Jira server Base URL health check fails
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the server and data center platforms.
Problem
The Base URL Health Check verifies if Jira is able to access its own Base URL. Starting in Jira 7.1, gadgets charts are generated using Javascript in the browser rather than server-side with Java. This had significant performance improvements as the server was offloading processing to the browsers and resulted in less CPU usage. Part of the change modified the way Jira previously operated, and now it is required that the server can connect to itself.
Impact
Gadget titles showing as __MSG_gadget.xxxxxxx
, __MSG_gadget.activity.
, __MSG_gadget.filter,
and so on as per the example below:_MSG_gadget.project.title_
For example:
Understanding the Results
Icon | Result | What this means |
---|---|---|
Jira is able to access itself through the configured Base URL | Your dashboard gadgets should be generated and loaded correctly. | |
Jira is not able to access itself through the configured Base URL. This is necessary so that dashboard gadgets can be generated successfully. Please verify the current Base URL and if necessary, review your network configurations to resolve the problem | Your dashboard gadgets may not be loading properly. Please follow the diagnosis and resolution steps below to resolve the problem. |
Diagnosis
Environment
- iptables has been configured to forward packets from 80 to 8080 and/or 443 to 8443
- From the Jira server itself, try curl -v <baseurl> to verify if JIRA is able to communicate with itself.
- Run SSLPoke from the Jira server itself and see if it returns successfully.
- Additionally, run the httpclienttest from the Jira server itself to confirm if the SSL configuration is okay.
- There are application links configured on the instance but they seem to be having issues.
- As the symptoms for both environments are different, diagnosis and resolution steps are segregated into multiple sections below.
- Entries have been configured in the hosts file.
When accessing the Dashboard, the gadgets serve a response that is processed by the client (ie the browser) to generate gadgets. Whilst this happens, the server also connects to itself to provide the gadget's translated strings. Jira uses the URL the instance is connected to, so the JIRA instance needs to be able to access itself.
If it's not able to do so this error will occur. Some known causes are:
- Basic or certificate-based auth on a proxy layer that Jira is behind
- The domain name is not resolvable
- Jira is served on an IP that's in a separate restricted subnet to the server Jira is running on
- Jira is served with a self-signed certificate that doesn't exist in its own trust store
- There are more than 3 redirects between the entry point and the final Jira server (this is tested in the base URL check and also configured in our gadgets).
The recommended best practice is to have Jira served on one domain name only. This can have different IPs (for example internal and external) configured by different DNS, however will only resolve to one domain. For example https://jira.atlassian.com has an external IP of 131.103.28.11
(mapped to by external DNS) and an internal IP of 192.168.1.2
(mapped with an internal DNS). It has one certificate for that FQDN, and all users access it on that domain only.
Additionally, there are some environmental-specific causes to this problem. Please see below for further information.
Resolution
Cause 1:
Jira applications with SSL Configured
The following appears in the atlassian-jira.log
file:
2016-02-26 14:22:28,843 http-bio-8443-exec-11 ERROR admin 862x395x1 m32d6k xx.xx.xx.xx /secure/MyJiraHome.jspa [c.a.g.r.internal.http.HttpClientFetcher] Unable to retrieve response
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)Cause
2022-03-29 23:14:36,116-0700 HealthCheck:thread-1 ERROR ServiceRunner [c.a.t.j.healthcheck.support.GadgetFeedUrlHealthCheck] An error occurred when performing the Gadget feed URL healthcheck
javax.net.ssl.SSLException: Connection reset
at sun.security.ssl.Alert.createSSLException(Alert.java:127)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:324)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:267)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:262)
at sun.security.ssl.SSLTransport.decode(SSLTransport.java:135)
Resolution
- Verify that the Root and Intermediate CA certificates were added to the keystore when SSL was configured.
- Follow our instructions in our Unable to connect to SSL services due to "PKIX Path Building Failed" error knowledge base article for additional details to resolve the problem.
- Restart JIRA (if Data Center, restart all nodes one by one)
Additionally, verify the configuration with httpclienttest as described in the readme of that repository, to gather more detail.
Cause 2: Jira Applications with port forwarding configured
Applies to environments that are using port forwarding, such as iptables:
Cause
If port forwarding has been configured to forward packets from 80 to 8080 and/or 443 to 8443, you may see gadget titles be broken and show as __MSG_gadget.xxxxxxx
. This can happen if the rules are configured only to forward packets from external sources.
Resolution:
You need to create a rule both for packets coming from external IP sources AND for local packets.
For example, in iptables
, it should look like this:
iptables -t nat -I OUTPUT -p tcp -o lo --dport 80 -j REDIRECT --to-ports 8080
For firewalld
:
firewall-cmd --permanent --add-masquerade
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
In Windows, we can use the netsh
command, like this:
netsh interface portproxy add v4tov4 listenport=80 connectport=8080
Cause 3: Jira applications with a broken Proxy configuration
Applies to environments configured to use a Web Proxy. This can be determined by checking the "JVM Arguments" in the System Information screen for existing proxy configurations.
Cause
Jira is unable to communicate with itself due to a Web Proxy not being able to correctly resolve the Jira Server.
Resolution
Add the JIRA Server's hostname/ to the -Dhttp.nonProxyHosts
and -Dhttps.nonProxyHosts
arguments as in Configure an outbound proxy for use in Jira server.
Make sure that the same domain is not being mentioned twice in an argument, e.g. -
Dhttps .nonProxyHosts = jira|confluence|jira
Cause 4: Jira configured with Apache in front with BasicAuth password restriction
Cause
Jira is unable to communicate with itself due to a Web Proxy requiring authentication.
Bug ticket raise - JRA-61273Getting issue details... STATUS
Resolution
Add the Server IP itself for access without password:
Order Allow,Deny
Allow from <hostname>
Satisfy Any
Resolution 2
If using Shibbolethauthentication ,
- leave the /rest URLs outside theshibbolethauthentication.
- /rest URL must not be shibboleth protected.
- Example :
<LocationMatch "^(/rest)/[^/]+">
AuthType None
Require all granted
</LocationMatch>
<LocationMatch "/">
AuthType Shibboleth
ShibRequireSession On
require valid-user
ShibUseEnvironment On
Order allow,deny
Allow from all
</LocationMatch>
Cause 5: Entries have been configured in the hosts file
Cause
Sometimes after server migrations, some errors are shown when there's not DNS in function and an entry is not properly configured in the hosts file.
HealthCheck:thread-3 ERROR [c.a.t.j.healthcheck.support.GadgetFeedUrlHealthCheck] An error occurred when performing the Gadget feed URL healthcheck
org.apache.http.conn.ConnectTimeoutException: Connect to FQDN:443 [FQDN/OLD_IP] failed: connect timed out
Resolution
Check the hosts file in your server and update the IP:
- Linux: /etc/hosts
- Windows: C:\Windows\System32\drivers\etc\hosts