Problems with JKS and SSL

Question

I am using Portecle to install a GoDaddy certificate into JIRA. I am using it to create a JKS file for the web server.

I issued the CSR o GoDaddy and got intermediate certs and the site cert back, I split the intermediate bundle as Portecle cannot import groups of certs, it needs them one at a time.

I imported the CA Reply.

When I check the Certificate in the Key Store, it gives me the error:

"The private key could not be found in the key store"

I am following the guide here:

https://confluence.atlassian.com/adminjiraserver073/running-jira-applications-over-ssl-or-https-861253906.html

Do I need to somehow derive the private key from the .crt file?

Dave Theodore [Coyote Creek Consulting] · Answer

It's easy to convert from JKS to PEM format.  A variety of methods are discussed on this Stack Overflow post.

Kabouter Technology · Answer

Ok.

I can see the problems w. using JKS files in Tomcat. But even with a self-signed cert (which I would need to do a reverse proxy) the problem is going to be the same.

Dave Theodore [Coyote Creek Consulting] · Answer

I wouldn't recommend doing it this way. It's a management hassle (as you are learning) and in order to have Jira listen on port 443, you need to run the Java process as root. If a vulnerability allows an attacker to execute arbitrary code, it will run as root and make it easy for someone to compromise your server.

My recommendation would be  to set up a reverse proxy server, such as Apache, and point that at Jira running as an unprivileged user on the default 8080 port.  When your cert expires, you simply replace the cert and key, then bounce apache. Easy peasy.  I hope that helps.