Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to get a JIRA install to work behind a Pound proxy that is doing SSL termination/"acceleration". Unfortunately it seems that JIRA (Coyote) is redirecting to HTTPS when accessed:

C:\Users\Josh>openssl s_client -connect www:443
...
---
GET /support HTTP/1.1
Host: www

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Location: http://www/support/
Transfer-Encoding: chunked
Date: Sat, 21 Jul 2012 16:05:03 GMT

0

I can't figure out how to stop this... This is my Pound config:

ignorecase 1

listenhttps
  address 10.3.0.12
  port 443
  cert "/usr/local/etc/bundle.pem"

  service
    headrequire "Host: www"
    url "/support.*"
    backend
      address 10.3.0.16
      port 8080
    end
    session
      type cookie
      ttl 1800
      id "X-SA"
    end
  end
end

Is there any setting in Tomcat or JIRA that would affect this?

share|improve this question
    
Does it send the same redirect when you make the GET request for /support/ instead of /support? –  Shane Madden Jul 21 '12 at 21:53

2 Answers 2

Glad you got it working. I'll try and add a bit of color to this in the event it's useful. When terminating SSL with an upstream device - a proxy, load balancer, etc., the downstream service won't know this. So your Tomcat was seeing normal HTTP traffic, specifically for a URI of just "/". At this point, Tomcat is doing an self referential redirect to /support/, where the application is configured.

When it does this, it builds the URI to use http://... instead of HTTPS://, as it's got literally no idea about the upstream proxy that is doing SSL. By adding the proxyPort and ProxyName directives, above, you've given Tomcat explicit awareness of an upstream device, so it'll now rebuild those redirects using https://, which will work.

--Matt

share|improve this answer
up vote 0 down vote accepted

I figured it out, the proxy settings in Tomcat solved it (proxyPort and proxyName, IIRC).

share|improve this answer
    
Yep, I saw that. I added my answer for posterity; the explanation may help others who come across this post. –  mcauth Jul 23 '12 at 0:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.