Exchange of ssl certificates

[Karol Urbaniak]

On my Jira server (RHEL7) I have exchanged ssl certificates. New certificates (cert and key) has been uploaded to Apache virtual host location. 

From JVM point of I have imported public.crt (old cert has been removed), intermediate.ca.crt and root.ca.crt into local cacerts (local keystore is configured in setenv.sh file). 

After restarting of Apache and Jira there wasn't any problem. In browsers all above certificates has been recognized properly. Users are able to use Jira.

For testing purpose I have use SSLPoke class to verify the https connection and this is what I've got:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
at sun.security.validator.Validator.validate(Validator.java:262)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:750)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:138)
at SSLPoke.main(SSLPoke.java:31)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)

It looks like my cert are not being recognized, I have checked them and all looks alright. cacerts is properly configured. Do you have any idea how to troubleshoot it? Is there any debugging mode which could give me an info which cert failed? 

Added after posting:

We have SingleSignOn via Azure. Do you think that it might have influence on that?

[Shankar Asam {Appfire} · Accepted solution]

Hi,

Pls try this step and check if you are able to get connected successfully.

$JAVA_HOME/bin/java -Djavax.net.ssl.trustStore=/my/custom/truststore SSLPoke jira.example.com 443

Replace truststore path to your actual store path.

-Shankar