Youtrack over SSL

Avatar
Permanently deleted user
Created
Hello.

Where I can find a detailed instruction how I can configure our YouTrack instance to be used over SSL?

I found a lot of materials regarding Tomcat over SSL and others, but I can't put this working till now.

Can you help me?

Regards,
Sergiu

Votes

0

Share

17 comments
Avatar
Andrey Tigay
Created
Hello Sergiu Sofroni,

Unfortunately, we have no such materials in our documentation yet, as it's not the YouTrack's competency. We have planned to add manuals of the most general cases soon. You are always welcome to ask us all the quesions, even if they are not about YouTrack's side, we'll direct you in the right way.
What particular problems are you experienced?

Thank you.
0
Avatar
Permanently deleted user
Created
Hello Andrey.

The problem is that we have bought some licenses for YouTrack and we want to give access externally for some of our customers. Also we want to do this in secure way.

I’ve found over Internet how to configure Tomcat to use SSL. I’ve created a certification store, bought signed SSL certificates from trusted CA, imported them etc… but I can’t get working YouTrack over SSL.

Can you advice what I’m doing wrong?

PS: I’ve tried to configure also with self-signed certificates, but I still can’t get connected to YouTrack server using secure way on port 443. The port is opened, get connected via Telnet.

Regards,
Sergiu
0
Avatar
Permanently deleted user
Created
Hello Andrey.

I've fixed that.

For the people that encountered the same error, as a fix you should edit the server.xml and to change the protocol for Connector that will be used for secured connection from HTTP/1.1 to org.apache.coyote.http11.Http11NioProtocol. Your config should looks like below

    <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keystoreFile="Your path to keystore file" keystorePass="Your keystore password" />
0
Avatar
Permanently deleted user
Created
I guess you would need to follow http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html to enable SSL certificates which are used by Apache.
0
Avatar
Permanently deleted user
Created
I too am having trouble getting SSL to work for YouTrack.  I've followed the instructions here http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html, on a Windows 2008R2 server, and am getting an error "Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error."

I've tried troubleshooting with curl and this is what I see:
$ curl -Iv https://<my server>.com
  • About to connect() to <my server>.com port 443 (#0)
  •    Trying <IP ADDR>...
  • 0x8001f140 is at send pipe head!
  • STATE: CONNECT => WAITCONNECT handle 0x80057408; line 1032 (connection #0)
  • Connected to <my server>.com (<IP ADDR>) port 443 (#0)
  • successfully set certificate verify locations:
  •    CAfile: /usr/ssl/certs/ca-bundle.crt
  CApath: none
  • SSLv3, TLS handshake, Client hello (1):
  • STATE: WAITCONNECT => PROTOCONNECT handle 0x80057408; line 1145 (connection #0   )
  • Unknown SSL protocol error in connection to <my server>.com:443
  • Closing connection 0
  • The cache now contains 0 members
curl: (35) Unknown SSL protocol error in connection to <my server>.com:443

My connector configuration looks like this:
    <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keystoreFile="C:/bin/.keystore" keystorePass="<password>" keyAlias="tomcat" />

I can still connect over HTTP just fine.

Thanks for your help.
0
Avatar
Permanently deleted user
Created
We ended up using Apache as a HTTPS proxy. We had to bind YouTrack only to local host on port 9876 and we used Apache to proxy to localhost (with SSL configured in Apache). Work like a charm. You also get some simple access control possibilities from Apache as well. I would advice you doing this.
0
Avatar
Andrey Tigay
Created
Dd ofborg, Sergiu

Thank you for your help.

Steven,

I hate to break it to you, but we are not able to solve such issues. We can only suggest you.
So, problem may be because the .keystore doesn;t exist in default directory (as Tomcat thinks). It shouldn't exist inside WAR.
Another assumption is that your SSl was not configured correctly.
Anyways, the best way to solve this is to look at the official Tomcat documentation or to follow this suggestion http://forum.jetbrains.com/message/YouTrack-940-6 .

Thank you.
0
Avatar
Permanently deleted user
Created
We found the problem was a missing intermediate certificate.  I followed the instructions here http://support.godaddy.com/help/article/5239/generating-a-csr-and-installing-an-ssl-certificate-in-tomcat-4x5x6x (our certificate is from godaddy), which is a bit different than the tomcat documentation, and everything is working over SSL now.
0
Avatar
Andrey Tigay
Created
Steven,

That's great.
Thank you for useful link.
0
Avatar
Permanently deleted user
Created
This is exactly what we'd like to do, but we're having some trouble getting it set up. Would you mind sharing your Apache config with me?
0
Avatar
Permanently deleted user
Created
Try this manual: https://www.adwordsrobot.com/en/content/blog/youtrack-behind-apache-proxy-over-ssl
0
Avatar
Permanently deleted user
Created
We got it working. Thanks!
0
Avatar
Permanently deleted user
Created

Thank you for contacting IQMS.  I will be out of the office October 7th.  While I am out I will have limited access to email. If you require immediate assistance please contact Automation at automation@iqms.com.

I look forward to assisting you upon my return.

Steven Bryden
Automation Software Engineer
Phone:  805.227.1122 Ext. 297
Fax:  805.227.1120

By Your Side, Every Step of the Way, From Start to Finish

For more information on IQMS products or services, please visit our website at www.iqms.com<http://www.iqms.com/>
0
Avatar
Permanently deleted user
Created
I'm also struggling with this a Windows installation...I managed to get it working on a TeamCity installation but fail doing it on the YouTrack installation (different server). Are there any other help files/resources or tools to assist me with this?
0
Avatar
Permanently deleted user
Created

Here’s the mail I got recently for my problem

Disable QUIC Protocol
in URL write "chrome://flags/#enable-quic Protocol" and hit Enter,
if will be selected as Default, now click on that drop-down and select Disabled, 
now click on Relaunch in bottom.

2) Update the system Time
3) Disable unknown or unused extensions
4) Check if there is restrictions on Firewall or not.

If you error is still not solved, or getting other SSL error please visit <ERR_SSL_PROTOCOL_ERROR – Fix by deskdecode>

     

0
Avatar
Liubov Dievskaia
Created

Hello John, I'm sorry, but it's not clear for me, could you please elaborate, what you issue is exactly? How can we help you? Thank you.

0
Avatar
Permanently deleted user
Created

There are two ways to fix it, You can Proxy or you can ERR_SSL_PROTOCOL_ERROR mentor Hope it will work for you.

0

Please sign in to leave a comment.