SSL, Apache, Jira and Confluece (application links)

Question

Hi,   We have configured Jira and Confluence to run behind Apache using the Mod_proxy approach described in the Jira/Confluence wiki's.   We have configured both virtual host (jira.domainname.com) and (confluence.domainname.com).and set up certificates for both using OpenSSL.   We are able to get to the sites  https://jira.domainname.com and https://confluence.domainname.com individually with no problem.  Initially when had to get the certificate in the browser and confirm,etc.  However, I am now changing my application links from http://machinename:8083 to https://confluence.domainname.com  to get the integration and have both as trusted applications.

When I do this in Jira for confluence it does not immediately recognize the confluence site.  So I continue to set up the application and configure the trust and we get the error.

Unable to retrieve the application's certificate: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I have imported the certs created with openSSL and used in the apache vhost into the keystore wtih the following approach.

keytool -genkey -alias tomcat -keyalg RSA  -keystore "%JAVA_HOME%\jre\lib\security	omcat"

This asked me all the same questions when I created the cert/key pair and I answered them the same.  first name last name was set to the site name ie, confluence.domainname.com

keytool -genkey -alias tomcat2 -keyalg RSA -keystore "%JAVA_HOME%\jre\lib\security	omcat2"

same as above but for jira.domainname.com

keytool -import -alias confluence -file confluence.cert -keystore "%JAVA_HOME%\jre\lib\security	omcat"

Enter keystore password:
Owner: EMAILADDRESS=Lance_lyons@onlifehealth.com, CN=confluence.onlifehealth.com
, OU=IT, O=Onlife, L=Nashville, ST=TN, C=US
Issuer: EMAILADDRESS=Lance_lyons@onlifehealth.com, CN=confluence.onlifehealth.co
m, OU=IT, O=Onlife, L=Nashville, ST=TN, C=US
Serial number: a222ff8c3e0178d3
Valid from: Thu Aug 25 09:23:46 PDT 2011 until: Sun Aug 22 09:23:46 PDT 2021
Certificate fingerprints:
         MD5:  E8:18:8F:39:B2:34:93:48:17:67:......
         SHA1: 8A:68:FE:48:9B:53:91:20:F2:8.........
         Signature algorithm name: SHA1withRSA
         Version: 1
Trust this certificate? [no]:  yes
Certificate was added to keystore

same for the jira.cert

keytool -import -alias jira -file jira.cert -keystore "%JAVA_HOME%\jre\lib\security	omcat2"

I cant get the application link trust to work.  I made sure I am creating these for the same java that jira is issuing.

What am I missing?

Weijing · Answer

Same issue.

Jira and Confluence running behind Apache and OpenSSL.

I have imported Jira and Confluence certificate into /opt/atlassian/jira/jre/lib/security/cacerts and JIRA/Confluence point to same keystore.

JIRA and Confluence can work fine with https but cannot create application link with error " PKIX path building failed"

lance_lyons · Answer

We finally figure this out.  We had 3 different java installs.   One for Jira,  one for Bamboo (64 bit) and one for Confluence all on the same box.    Each one needs to have the cert that we create with openSSl loaded into the certifcate keystore if you want to link these apps.

We did the following with the keystore command.

keytool -import -alias confluence.onlifehealth.com -file confluence.cert -keystore "C:\Program Files\Java\jre6\lib\security\cacerts"
keytool -import -alias jira.onlifehealth.com -file jira.cert -keystore  "C:\Program Files\Java\jre6\lib\security\cacerts"

We had to do this for each JRE/ JDK in use.

Also the password for the cacerts keystore was "changeit"