This page last changed on Jun 16, 2010 by jhammons.
This page describes how to get Confluence connecting to external servers over SSL, via the various SSL-wrapped protocols. For instance, you may want to:
- Refer to an https://... URL in a Confluence macro.
- Connect to an LDAP directory over SSL.
- Set up JIRA as a trusted application in Confluence, when JIRA is running over SSL.
If you want to run Confluence itself over SSL, see Adding SSL for Secure Logins and Page Security.
Importing SSL Certificates
 | The following commands are in reference to JDK 1.5. For commands/syntax relevant to JDK 1.6, please refer to this document. |
Atlassian User LDAP supports connecting to an LDAP server over SSL/HTTPS. The Trusted Applications protocol requires configuration if JIRA is running over SSL.
- Add the root certificate to your default Java keystore with the following command. This is the certificate that was used to authorise the LDAP server's certificate. It will be either the one that was used for signing it, or will come from further up in the trust chain, possibly the root certificate. This is often a self-signed certificate, when both ends of the SSL connection are within the same network. Again, the exact alias is not important.
- Import your LDAP or JIRA server's public certificate into the JVM Keystore. This is the certificate that the LDAP server will use to set up the SSL encryption. You can use any alias of your choosing in place of "JIRAorLDAPServer.crt".
- Edit the file in your Confluence installation directory, {confluence-installation}\confluence\WEB-INF\classes\atlassian-user.xml. Change the value of securityProtocol from "plain" to "ssl":
Switch the LDAP connection to the SSL port, if it is different from the default LDAP port. If you are using the most common LDAPS port, set:
The keytool will ask you for a password. The default password is 'changeit' without the quotes.
- Verify that the certificate has been added successfully by entering the following command:
- Ensure that you have updated JAVA_OPTS to specify the path to the keystore, as specified in Connecting to SSL services, before restarting Tomcat/Confluence.
There is no need to specify an alias for Confluence to use. On connecting to the LDAP server, it will search through the keystore to find a certificate to match the key being presented by the server.
Troubleshooting
Check the following knowledgebase articles:
RELATED ARTICLES
JIRA Connecting to SSL Services
Confluence Unable to Connect to SSL Services
Configure Web Proxy Support for Confluence
Adding SSL for Secure Logins and Page Security
Troubleshooting SSL
|