HTTPS failing after Sonar Upgrade

Question

I just completed the upgrade from SonarQube 5.3 to 5.6. I copied my key/values from the prior sonar.properties. Sonar is able to start up on HTTP but is generating errors when attempting to start up only with previously working HTTPS.

My sonar.properties around HTTPS:

sonar.web.port=-1
sonar.web.context=/sonar
sonar.web.https.port=9000
sonar.web.https.keyAlias=<confirmed alias>
sonar.web.https.keyPass=<confirmed password>
sonar.web.https.keystoreFile=<confirmed file>
sonar.web.https.keystoreType=JKS

The error generated with the above config:

2016.06.10 02:05:46 INFO  web[o.s.p.ProcessEntryPoint] Starting web
2016.06.10 02:05:46 WARN  web[o.s.p.ProcessEntryPoint] Fail to start web
java.lang.IllegalStateException: HTTP connectors are disabled
        at org.sonar.server.app.TomcatConnectors.verify(TomcatConnectors.java:64) ~[sonar-server-5.6.jar:na]
        at org.sonar.server.app.TomcatConnectors.configure(TomcatConnectors.java:54) ~[sonar-server-5.6.jar:na]
        at org.sonar.server.app.EmbeddedTomcat.start(EmbeddedTomcat.java:59) ~[sonar-server-5.6.jar:na]
        at org.sonar.server.app.WebServer.start(WebServer.java:42) [sonar-server-5.6.jar:na]
        at org.sonar.process.ProcessEntryPoint.launch(ProcessEntryPoint.java:102) ~[sonar-process-5.6.jar:na]
        at org.sonar.server.app.WebServer.main(WebServer.java:68) [sonar-server-5.6.jar:na]

As a test, I switched back to just HTTP:

sonar.web.port=9000
sonar.web.context=/sonar
#sonar.web.https.port=9000
sonar.web.https.keyAlias=<confirmed alias>
sonar.web.https.keyPass=<confirmed password>
sonar.web.https.keystoreFile=<confirmed file>
sonar.web.https.keystoreType=JKS

The info from that log:

2016.06.10 02:19:11 INFO  web[o.s.s.a.TomcatAccessLog] Web server is started
2016.06.10 02:19:11 INFO  web[o.s.s.a.EmbeddedTomcat] HTTP connector enabled on port 9000
2016.06.10 02:19:11 INFO  web[o.a.c.h.Http11NioProcessor] Error parsing HTTP request header
 Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
java.lang.IllegalArgumentException: Invalid character (CR or LF) found in method name
        at org.apache.coyote.http11.AbstractNioInputBuffer.parseRequestLine(AbstractNioInputBuffer.java:228) ~[tomcat-embed-core-8.0.30.jar:8.0.30]
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1010) ~[tomcat-embed-core-8.0.30.jar:8.0.30]
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:674) [tomcat-embed-core-8.0.30.jar:8.0.30]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500) [tomcat-embed-core-8.0.30.jar:8.0.30]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456) [tomcat-embed-core-8.0.30.jar:8.0.30]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_71]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_71]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.30.jar:8.0.30]
        at java.lang.Thread.run(Thread.java:745) [na:1.8.0_71]

What am I missing that is causing HTTPS to not work?

score 6 · Accepted Answer · answered Jun 10 '16 at 07:31

6

Support of HTTPS was removed in version 5.5. The properties sonar.web.https.* do not exist anymore in conf/sonar.properties. See http://docs.sonarqube.org/display/SONAR/Release+5.5+Upgrade+Notes and https://jira.sonarsource.com/browse/SONAR-7411. For security reasons a reverse-proxy should be used instead.

answered Jun 10 '16 at 07:31

Simon Brandhof

5,137
1
21
28

I understand the pros. However, configuration of HTTPS on Sonar is only optional as is negating most of the cases. What if I want to secure the connection between my reverse-proxy and my application server? – DuckieHo Jun 10 '16 at 13:40
1

@DuckieHo if your web server and sonarqube is on the same server, you don't need it by using localhost connection. If SonarQube is on another server and you don't trust the link between those two servers, just add another web server in front of SonarQube, with this setup you can even allow only a list of IPs that can access it. – Eric Hartmann Jun 10 '16 at 13:52
@EricHartmann Thanks for the addition insight. Seperation of functions does make sense but many of the applications in this space do natively support HTTPS. No worries, just some thing else to configure. – DuckieHo Jun 13 '16 at 04:47

HTTPS failing after Sonar Upgrade

1 Answers1