Crowd and SSL
Asked by lance_lyons:

Hi We have Jira, Confluence, Bamboo and Crucible all setup in an SSL configuration so each site is <https://sitename,> etc. Each of these have user directories in crowd that is connected to applications that have an directory connected to our windows active directory. The connection to crowd in each application uses <http://crowd.onlifehealth.com> (Non SSL). We are wanting to implement SSL for our crowd connections as well.

The assumption is the site would now be <https://crowd.onlifehealth.com.>

I am curious what the best way of doing this is.

We attempted to set up the crowd site in apache (was already setup to reverse proxy to the tomcat app on our server <http://corp-jiraweb:8095>).

So we made the changes to our apache vhosts section as shown at the bottom highlighted.

We did nothing to the server.xml file in crowd

We changed the crowd.properties to reflect the new URL https.

We added the certs to the java keystores that each app uses.

Also all of our apps run on dedicated IP addresses and we have these setup in the vhost section to reverse proxy to the actual port on the server.

NameVirtualHost 10.243.2.193:80  

<br />

\<VirtualHost 10.243.2.193:80\>  
ServerName jira.onlifehealth.com  
Redirect / <https://jira.onlifehealth.com/>

<br />

\</VirtualHost\>

<br />

\<VirtualHost 10.243.3.9:80\>  
ServerName crucible.onlifehealth.com  
Redirect / <https://crucible.onlifehealth.com/>

<br />

\</VirtualHost\>

<br />

\<VirtualHost 10.243.3.8:80\>  
ServerName bamboo.onlifehealth.com  
Redirect / <https://bamboo.onlifehealth.com/>

<br />

\</VirtualHost\>

<br />

\<VirtualHost 10.243.3.10:80\>  
ServerName confluence.onlifehealth.com  
Redirect / <https://confluence.onlifehealth.com/>

<br />

\</VirtualHost\>

<br />

**NameVirtualHost 10.243.3.11:80**

<br />

**\<VirtualHost 10.243.3.11:80\>**   
**ServerName crowd.onlifehealth.com**   
**Redirect / <https://crowd.onlifehealth.com/>**

**\</VirtualHost\>**   

<br />

<br />

**NameVirtualHost 10.243.3.11:443**   
**\<VirtualHost 10.243.3.11:443\>**   
**ServerName crowd.onlifehealth.com**   

**ProxyRequests Off**   
**ProxyPreserveHost On**   
**\<Proxy \*\>**   
**Order deny,allow**   
**Allow from all**   
**\</Proxy\>**   

**SSLEngine On**   
**SSLCertificateFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/crowd.cert"**   
**SSLCertificateKeyFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/crowd.key"**   

**ProxyPass / <http://corp-jiraweb:8095/>**

**ProxyPassReverse / <http://corp-jiraweb:8095/>**

<br />

**\<Location /\>**   
**Order allow,deny**   
**Allow from all**   
**\</Location\>**   
**\</VirtualHost\>**   

NameVirtualHost 10.243.3.10:443  

\<VirtualHost 10.243.3.10:443\>  
ServerName confluence.onlifehealth.com  
ProxyRequests Off  
ProxyPreserveHost On  
\<Proxy \*\>  

Order deny,allow  
Allow from all  
\</Proxy\>  
SSLEngine On  
SSLCertificateFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/confluence.cert"  
SSLCertificateKeyFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/confluence.key"  

ProxyPass / ajp://corp-jiraweb:8019/

<br />

ProxyPassReverse / ajp://corp-jiraweb:8019/

<br />

\<Location /\>  
Order allow,deny  
Allow from all  
\</Location\>  

<br />

<br />

\</VirtualHost\>  

NameVirtualHost 10.243.2.193:443  

\<VirtualHost 10.243.2.193:443\>  
ServerName jira.onlifehealth.com  

ProxyRequests Off  
ProxyPreserveHost On  
\<Proxy \*\>  
Order deny,allow  
Allow from all  
\</Proxy\>  

SSLEngine On  
SSLCertificateFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/jira.cert"  
SSLCertificateKeyFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/jira.key"  

ProxyPass / ajp://corp-jiraweb:8009/  
ProxyPassReverse / ajp://corp-jiraweb:8009

<br />

\<Location /\>  

Order allow,deny  
Allow from all  

\</Location\>  
\</VirtualHost\>  

NameVirtualHost 10.243.3.9:443  

\<VirtualHost 10.243.3.9:443\>  
ServerName crucible.onlifehealth.com  

ProxyRequests Off  
ProxyPreserveHost On  
\<Proxy \*\>  
Order deny,allow  
Allow from all  
\</Proxy\>  

SSLEngine On  
SSLCertificateFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/crucible.cert"  
SSLCertificateKeyFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/crucible.key"  

ProxyPass / <http://corp-jiraweb:8060/>  
ProxyPassReverse / <http://corp-jiraweb:8060/>

<br />

\<Location /\>  
Order allow,deny  
Allow from all  
\</Location\>  
\</VirtualHost\>  

<br />

<br />

<br />

NameVirtualHost 10.243.3.8:443  
\<VirtualHost 10.243.3.8:443\>  
ServerName bamboo.onlifehealth.com  

ProxyRequests Off  
ProxyPreserveHost On  
\<Proxy \*\>  
Order deny,allow  
Allow from all  
\</Proxy\>  

SSLEngine On  
SSLCertificateFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/bamboo.cert"  
SSLCertificateKeyFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/bamboo.key"  

<br />

ProxyPass / <http://corp-jiraweb:8084/>  
ProxyPassReverse / <http://corp-jiraweb:8084/>

<br />

\<Location /\>  
Order allow,deny  
Allow from all  
\</Location\>  
\</VirtualHost\>  

<br />

<br />

<br />

<br />

<br />

<br />

Are we doing this the right way?

Any suggestions?


Answers:
author: PauloP
body: Hi Lance

The settings related to Apache seems to be OK. However, I would suggest to review the HTTP context from Crowd side and enable the tags `proxyName=` and `proxyPort=.`

For further details, please use the following link as your guideline:

<https://confluence.atlassian.com/display/JIRA/Integrating+JIRA+with+Apache+using+SSL#IntegratingJIRAwithApacheusingSSL-Note:AlternativeconfigurationifHTTPSisterminatedontheproxyserver>

Cheers,

Paulo Renato