Running Confluence over SSL

[earlramirez]

Good Day All,

I have successfull enabled SSL on my lab confluence instance and will like to implement it in a few weeks on two production instances. By default when you generate the self signed certificate its a few months; therefore, I will like to know how can I create a certificate for a year or two.

I would also like to know if the same document "https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html" can be used when the certificate has expired to renew it?

[Daniel Eads {unmonitored account}]

Hi Earl,

When pushing this out to your production instance, you'll want to get a certificate from a trusted Certificate Authority such as Verisign, GeoTrust, Comodo, etc. These providers charge a fee for their service. When you purchase a certificate through a Certificate Authority, you can choose what length of time the certificate should be valid for.

As a rule of thumb, it's easier to manage SSL certificates through a reverse proxy such as nginx or Apache than directly through Tomcat (the application server for JIRA and Confluence). You'll also get some side benefits by using a reverse proxy such as better connection handling, gzip compression, and the ability to make use of http/2.

Check out this Atlassian article on setting up nginx with HTTPS in front of Confluence: https://confluence.atlassian.com/confeap/running-confluence-behind-nginx-with-ssl-849150880.html

I've also written some more detailed instructions on getting nginx set up if you're using CentOS/Ubuntu: https://danieleads.com/turbo-charging-your-confluence-with-nginx/ - small caveat that my article doesn't contain the extra lines in your configuration that you need to get collaborative editing working in Confluence 6.0 - but this only affects Confluence 6.0 and not any versions before/after 6.0.

[earlramirez]

Hi Daniel,

Thanks a lot for your response, it's highly appreciated, I was under the impression that Atlassian does not support any other web server apart from Tomcat.

I will give Nginx a try in the lab instance and see how it goes.

Thanks again.

[Josh Steckler]

Hey Daniel that's a great nginx tutorial! I'll have to try that myself. The chart with the load times, wow. I'll have to benchmark my current apache vs nginx.

[Davin Studer]

As of Confluence 6.1 yo don't need any config changes on the reverse proxy to get collaborative editing working over SSL. :)