How to integrate Jira with Elasticsearch

Mohit Kumar_vzkuse

When triggering jira tickets from ELK , we getting certificate issue from JIRA side.

ELK is not able to validate the JIRA certificate.

type”: “s_s_l_handshake_exception”,
"reason": "sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",
"caused_by": { "type": "validator_exception", "reason": "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",
"caused_by": {"type": "sun_cert_path_builder_exception","reason": "unable to find valid certification path to requested target"

Andy Heinzer

Hi Mohit,

I see that you are trying to integrate Jira Cloud with Elasticsearch, however you appear to be getting a 'PKIX path building failed' error in the process.

Admittedly, I don't have much experience using Elasticsearch, but this specific error is something I have seen a lot of when Jira Server administrators first try to setup SSL (HTTPS) for Jira Server.  I realize your are using Jira Cloud here. This error though tends to happen when the application (Jira in my experience, but Elasticsearch in your case) does not have the SSL certificate of the destination address in its truststore when the connection request is attempted.   We have a helpful KB for this problem for a number of Atlassian Server products over in Unable to connect to SSL services due to "PKIX Path Building Failed" error.

You might not be able to follow the KB exactly here, since it sounds like the certificate that is needed here is a Jira Cloud one (I'm guessing its something such as example.atlassian.net for a Cloud domain).  However the steps might be similar for your use case here.  I understand that Elasticsearch is a Java application, much like Jira Server is, so it might be more applicable than I initially thought.

Is $JAVA_HOME defined on the operating system environment where you are running Elasticsearch?  I ask because if it is set, it tends to make it much easier to figure out exactly where the truststore is for this JVM.  If it is not set, then it becomes a bit more digging to figure out exactly where that truststore exists for the Java JRE/JDK that is running elasticsearch. We also have steps on how to Set the JAVA_HOME in Installing Java - Atlassian Documentation.

I believe that you could then follow a guide such as How to import a public SSL certificate into a JVM.  The major difference here is that you would be doing these steps to the JVM that elasticsearch is running, as it is not possible for you to do this for an Atlassian Cloud site.

I hope this helps, please let me know if you have any concerns with these steps.

Andy