=confluence.git, CN=Jan Daniel, OU=server confluence, O="OSC, a.s.", L=Brno, ST=Czech Republic, C=CZ  
Issuer: CN=OSC-CA, DC=osc, DC=local  
Serial number: 4f0000009430d45c135253730d000000000094  
Valid from: Wed Sep 09 15:49:43 CEST 2020 until: Sun Mar 20 14:52:21 CET 2022  
Certificate fingerprints:  
SHA1: 55:CE:AE:CA:28:20:4B:47:BD:87:DB:73:8A:18:74:AE:8D:CE:01:E6  
SHA256: 11:21:48:E6:E1:E4:6A:BA:96:70:21:F3:55:84:11:71:EE:DC:F4:56:8F:BE:C4:98:19:FF:15:D3:32:08:22:2C  
Signature algorithm name: SHA256withRSA  
Subject Public Key Algorithm: 2048-bit RSA key  
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.4.1.311.20.2 Criticality=false  
0000: 1E 12 00 57 00 65 00 62 00 53 00 65 00 72 00 76 ...W.e.b.S.e.r.v  
0010: 00 65 00 72 .e.r

<br />

#2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false  
AuthorityInfoAccess \[  
\[  
accessMethod: caIssuers  
accessLocation: URIName: ldap:///CN=OSC-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=osc,DC=local?cACertificate?base?objectClass=certificationAuthority  
\]  
\]

#3: ObjectId: 2.5.29.35 Criticality=false  
AuthorityKeyIdentifier \[  
KeyIdentifier \[  
0000: B8 7E 56 87 C6 CE 5C 4E BB B2 3D DC 1A 8B 21 F4 ..V...\\N..=...!.  
0010: 22 87 97 B5 "...  
\]  
\]

#4: ObjectId: 2.5.29.31 Criticality=false  
CRLDistributionPoints \[  
\[DistributionPoint:  
\[URIName: ldap:///CN=OSC-CA,CN=Sx2,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=osc,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint\]  
\]\]

#5: ObjectId: 2.5.29.37 Criticality=false  
ExtendedKeyUsages \[  
serverAuth  
\]

#6: ObjectId: 2.5.29.15 Criticality=false  
KeyUsage \[  
DigitalSignature  
Key_Encipherment  
\]

#7: ObjectId: 2.5.29.17 Criticality=false  
SubjectAlternativeName \[  
DNSName: confluence  
DNSName: confluence.git  
IPAddress: 10.10.1.10  
\]

#8: ObjectId: 2.5.29.14 Criticality=false  
SubjectKeyIdentifier \[  
KeyIdentifier \[  
0000: 08 A3 0C 63 2C 10 E4 10 BE 74 7F 95 FF 08 DA 63 ...c,....t.....c  
0010: 1D 94 E9 D0 ....  
\]  
\]

Certificate\[2\]:  
Owner: CN=OSC-CA, DC=osc, DC=local  
Issuer: CN=OSC-CA, DC=osc, DC=local  
Serial number: 4ec85b16dd1deab3486e4dfa40b0876f  
Valid from: Mon Mar 20 14:42:21 CET 2017 until: Sun Mar 20 14:52:21 CET 2022  
Certificate fingerprints:  
SHA1: 9B:AA:44:5F:F9:66:3A:A7:C8:72:A0:66:C3:F9:81:E0:20:5D:38:CB  
SHA256: 67:1C:9F:D8:A2:8A:78:AF:01:29:82:46:6A:4B:A2:B2:17:A9:08:4E:3F:85:FE:30:04:83:74:18:DD:7E:35:92  
Signature algorithm name: SHA256withRSA  
Subject Public Key Algorithm: 2048-bit RSA key  
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.4.1.311.20.2 Criticality=false  
0000: 1E 04 00 43 00 41 ...C.A

<br />

#2: ObjectId: 1.3.6.1.4.1.311.21.1 Criticality=false  
0000: 02 01 00 ...

<br />

#3: ObjectId: 2.5.29.19 Criticality=true  
BasicConstraints:\[  
CA:true  
PathLen:2147483647  
\]

#4: ObjectId: 2.5.29.15 Criticality=false  
KeyUsage \[  
DigitalSignature  
Key_CertSign  
Crl_Sign  
\]

#5: ObjectId: 2.5.29.14 Criticality=false  
SubjectKeyIdentifier \[  
KeyIdentifier \[  
0000: B8 7E 56 87 C6 CE 5C 4E BB B2 3D DC 1A 8B 21 F4 ..V...\\N..=...!.  
0010: 22 87 97 B5 "...  
\]  
\]

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Do you need any more details?

Thanks again,

Tomas


author: Tomas Tudja
body: UPDATE:

I took a look at the jira SSL configuration on the other NIC and i figured i'll have to add rootca as well. I have done that and now the kaystore looks like this:

\[root@jira confluence\]# keytool -list -keystore confluence.jks -storepass \<PASSWORD\> -v  
Keystore type: PKCS12  
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: confluence.git  
Creation date: Sep 11, 2020  
Entry type: PrivateKeyEntry  
Certificate chain length: 2  
Certificate\[1\]:  
Owner: EMAILADDRESS=jan.daniel@osc.cz, CN=confluence.git, CN=Jan Daniel, OU=server confluence, O="OSC, a.s.", L=Brno, ST=Czech Republic, C=CZ  
Issuer: CN=OSC-CA, DC=osc, DC=local  
Serial number: 4f00000095bfb1c796bbc369ed000000000095  
Valid from: Fri Sep 11 09:26:55 CEST 2020 until: Sun Mar 20 14:52:21 CET 2022  
Certificate fingerprints:  
SHA1: 89:6F:25:D9:1D:70:11:A2:4E:C5:E2:44:C6:87:11:D3:50:30:F2:44  
SHA256: 6D:CA:3E:D1:B8:E0:73:35:D5:DE:5D:E6:4A:D3:08:15:97:FB:8C:11:77:E2:2D:5E:01:E8:D4:47:62:6F:4C:78  
Signature algorithm name: SHA256withRSA  
Subject Public Key Algorithm: 2048-bit RSA key  
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.4.1.311.20.2 Criticality=false  
0000: 1E 12 00 57 00 65 00 62 00 53 00 65 00 72 00 76 ...W.e.b.S.e.r.v  
0010: 00 65 00 72 .e.r

<br />

#2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false  
AuthorityInfoAccess \[  
\[  
accessMethod: caIssuers  
accessLocation: URIName: ldap:///CN=OSC-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=osc,DC=local?cACertificate?base?objectClass=certificationAuthority  
\]  
\]

#3: ObjectId: 2.5.29.35 Criticality=false  
AuthorityKeyIdentifier \[  
KeyIdentifier \[  
0000: B8 7E 56 87 C6 CE 5C 4E BB B2 3D DC 1A 8B 21 F4 ..V...\\N..=...!.  
0010: 22 87 97 B5 "...  
\]  
\]

#4: ObjectId: 2.5.29.31 Criticality=false  
CRLDistributionPoints \[  
\[DistributionPoint:  
\[URIName: ldap:///CN=OSC-CA,CN=Sx2,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=osc,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint\]  
\]\]

#5: ObjectId: 2.5.29.37 Criticality=false  
ExtendedKeyUsages \[  
serverAuth  
\]

#6: ObjectId: 2.5.29.15 Criticality=false  
KeyUsage \[  
DigitalSignature  
Key_Encipherment  
\]

#7: ObjectId: 2.5.29.17 Criticality=false  
SubjectAlternativeName \[  
DNSName: confluence  
DNSName: confluence.git  
IPAddress: 10.10.1.10  
\]

#8: ObjectId: 2.5.29.14 Criticality=false  
SubjectKeyIdentifier \[  
KeyIdentifier \[  
0000: 08 A3 0C 63 2C 10 E4 10 BE 74 7F 95 FF 08 DA 63 ...c,....t.....c  
0010: 1D 94 E9 D0 ....  
\]  
\]

Certificate\[2\]:  
Owner: CN=OSC-CA, DC=osc, DC=local  
Issuer: CN=OSC-CA, DC=osc, DC=local  
Serial number: 4ec85b16dd1deab3486e4dfa40b0876f  
Valid from: Mon Mar 20 14:42:21 CET 2017 until: Sun Mar 20 14:52:21 CET 2022  
Certificate fingerprints:  
SHA1: 9B:AA:44:5F:F9:66:3A:A7:C8:72:A0:66:C3:F9:81:E0:20:5D:38:CB  
SHA256: 67:1C:9F:D8:A2:8A:78:AF:01:29:82:46:6A:4B:A2:B2:17:A9:08:4E:3F:85:FE:30:04:83:74:18:DD:7E:35:92  
Signature algorithm name: SHA256withRSA  
Subject Public Key Algorithm: 2048-bit RSA key  
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.4.1.311.20.2 Criticality=false  
0000: 1E 04 00 43 00 41 ...C.A

<br />

#2: ObjectId: 1.3.6.1.4.1.311.21.1 Criticality=false  
0000: 02 01 00 ...

<br />

#3: ObjectId: 2.5.29.19 Criticality=true  
BasicConstraints:\[  
CA:true  
PathLen:2147483647  
\]

#4: ObjectId: 2.5.29.15 Criticality=false  
KeyUsage \[  
DigitalSignature  
Key_CertSign  
Crl_Sign  
\]

#5: ObjectId: 2.5.29.14 Criticality=false  
SubjectKeyIdentifier \[  
KeyIdentifier \[  
0000: B8 7E 56 87 C6 CE 5C 4E BB B2 3D DC 1A 8B 21 F4 ..V...\\N..=...!.  
0010: 22 87 97 B5 "...  
\]  
\]

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

<br />

Alias name: oscrootca  
Creation date: Sep 11, 2020  
Entry type: trustedCertEntry

Owner: CN=OSC-CA, DC=osc, DC=local  
Issuer: CN=OSC-CA, DC=osc, DC=local  
Serial number: 4ec85b16dd1deab3486e4dfa40b0876f  
Valid from: Mon Mar 20 14:42:21 CET 2017 until: Sun Mar 20 14:52:21 CET 2022  
Certificate fingerprints:  
SHA1: 9B:AA:44:5F:F9:66:3A:A7:C8:72:A0:66:C3:F9:81:E0:20:5D:38:CB  
SHA256: 67:1C:9F:D8:A2:8A:78:AF:01:29:82:46:6A:4B:A2:B2:17:A9:08:4E:3F:85:FE:30:04:83:74:18:DD:7E:35:92  
Signature algorithm name: SHA256withRSA  
Subject Public Key Algorithm: 2048-bit RSA key  
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.4.1.311.20.2 Criticality=false  
0000: 1E 04 00 43 00 41 ...C.A

<br />

#2: ObjectId: 1.3.6.1.4.1.311.21.1 Criticality=false  
0000: 02 01 00 ...

<br />

#3: ObjectId: 2.5.29.19 Criticality=true  
BasicConstraints:\[  
CA:true  
PathLen:2147483647  
\]

#4: ObjectId: 2.5.29.15 Criticality=false  
KeyUsage \[  
DigitalSignature  
Key_CertSign  
Crl_Sign  
\]

#5: ObjectId: 2.5.29.14 Criticality=false  
SubjectKeyIdentifier \[  
KeyIdentifier \[  
0000: B8 7E 56 87 C6 CE 5C 4E BB B2 3D DC 1A 8B 21 F4 ..V...\\N..=...!.  
0010: 22 87 97 B5 "...  
\]  
\]

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

I have also found out that when i connect to jira and look into the certificated received, there is two certificates. One is from the jira server, other one is from ESET. We are probably running some MITM based SSL interception solution internally. I have to talk to our network folks.


Tags: confluence-server

https

server