Enabling https with Confluence

[Onno van der Straaten]

There is some documentation on how to enable https with Confluence for example https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html

When I follow these instructions I cannot access the site. When I navigate to my test instance I see in the browser

Secure Connection Failed

An error occurred during a connection to collab:8443. Cannot communicate securely with peer: no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP

Nmap shows the ciphers as shown below. The ciphers look a bit strange to me. When I check for example ciphers from other sites I see more and other ciphers. And there is no overlap.

Is it possible to enable https this way? Should I use a different Java - not the embedded jre?

[user@xtop:~] $ nmap --script ssl-enum-ciphers -p 8443 collab

Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-04 09:58 PDT
Nmap scan report for collab (1.1.1.12)
Host is up (0.00042s latency).

PORT STATE SERVICE
8443/tcp open https-alt
| ssl-enum-ciphers: 
| TLSv1.2: 
| ciphers: 
| TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (dh 2048) - C
| TLS_DHE_DSS_WITH_AES_128_CBC_SHA (dh 2048) - A
| TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (dh 2048) - A
| TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 (dh 2048) - A
| TLS_DHE_DSS_WITH_AES_256_CBC_SHA (dh 2048) - A
| TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 (dh 2048) - A
| TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 (dh 2048) - A
| compressors: 
| NULL
| cipher preference: client
| warnings: 
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
|_ least strength: C

Nmap done: 1 IP address (1 host up) scanned in 0.48 seconds
[user@xtop:~] $

[Stephen Sifers]

Hello Onno,

Thank you for including the steps you took and the output from your tests. This type of error can be caused by the certificate that was used/generated. We would suggest reviewing your created certificate and ensure it is using RSA which is supported by default. If you’re needing a cipher outside of RSA we would suggest reviewing the following; Security tools report the default SSL Ciphers are too weak.

I hope this information proves helpful and you’re able to resolve or address your cipher issues.

Regards,
Stephen Sifers