Anyone having issues with Jira SSL DB connection with FIPS enabled

[Joe Red]

I am getting the following error when trying to load up Jira:  FIPS mode: only SunJSSE KeyManagers may be used

It is unable to connect to the Postgres DB and Jira is useless.

I am running Jira on a RHEL 8 container with FIPS enabled.

---

2022-01-20 20:51:49,971+0000 JIRA-Bootstrap ERROR [c.a.config.bootstrap.DefaultAtlassianBootstrapManager] Could not successfully test your d
atabase:
org.postgresql.util.PSQLException: Could not initialize SSL context.
at org.postgresql.ssl.LibPQFactory.<init>(LibPQFactory.java:193)
at org.postgresql.core.SocketFactoryFactory.getSslSocketFactory(SocketFactoryFactory.java:61)
at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:34)
at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:534)
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:149)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51)
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:223)
at org.postgresql.Driver.makeConnection(Driver.java:465)
at org.postgresql.Driver.connect(Driver.java:264)
at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:677)
at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:228)
at com.atlassian.config.bootstrap.DefaultAtlassianBootstrapManager.getTestDatabaseConnection(DefaultAtlassianBootstrapManager.java:347)
at com.atlassian.jira.config.database.JdbcDatasource.getConnection(JdbcDatasource.java:224)
at com.atlassian.jira.config.database.DatabaseConfig.testConnection(DatabaseConfig.java:89)
at com.atlassian.jira.health.checks.DbConfigurationAndConnectionCheck.doPerform(DbConfigurationAndConnectionCheck.java:60)
at com.atlassian.jira.health.HealthCheckTemplate.perform(HealthCheckTemplate.java:23)
at com.atlassian.jira.health.DefaultHealthCheckExecutor.runCheck(DefaultHealthCheckExecutor.java:76)
at com.atlassian.jira.health.DefaultHealthCheckExecutor.lambda$applyAndCollectExceptions$1(DefaultHealthCheckExecutor.java:55)
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:177)
at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1801)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:497)
at com.atlassian.jira.health.DefaultHealthCheckExecutor.applyAndCollectExceptions(DefaultHealthCheckExecutor.java:55)
at com.atlassian.jira.health.DefaultHealthCheckExecutor.performHealthChecks(DefaultHealthCheckExecutor.java:44)
at com.atlassian.jira.health.HealthChecks.executeChecksAndRecordResults(HealthChecks.java:164)
at com.atlassian.jira.health.HealthChecks.runHealthChecks(HealthChecks.java:154)
at com.atlassian.jira.health.HealthChecks.runHealthChecks(HealthChecks.java:66)
at com.atlassian.jira.startup.BootstrapContainerLauncher.start(BootstrapContainerLauncher.java:48)
at com.atlassian.jira.startup.DefaultJiraLauncher.preDbLaunch(DefaultJiraLauncher.java:115)
at com.atlassian.jira.startup.DefaultJiraLauncher.lambda$start$0(DefaultJiraLauncher.java:101)
at com.atlassian.jira.util.devspeed.JiraDevSpeedTimer.run(JiraDevSpeedTimer.java:31)
at com.atlassian.jira.startup.DefaultJiraLauncher.start(DefaultJiraLauncher.java:100)
at com.atlassian.jira.startup.LauncherContextListener.initSlowStuff(LauncherContextListener.java:154)
at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.security.KeyManagementException: FIPS mode: only SunJSSE KeyManagers may be used
at java.base/sun.security.ssl.SSLContextImpl.chooseKeyManager(SSLContextImpl.java:167)
at java.base/sun.security.ssl.SSLContextImpl.engineInit(SSLContextImpl.java:83)
at java.base/javax.net.ssl.SSLContext.init(SSLContext.java:297)
at org.postgresql.ssl.LibPQFactory.<init>(LibPQFactory.java:191)
... 40 more

[Joe Red]

To be clear, I am running Jira on a RHEL 8 container with FIPS enabled in  the $JAVA_HOME/conf/security/java.security file.

There has to be someone that has come across this issue!

[Marnix Klooster]

Recently I saw the same symptom, but in a completely different product, no solution yet.  Seems to have been triggered by upgrade of org.postgresql:postgresql from 9.3-1100-jdbc41 to 42.2.10.  (No idea which driver version is used in Jira.)