I have Internal Jira and Confluence nURL's and I want to expose them externally to individual users.
Asked by Mark Tellier:

I have internal URLs for Jira <http://xxx.xxx.xxx.xxx:8080> and Confluence <http://xxx.xxx.xxx.xxx:8090> and I want to make the URL's public. However, I do not want to make them anonymous, so I am using an ssl cert with current permissions. Is there anythin specific that I need to do to accomplish moving the URl's to public access? I have all the DNS issues resolved, I just need to know if there are any permissions that need to be changes and how to load the SSL Cert into Jira itself.

Thanks,

Mark


Answers:
author: AnnWorley
body: Hi Mark,

The best practice for exposing your URLs publicly and implementing SSL for them is to use a reverse proxy in front of the Atlassian applications. NGINX and Apache are free, here are the docs:

[Integrating JIRA with Nginx](https://confluence.atlassian.com/jirakb/integrating-jira-with-nginx-426115340.html)

[Running Confluence behind NGINX with SSL](https://confluence.atlassian.com/confeap/running-confluence-behind-nginx-with-ssl-849150880.html)

[Securing your Atlassian applications with Apache using SSL](https://confluence.atlassian.com/kb/securing-your-atlassian-applications-with-apache-using-ssl-838284349.html)

To allow the public to access your URLs you will need to open a port on your firewall for SSL - port 443. The proxy will direct requests that are going to https://DNS_NAME over to <http://xxx.xxx.xxx.xxx:8080> so the users won't have to type in the port number.

Thanks,

Ann

comments: author: Mark Tellier
body: Hi Ann,

in this instance we are not using our NGINX firewall and we have Jira in use internally. We have Jira installed on Windows 2012 R2 running internally. what we want to do is have our external user have the ability too log on externally so that we do not have to provide an SSL VPN so that they can log in internally. The server is not running any web services and will just be Natted externally with port forwarding. If I install the SSL cert into the JRE directory will this suffice for our users to log on extarnally?

Thanks,

Mark


author: AnnWorley
body: You have to add the certs to a keystore and define the location of the keystore in the server.xml file for each app. If Confluence and Jira will be connecting to one another for user management or application links and you are using a self signed cert, the certificate for each app will need to be added to the Java trust store of the other app.

Our docs say it better than I do:

[Running Confluence Over SSL or HTTPS](https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html)

[Running JIRA applications over SSL or HTTPS](https://confluence.atlassian.com/adminjiraserver/running-jira-applications-over-ssl-or-https-938847764.html)


author: Mark Tellier
body: Thanks Ann. It is making sense and I am having difficulty with using the Java Keytool. My question now is if I make the modifications\<confluence-install-directory\>/conf/server.xml prior to the firewall cutover, will there be any affect on the internal URL's which everyone is using on a daily basis while we make it public. In other words, will this effort in making Jira public affect in any way the current production instance used on a daily basis. Also, the documentation seems to be for Confluence, would Jira follow the same instructions? Is there support available to assist us in doing this change to public?

Best Regards,

Mark


author: Mark Tellier
body: Hi Ann,

I am moving forward. Would I have to do anything with the config.bat file?

<https://confluence.atlassian.com/adminjiraserver/running-jira-applications-over-ssl-or-https-938847764.html>

Also, would Jira follow the same sequence of events?

Thank you in advance for your response


author: AnnWorley
body: Hi Mark,

I am not sure which sequence of events you mean as far as configuring SSL for Jira - the kb you posted is the right one, though.

Confluence doesn't have a configuration tool for SSL like config.bat (in Jira running on Windows) but if keytool is hard to use, [Portecle](http://portecle.sourceforge.net/) can be a graphical alternative.

As far as whether the existing URL on port 8090 will still be accessible, it will be if you add a second connector directive to the server.xml, on port 443, and leave the existing one in place. (Also, if you [configure a security constraint in web.xml](https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html#RunningConfluenceOverSSLorHTTPS-Step5.AddasecurityconstrainttoredirectallURLstoHTTPS) as documented that will force requests to go to https and the 8090 URL will be unavailable.)

However, the base URL must either be the https one or the http one for several reasons, for example, XSRF errors and invalid URLs being built based on the base URL: [Configuring the Server Base URL](https://confluence.atlassian.com/doc/configuring-the-server-base-url-148592.html)
> Using different URLs. If you configure a different base URL or if visitors use some other URL to access Confluence, it is possible that you may encounter errors while viewing some pages.

Since this is a Production instance I recommend you spin up a test environment that is set up the same way, and test the SSL cutover there before doing it on your "live" system. Here are the docs for Confluence and Jira:

[Restoring a Test Instance from Production](https://confluence.atlassian.com/doc/restoring-a-test-instance-from-production-127369720.html)

[Establishing staging server environments for JIRA applications](https://confluence.atlassian.com/adminjiraserver/establishing-staging-server-environments-for-jira-applications-938846961.html)

Atlassian support is available to recommend SSL configurations but if you need real- time support during the cutover, please consider paying for an Atlassian Solution Partner. To find Solution Partners near you, please try the search tool: [Find Solution Partners](https://www.atlassian.com/partners/search?page=1)

regards,

Ann


Tags: public

ssl