How to run Bitbucket Server over HTTPS with a Personal Information Exchange (PFX) keystore
Platform Notice: Server and Data Center Only - This article only applies to Atlassian products on the server and data center platforms.
Atlassian applications allow the use of SSL within our products, however Atlassian Support does not provide assistance for configuring it. Consequently, Atlassian cannot guarantee providing any support for it.
- If assistance with conversions of certificates is required, please consult with the vendor who provided the certificate.
- If assistance with configuration is required, please raise a question on Atlassian Answers.
Certificates with the extension
.p12 usually use PKCS12 as encryption mechanism and this type of certificate is possible to be used in Tomcat without any conversion.
Usually certificates generated by Microsoft's Certification Authority console use PKCS12.
You can check the Keystore type of your certificate using the following keytool command "keytool -list -keystore path_to_certificate.pfx -storetype PKCS12" and in case it's indeed PKCS12 you'll see the following output:
$ keytool -list -keystore cert.pfx -storetype PKCS12 Enter keystore password: Keystore type: PKCS12 Keystore provider: SunJSSE Your keystore contains 1 entry
- Shutdown Bitbucket Server
- Bitbucket Server 5.0+
Adjust the connector properties in
bitbucket.propertiesas described in Securing Bitbucket Server with Tomcat using SSL. To set the keystore type, set the following:
- Bitbucket Server 4.14 and below
Adjust your SSL connector into the
server.xmlfile. This is an example of SSL connector using keystoreType="PKCS12":
<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" maxHttpHeaderSize="8192" SSLEnabled="true" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" keystoreFile="C:\path_to_cert\certificate.pfx" keystorePass="certificate_password" keyAlias="1" keystoreType="PKCS12" clientAuth="false" connectionTimeout="20000" sslProtocol="TLS" useBodyEncodingForURI="true"/>
Restart Bitbucket Server.