Bamboo: SSL issues after CentOS upgrade
Asked by Martin Mielke:

Dear all,

Bamboo stopped accepting connections on port 8443 after the last OS upgrade we did a few days ago.

Nmap shows this:

---\] START OF PASTED TEXT

PORT STATE SERVICE  
8443/tcp open https-alt  
\| ssl-enum-ciphers:  
\| TLSv1.0:  
\| ciphers:  
\| TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A  
\| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A  
\| compressors:  
\| NULL  
\| cipher preference: client  
\| TLSv1.1:  
\| ciphers:  
\| TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A  
\| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A  
\| compressors:  
\| NULL  
\| cipher preference: client  
\| TLSv1.2:  
\| ciphers:  
\| TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A  
\| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A  
\| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A  
\| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A  
\| compressors:  
\| NULL  
\| cipher preference: client  
\|_ least strength: A

---\] END OF PASTED TEXT

And curl shows this:

---\] START OF PASTED TEXT

$ curl -v https://bamboserver:8443  
\* Rebuilt URL to: <https://bamboo.server:8443/>  
\* Trying 192.168.0.10...  
\* TCP_NODELAY set  
\* Connected to bamboo.server (192.168.0.10) port 8443 (#0)  
\* ALPN, offering h2  
\* ALPN, offering http/1.1  
\* successfully set certificate verify locations:  
\* CAfile: /etc/pki/tls/certs/ca-bundle.crt  
CApath: none  
\* TLSv1.3 (OUT), TLS handshake, Client hello (1):  
\* TLSv1.3 (IN), TLS handshake, Server hello (2):  
\* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):  
\* TLSv1.3 (OUT), TLS handshake, Client hello (1):  
\* TLSv1.3 (IN), TLS handshake, Server hello (2):  
\* TLSv1.3 (OUT), TLS alert, illegal parameter (559):  
\* error:141BD06C:SSL routines:tls_parse_stoc_key_share:bad key share  
\* Closing connection 0  
curl: (35) error:141BD06C:SSL routines:tls_parse_stoc_key_share:bad key share  
$

---\] END OF PASTED TEXT

Any ideas as to why connections to port 8443 yield messages like: "ERR_SSL_PROTOCOL_ERROR" on Google Chrome? Similar ones show with Firefox as well.

Is there any way to fix it?

Thanks and regards,

Martin


Answers:
author: Daniel Ebers
body: Hi Martin,

are you using a reverse proxy in front of Bamboo or what is exactly terminating the SSL connections?

As you mentioned an OS upgrade I rather suspect that something was updated and is not imcompatible (needs probably a fix of one configuration line or the other).  
But I rather suspect this to be an Apache/nginx then Bamboo itself (except you touched Bamboo installation as well).

Are the certificate files still in the proper location, intact and readable?  
I ask because of:
>
> \* error:141BD06C:SSL routines:tls_parse_stoc_key_share:bad key share

Regards,  
Daniel

comments: author: Martin Mielke
body: Hi Daniel,

thanks for your reply.

There are no reverse proxies.

I solved this issue through the Atlassian Support.

We were hit by a known issue: <https://jira.atlassian.com/browse/BAM-21157>

This thread can be closed.

Best,

Martin


Tags: centos

ssl

tls

upgrade