如何将组织的Jira项目管理工具从HTTP转换为HTTPS？

Hey there, let's get your Jira switched from HTTP to HTTPS smoothly—sounds like you've hit some roadblocks already, so let's break this down step by step with actionable steps that should fix things:

• For internal testing, you can generate a self-signed certificate, but always use a CA-issued certificate (like Let's Encrypt's free option) for production environments to avoid browser warnings and security gaps.
• Place your certificate files (usually .crt + .key, or a .pfx bundle) in a secure directory on your Jira server—for example, /opt/atlassian/jira/ssl. Make sure the Jira service user has read permissions for this folder.
  • If you have separate .crt and .key files, convert them to a JKS keystore first using this command:

    keytool -importcert -file your-domain.crt -keystore jira-keystore.jks -alias jira-ssl
    

    Follow the prompts to set a keystore password (save this—you'll need it later).

First, back up your server.xml file (found in JIRA_INSTALL/conf/)—better safe than sorry!

• Locate the existing HTTP connector block (looks like this) and either comment it out or replace it:

  <Connector port="8080" protocol="HTTP/1.1"
             connectionTimeout="20000"
             redirectPort="8443"
             maxThreads="48" minSpareThreads="10"
             useBodyEncodingForURI="true"
             enableLookups="false"
             acceptCount="10"
             debug="0"
             URIEncoding="UTF-8"/>
  

• Add the HTTPS connector based on your certificate type:

  For JKS keystore (from .crt/.key): #

  <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
             maxThreads="150" SSLEnabled="true">
      <SSLHostConfig>
          <Certificate certificateKeystoreFile="/opt/atlassian/jira/ssl/jira-keystore.jks"
                       type="RSA"
                       certificateKeystorePassword="your-keystore-password"/>
      </SSLHostConfig>
  </Connector>
  

  For .pfx certificate bundle: #

  <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
             maxThreads="150" SSLEnabled="true">
      <SSLHostConfig>
          <Certificate certificateKeystoreFile="/opt/atlassian/jira/ssl/your-domain.pfx"
                       type="PKCS12"
                       certificateKeystorePassword="your-pfx-password"/>
      </SSLHostConfig>
  </Connector>
  

• Log into your Jira instance (still via HTTP for now) and go to Settings > System > General Configuration.
• Find the Base URL field and replace the HTTP address with your new HTTPS one—e.g., change http://your-jira-domain:8080 to https://your-jira-domain:8443 (or just https://your-jira-domain if you're using a reverse proxy on port 443).

Using Nginx or Apache as a reverse proxy lets you use standard HTTPS port 443 (no need to append :8443 to your URL) and adds an extra layer of security. Here's a quick Nginx example:

• Add this server block to your Nginx config:

  server {
      listen 443 ssl;
      server_name your-jira-domain;
  
      ssl_certificate /path/to/your-domain.crt;
      ssl_certificate_key /path/to/your-domain.key;
  
      location / {
          proxy_pass http://localhost:8080;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
      }
  }
  

• Update your Jira server.xml HTTP connector to recognize the proxy:

  <Connector port="8080" protocol="HTTP/1.1"
             connectionTimeout="20000"
             redirectPort="8443"
             maxThreads="48" minSpareThreads="10"
             useBodyEncodingForURI="true"
             enableLookups="false"
             acceptCount="10"
             debug="0"
             URIEncoding="UTF-8"
             scheme="https"
             proxyName="your-jira-domain"
             proxyPort="443"/>
  

• Add these lines to your jira-config.properties file (create it if it doesn't exist in JIRA_HOME/):

  jira.proxy.port=443
  jira.baseurl=https://your-jira-domain
  

• Restart the Jira service (command varies by OS—e.g., sudo systemctl restart jira for Linux systemd).
• Visit your new HTTPS URL and test:
  • Can you log in successfully?
  • Do all pages load without mixed-content warnings?
  • Are attachments, images, and plugins working correctly?
• If you see mixed-content issues, flush Jira's cache: go to Settings > System > Advanced > Cache management and click "Flush all caches".

• If Jira won't start, check the Catalina logs at JIRA_INSTALL/logs/catalina.out—most issues are wrong certificate paths or incorrect passwords.
• Browser certificate warnings? Self-signed certificates cause this—swap to a CA-issued cert for production.
• Broken links? Double-check your Base URL and reverse proxy headers to ensure Jira knows it's behind HTTPS.

内容的提问来源于stack exchange，提问作者bhawana khimani