Bitbucket SSL errors

[Pawel Leczycki]

Fresh bitbucket installation is working on http (7990).

When we try to switch to the https (443 or 8443) there is error on bitbucket starting.

Some details:

Bitbucket v6.8.1

Bitbucket keystore

---------------------------------

Keystore type: PKCS12

Keystore provider: SUN

Your keystore contains 1 entry

tomcat, Mar 1, 2020, PrivateKeyEntry,

echo $JAVA_HOME

/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.232.b09-0.el8_0.x86_64

bitbucket.properties

-------------------------------

server.port=443

server.scheme=https

server.ssl.enabled=true

server.ssl.key-store-type=pkcs12

server.ssl.key-store=/var/atlassian/application-data/bitbucket/shared/config/ssl-keystore/bitbucket.jks

Bitbucket log:

------------------

426 ERROR [main]  o.apache.catalina.util.LifecycleBase Failed to start component [Connector[HTTP/1.1-443]

Caused by: java.net.SocketException: Permission denied

The Tomcat connector configured to listen on port 443 failed to start. The port may already be in use or the connector may be misconfigured.

Action:

Verify the connector's configuration, identify and stop any process that's listening on port 443, or configure this application to listen on another port.

Network:

--------------

netstat -tupan | grep 443

returns empty list

The same is with 8443 port.

[Eyal Goren]

Assuming you created the keystore correctly, then-

server.ssl.key-store-type should have the value "jks", not "pkcs12".

[Pawel Leczycki]

With "jks" also not working.

[Eyal Goren]

1) Please verify the configuration is OK,  it should looks like this-

server.secure=true
server.scheme=https
server.port=8443
server.ssl.enabled=true
server.ssl.client-auth=want
server.ssl.protocol=TLSv1.2
server.ssl.key-alias=<Alias>
server.ssl.key-store-type=jks

And in addition we have two fields-

server.ssl.key-store-password=
server.ssl.key-password=

2) Verify the keystore 

keytool -list -v -keystore /var/atlassian/application-data/bitbucket/shared/config/ssl-keystore/bitbucket.jks --store-pass <Same password you configure in the file>

Check that the relevant certificate exist with the same alias as the server.ssl.key-alias value