Jenkins behind SSL, my case not going through

sndlt · 07-19-2015, 04:44 PM

I used to use these statemets to put Jenkins behind reverse proxy for TLS in previous previous job. But somehow these are't working anymore.

I referred to all the Jenkins proxy guides on here and and Jenkisn website, but no luck. They all seem to have variations of what I already have/know down in conf files.

So basically, I installed Jenkins and can access via http://its-address:8080; Now I'm triyng to put it reverse proxy through http:its-address so that I can reverse proxy it to https://its-address

I used to able to get through without using a2enmod.

These are what I used to add on httpd.conf and ssl.conf.

[httpd.conf]

Code:

<VirtualHost *:80>
DocumentRoot /var/www/html
ProxyPass / http://localhost:8080 / nocanon
ProxyPassReverse / http://localhost:8080/
ProxyRequests Off
ProxyPreserveHost On
<Proxy http://localhost:8080/*>
Order deny,allow
Allow from all
</Proxy>
</VirtualHost>

[ssl.conf]

Code:

SSLProxyEngine On
ProxyPreserveHost on
ProxyPass / https://localhost:8080
ProxyPassReverse / https://localhost:8080

No matter what I do around syntax, I'm suffering from

Code:

httpd[2410]: AH00526: Syntax error on line 100 of /etc/httpd/conf/httpd.conf:
httpd[2410]: ProxyPass|ProxyPassMatch needs a path when not defined in a location
or
httpd[2401]: Invalid ProxyPass|ProxyPassMatch parameter. Parameter must be in t...lue'.

Am I putting the correct statements?

Seems like I'm not even puting it behind 80 to be able to forward to 443. 443 is currently configured with CA signed keys and the test page is secured.

Help appreciated, thanks.

bathory · 07-20-2015, 03:39 AM

Hi,

You have an error in your ProxyPass definition. The slash "/" has to be right after the port definition and not on its own:

Code:

<snip
ProxyPass / http://localhost:8080/ nocanon
ProxyPassReverse / http://localhost:8080/
<snip>

Also you have to add trailing slashes in the ssl vhost:

Code:

SSLProxyEngine On
ProxyPreserveHost on
ProxyPass / https://localhost:8080/
ProxyPassReverse / https://localhost:8080/

sndlt · 07-20-2015, 09:10 AM

Quote:

Originally Posted by bathory

Hi,

You have an error in your ProxyPass definition. The slash "/" has to be right after the port definition and not on its own:

Code:

<snip
ProxyPass / http://localhost:8080/ nocanon
ProxyPassReverse / http://localhost:8080/
<snip>

Also you have to add trailing slashes in the ssl vhost:

Code:

SSLProxyEngine On
ProxyPreserveHost on
ProxyPass / https://localhost:8080/
ProxyPassReverse / https://localhost:8080/

Thanks for your time.
I'm getting "Service Unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later" at the webpage.

I added what you recommended to both httpd.conf and ssl.conf.

[httpd.conf]

Code:

#  ReWriteCond %{SERVER_PORT} !^443$
#  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
# </VirtualHost>

<VirtualHost *:80>
DocumentRoot /var/www/html
ProxyPass / http://localhost:8080/ nocanon
ProxyPassReverse / http://localhost:8080/
ProxyRequests Off
ProxyPreserveHost On
<Proxy http://localhost:8080/*>
Order deny,allow
Allow from all
</Proxy>
</VirtualHost>



#
# ServerAdmin: Your address, where problems with the server should be
# e-mailed.  This address appears on some server-generated pages, such
# as error documents.  e.g. admin@your-domain.com
#
ServerAdmin root@localhost

[ssl.conf]

Code:

 

SSLCertificateChainFile /etc/pki/tls/certs/DigiCertCA.crt

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt


SSLProxyEngine On
ProxyPreserveHost on
ProxyPass / https://localhost:8080/
ProxyPassReverse / https://localhost:8080/


#   Client Authentication (Type):
#   Client certificate verification t

Thanks again.

sndlt · 07-20-2015, 09:33 AM

Also,

[/etc/sysconfig/jenkins]

Code:

JENKINS_PORT="8080"
JENKINS_LISTEN_ADDRESS="0.0.0.0"
JENKINS_HTTPS_PORT="8081"
JENKINS_HTTPS_LISTEN_ADDRESS="0.0.0.0"

bathory · 07-20-2015, 12:13 PM

Quote:

I'm getting "Service Unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later" at the webpage.

I don't know how jenkins works, but you should make sure that the backend server is running and listening on 127.0.0.1:8080