Can SSL certificate for JIRA expire?

[First Last]

Hi all,

Our AD users lost access to JIRA. It happened just abruptly.

Because we a had a working connection JIRA <-> AD.

Long ago we tuned such integration through our home made certificate using "./keytool -import" and it worked.

Yesterday I found out that "ldap.secure" parameter set to "true" I changed it to "false", restarted JIRA but still no access for AD users. 

Log:

Caused by: org.springframework.transaction.CannotCreateTransactionException: Could not create DirContext instance for transaction; nested exception is org.springframework.ldap.CommunicationException: <server name>; nested exception is javax.naming.CommunicationException: <server name>:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] 

So can SSL certificate expire?

And what else can be done to fix it?

Thank you. 

[Manse Wolken · Accepted solution]

Yes, SSL certificates expire.

You need to create a new one and import it to Jira, just as you did with the old one. 

[Dave C]

Also the certificates are stored in the trust store, which is typically cacerts located in a subdirectory the Java home directory. If you make any changes to Java, such as upgrading it, this can overwrite that trust store and you need to re-import the certs.

[Sergey Svishchev]

Better yet, import the CA certificate(s) that sign the LDAP server's certificate.

[First Last]

Thank you all, chaps

A newly generated certificate sorted that out.