Application Link to JIRA stopped working after SSL implementation

[Devin Marco]

Hi all,

I'm having this problem with our Confluence and JIRA, both are installed on the same CentOS Server and the application link between the two were established successfully. We recently obtained SSL certs and moved both apps to SSL, since then JIRA is seen as offline by Confluence no matter what URL we tried (and vice versa).

I've followed the instructions from https://confluence.atlassian.com/display/CONFKB/Unable+to+Connect+to+SSL+Services+due+to+PKIX+Path+Building+Failed
however that doesn't seem to our problem because SSLPoke says: successfully connected

Has anyone else encountered similar issues before?
Any tips of hints is much appreciated, thank you for your time!

[Devin Marco · Accepted solution]

Dear all,

Sorry it took me a while to respond.
We finally managed to solve the problem, it turns out that for unknown reason, although accessing the Confluence / JIRA from outside will return the publicly signed SSL Cert, accessing either one of them from inside the server itself will return the server's self-signed SSL certificate. I am still not sure why this is the case as both external and internal request both go to the same Apache httpd server.

Therefore the resolution was to add the server's self-signed SSL Certificate to the cacerts of both JIRA and Confluence. Afterwards the Application Links works perfectly.

The Confluence KB has been updated with the step to check what is the SSL Cert being served for internal request and it's worth trying if anyone else is stuck on the same issue:
https://confluence.atlassian.com/display/CONFKB/Unable+to+Connect+to+SSL+Services+due+to+PKIX+Path+Building+Failed

Thank you for all of your inputs!

Cheers,
Devin

[Giuliano C_]

Can you confirm if the JIRA certificate was not inserted (or removed) into the Java that Confluence is using?

Mostly times when it happen, the certificate is not inside the the Java cacerts of your Confluence instance or JIRA, depending on which one not being able to do the connection. So, to check that can you navigate to *Confluence Admin > System Information* and search for *java.home*. This will return a path similar to this in your file system:

{{<$JAVA_HOME>/jre}}

In this Java Home location you'll find the *cacerts* file, which is located at {{<$JAVA_HOME>/jre/lib/security/cacerts}}

After this, we can give a try to the steps mentioned in the linked KB article from your side, man.

Hope it helps ya!

Cheers, 

Giuliano

[Danilo Conrad]

Hi Devin,

The SSLPoke test may pass if you are using a different Java than the one used by the application you are trying to test.

• Have you tried using the SSLPoke passing the trust store (cacerts file) used by JIRA's Java while trying to connect to Confluence (and vice versa)?

For instance, to test the connectivity from JIRA to Confluence, you should run the SSLPoke as below on your JIRA server (if you are using the JIRA bundled JRE):

$ java -Djavax.net.ssl.trustStore=/opt/atlassian/jira/jre/lib/security/cacerts SSLPoke <CONFLUENCE_URL> <CONFLUENCE_SSL_PORT>

If this does not work, I would highly recommend you to report a support ticket and attach your JIRA logs (Support Zip) to the ticket.

Cheers,

Danilo

[rrudnicki]

Hi Devin, 

Could you please post any log or error message? So we can better understand what might causing this issue.

Regards, 

Renato Rudnicki