JIRA を SSL または HTTPS 上で実行する

1. Obtain an SSL certificate

In this section, you will obtain an SSL certificate. An SSL certificate is required in order for SSL to work in JIRA. There are two ways to obtain one:

• by signing one yourself, or
• by getting one signed via a Certificate Authority

If you already have a certificate, you can skip to the Import certificate into the trust store section below.

Generate a self-signed certificate

Self-signed certificates are useful in cases where you require encryption but do not need to verify the website identity. They are commonly used for testing and on internal corporate networks (intranets). Due to the certificate not being signed by a Certification Authority (CA), users may get prompted that the site is untrusted and may have to perform several steps to "accept" the certificate before they can access the site. This usually will only occur the first time they access the site.

To generate a self-signed certificate:

1. Create a new keystore file by running one of the following commands. The keystore file will be created in the home directory of the user you used to run the keytool command.

   オペレーティング システム	JIRA Distribution	コマンド
   Windows	Windows Installer	"<jira-install-dir>\jre\bin\keytool" -genkey -alias tomcat -keyalg RSA
   Windows	'archive' or 'WAR distribution'	"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA
   Linux	すべて	$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA
   Solaris	すべて	$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA

2. When the keytool utility prompts you with 'What is your first and last name?', enter the fully qualified hostname of the server running JIRA. Do not enter your first name and last name.

   What is the fully qualified hostname of my server?

   The fully qualified hostname of your server is the name you would type in your web browser after the http:// (no port number) section to access your JIRA installation. When the client web browser examines the certificate, it checks this field, and makes sure that it matches the hostname. If it doesn't, it may prevent access to the site, and at the very least will generate pop-up messages saying that there is a mismatch. An example of a qualified hostname is: support.atlassian.com. Also, make sure the qualified host name matches the base URL you have set in JIRA (without the port).

3. When the keytool utility prompts you to enter the keystore password and key password for Tomcat, enter your desired passwords. You must use the same value for both passwords. Keep note of this password, as you will need it in the Configuring your web server using the JIRA configuration tool section below.

4. Export the certificate by running one of the following commands. The certificate has to be exported so that it can be imported into the trust store.

   オペレーティング システム	JIRA Distribution	コマンド
   Windows	Windows Installer	"<jira-install-dir>\jre\bin\keytool" -export -alias tomcat -file file.cer
   Windows	'archive' or 'WAR distribution'	"%JAVA_HOME%\bin\keytool" -export -alias tomcat -file file.cer
   Linux	すべて	$JAVA_HOME/bin/keytool -export -alias tomcat -file file.cer
   Solaris	すべて	$JAVA_HOME/bin/keytool -export -alias tomcat -file file.cer

5. Next, follow the instructions in the Import certificate into the trust store section below.

Obtain a certificate authority certificate

Digital Certificate that are issued by trusted 3rd party CAs (Certification Authority) provide verification that your Website does indeed represent your company, thereby verifying your company's identity. Many CAs simply verify the domain name and issue the certificate, whereas other such as VeriSign verifies the existence of your business, the ownership of your domain name, and your authority to apply for the certificate, providing a higher standard of authentication.

A list of CA's can be found here. Some of the most well known CAs are:

• Verisign
• Thawte

Next, follow the instructions in the Import certificate into the trust store section below.

2. Import certificate into the trust store

The instructions in this section are a general guide for importing a certificate into the trust store, assuming your certificate is called "file.cer" (whether obtained by a CA or self-generated). Note, your SSL Vendor may have different instructions, please refer to them for proper certificate installation, e.g. GoDaddy, VeriSign, etc.

To import your certificate into the trust store:

Run one of the following commands. Note, the Linux/Solaris commands must be run as the root user, or with the use of sudo.

"<jira-install-dir>\jre\bin\keytool" -import -alias tomcat -file file.cer

"%JAVA_HOME%\bin\keytool" -import -alias tomcat -file file.cer

$JAVA_HOME/bin/keytool -import -alias tomcat -file file.cer 

$JAVA_HOME/bin/keytool -import -alias tomcat -file file.cer 

Next, configure your web server as described in the Configuring your web server using the JIRA configuration tool section below.

3. Configuring your web server using the JIRA configuration tool

このセクションでは、JIRA での SSL 暗号化設定の最後の手順として、JIRA 設定ツールを利用した web サーバーの設定を行います。JIRA 設定ツールの詳細は、JIRA 構成ツールの利用 をご覧ください。

JIRA 設定ツールを利用してウェブサーバーの設定を行う手順 :

1. 次のように JIRA 設定ツールを起動します :
   
   • Windows: Open a command prompt and run config.bat in the bin sub-directory of the JIRA Installation Directory.
   • Linux/Unix: Open a console and execute config.sh in the bin sub-directory of the JIRA Installation Directory.
2. Click the Web Server tab.
   Screenshot: JIRA configuration tool — 'Web Server' tab
   

3. 各フィールドに次のように入力します :

   フィールド	値
   ポートの制御	Leave as default. You can change the port number if you wish. See Changing JIRA's TCP Ports.
   プロフィール	Profile とはプリセットされたウェブサーバー動作設定です。次の 4 つの値から選択します : 無効 HTTP のみ  HTTP & HTTPS HTTPS のみ JIRA を HTTPS 上で実行する場合は、'HTTP & HTTPS' または 'HTTPS' を選択する必要があります。 JIRA を HTTPS 上で実行するが、ユーザーに HTTP 経由でも JIRA にアクセスさせる場合は、'HTTP & HTTPS' を選択する必要があります。'HTTP & HTTPS' を選択すると、HTTP 経由で JIRA にアクセスするユーザーは HTTPS のアドレスにリダイレクトされます。
   HTTP ポート	Leave as default. You can change the port number if you wish. See Changing JIRA's TCP Ports. This will be disabled if you set the Profile to 'HTTPS only'.
   HTTPS ポート	Leave as default. You can change the port number if you wish. See Changing JIRA's TCP Ports.
   Keystore パス	Specify the location of the keystore of your certificate.
   Keystore パスワード	Specify the password for your keystore. If you generated a self-signed certificate, this is the password you specified for the key and keystore when generating the certificate (see above).
   Keystore エイリアス	Each entry in the keystore is identified by an alias. Specify the alias of your certificate.

4. Check Certificate in Key Store ボタンをクリックして、以下の項目を確認します :
   
   • キーストア内に証明書が存在すること。
   • キーストアのパスワードが有効であること。
   • キーエイリアスを使用してキーを見つけられること。
5. Save ボタンをクリックして設定を保存します。

高度な設定

同一ホストにおける複数のインスタンスの実行

When running more than one instance on the same host, it is important to specify the address attribute in the <JIRA_INSTALLATION>/conf/server.xml file because by default the connector will listen on all available network interfaces, so specifying the address will prevent conflicts with connectors running on the same default port. See the Tomcat Connector documentation for more about setting the address attribute: http://tomcat.apache.org/tomcat-5.5-doc/config/http.html

Redirecting certain pages to HTTPS

You can redirect users from HTTP URLs to HTTPS URLs by choosing the 'HTTP & HTTPS' profile in the JIRA configuration tool. However, if you want to only redirect certain pages to HTTPS, you can do this manually. To do this, select the 'HTTPS only' profile in the JIRA configuration tool and save the configuration. Then edit the WEB-INF/web.xml file and add the following section at the end of the file, before the closing </web-app>:

<security-constraint>
<web-resource-collection>
<web-resource-name>all-except-attachments</web-resource-name>
<url-pattern>*.jsp</url-pattern>
<url-pattern>*.jspa</url-pattern>
<url-pattern>/browse/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

In the example above, all URLs except attachments are redirected from HTTP to HTTPS.

変更を保存したら JIRA を再起動します。

トラブルシューティング

Here are some troubleshooting tips if you are using a self-signed key created by keytool, as described above.

ブラウザに「https://localhost:<port number>」と入力したときに "Cannot establish a connection to the server at localhost:8443" のようなメッセージが表示される場合は、ログ ファイル logs/catalina.out でエラー メッセージを探します。ここには発生する可能性があるいくつかのエラーとそれぞれの説明を紹介します。