Self Signed

[Fahad Siddiqui]

Hi,

I am generated self signed certificate , can someone assist which flies needs to be shared with system admin of AD so that they can upload it.

[DPKJ · Accepted solution]

@Fahad Siddiquiyou need to share both private key and public certificate.

[Fahad Siddiqui]

Can you please explain more? I have two files on desktop which can me open through Notepad++

[DPKJ]

You need share both these files.

Basically,

• One file is your private key, which is required to be added to your server and need to protected at all times
• Another one is your public certificate, this will served to users.

[Fahad Siddiqui]

when i generated i got two files? how can i know which is private key

[DPKJ]

What tool you have used to generate key files?

if you are using `openssl` it key will have extension `.pem` and certificate file will have extension `.crt`.

Also when you will open private key file in text editor, they will have "---- BEGIN xxx PRIVATE KEY ----" mentioned on top of file.

[Fahad Siddiqui]

Very clear answer thank you.  

Correct me if i am wrong.

Step1 : I will rename the original existing files

Step:2 .Then restart the JIRA instance services. So that the new certificate files will be updated,

Step 3: Then i will ask ADS team to do the required changes? can you please explain here?

what will happen and how it will be done

[DPKJ]

Once you replace existing key/certificate files with new key/certificate files and restart Jira, Jira will start serving with new public certificates.

Since, you are using self signed certificate, your user might need to accept it in there browsers to proceed.

Also, if you are consuming Jira rest resources etc some where you will need to confirm if they are working after certificate changes.

Rest will work as is.

[Fahad Siddiqui]

I dont need to give anything to AD team? and how I need to accept it in there browsers to proceed.?

[DPKJ]

AD team implies?

Certificates are symbol of trust, and browser/os hold list of certain trusted authorities, but when browser access any site that has certificate which is not from it's list of trusted authorities, it will give you warning.

Once you get to this warning page, and as you know that you have generated this certificate yourself you can ask browser to skip warning and mark this certificate as trusted.

You can also mark this certificate trusted beforehand. You can find lots of article on this, e.g.

• https://blogs.technet.microsoft.com/sbs/2008/05/08/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista/