The certificate on our Cent-OS Service Desk server expired recently and broke authentication to Active Directory. We ended up turning off the SSL option since we couldn't figure out how to get it updated in a timely manner.
I am taking a look at it now and am having trouble seemingly with the first step of the process per: https://confluence.atlassian.com/adminjiraserver/configuring-an-ssl-connection-to-active-directory-938847053.html
In which it says to navigate to $JAVA_HOME. This does not work in command line and I am not familiar enough with Linux to know where this location is. In addition, these directions are for importing a new certificate, not replacing an existing one. Has anyone done this that has a clear cut way of doing it? I wish the original person who set this up used Windows... far easier to manage certs.
Hi! How are you doing?
Usually people create an environment variable pointing to the default Java installation in the machine. In case it is not set, you can just enter the directory of the Java installation that Jira is using. To find the Jira process you could exexute:
ps -ef | grep jira
Sometimes you will see the full path of the Java installation being used in the output of this command above. If it is not there, you could use:
readlink -f /proc/<PID OF YOUR JIRA PROCESS>/exe
The PID of your Jira process is the second value that appears in the result line (first one is username or userid).
You do not have to delete the previous certificate in order to import the new one. You just have to use a different alias.
In case you have any doubt, just let us know.
Hope this helps!
That helps a lot, thanks Cristiano!
I should be able to figure out how to set the JAVA variable now, it is showing the full directory.
Do I just follow the same steps to import the new certificate as if it was a new one then? How do I set Jira to use the new one? Just run the keytool command with the new alias?
Hi @Ian Stuart ! How are you doing?
Yes! You should follow the same steps.
You do not have to tell Java what certificate it should use. It will get the certificate from the target address and will check if it was added to the local keystore (usually cacerts file). If Java finds it, it understands that you trust it and will start the exchange of information.
Hello @Cristiano Mariano thanks for the response. I was able to import the certificate successfully, and it said "trust this certificate?" etc., but when trying to switch Jira to use SSL over LDAP it still errored out with the same one as before.
I tried downloading the SSLPoke.class and running that to test if it could connect via SSL, but try as I might, the command never worked. Do you have a good example of using SSLPoke to test the SSL connection? All the variations from Jira articles failed for me (as in the syntax must be wrong, kept saying could not find "sslpoke.class".
Is there something else I can try for getting the server to use this updated cert? Thank you!
It looks like you're new here. Sign in or register to get started.
