Pre-migration checks not working

M. Scott Vintinner

I'm trying to migrate our on-prem Jira Software instance to the cloud.  Unfortunately, I'm running into all sorts of trouble with the migration assistant.

When I try the "Assess and prepare your users", I get this message:

If I try to jump ahead and migrate just the users, I get this message:

Messages include:

We couldn't check for Jira Work Management availability in cloud
We couldn't check for Jira Software availability in cloud
Some required URLs need authorization for migration
We couldn't check for invalid users
We couldn't check Jira Software user limit of your cloud plan
We couldn't check for Jira Work Management user limit of your cloud plan

 

The server has full access (outbound) to the Internet and I'm not seeing anything blocked on the firewall.

Unfortunately, our Jira instance is small with only 10 users, so I don't qualify for support.  It's super frustrating.

Any help would be appreciated.

M. Scott Vintinner

Posting here in case anyone else has this issue. 

So here's the essential problem: the directions for setting up SSL for Jira (here:  https://confluence.atlassian.com/adminjiraserver073/running-jira-applications-over-ssl-or-https-861253906.html)  instruct you to create a new Java keystore and put your custom SSL certificates in it.  Unfortunately, this will prevent Java from successfully completing any SSL connection to a server whose SSL certificate chain is not in the new keystore. 

Since the cloud migration assistant needs to talk to AWS servers over SSL, it fails because it cannot create the SSL connection without trusted certificate chains (that are missing from the custom keystore created following the directions above).  Normally, java would use the default keystore here, which includes the necessary root certs:

e:\Atlassian\jira\jre\lib\security\cacerts

 

To resolve the issue, I merged the cacerts into my keystore file.  In the example below jira.jks is the custom keystore that has my server's SSL certs in it.  Obviously set your passwords for your keystores as necessary (default is changeit) and make a backup copy of your jks file before doing this.

e:\Atlassian\jira\jre\bin\keytool.exe -importkeystore -srckeystore e:\Atlassian\jira\jre\lib\security\cacerts -destkeystore e:\Atlassian\jira\jira.jks -srcstorepass changeit -deststorepass changeit

After merging the cacerts file with my custom keystore and restarting Jira, the migration wizard checks now all work as expected.

There's probably some fine print somewhere that I could've read to separately specify the cacerts file or something, but this worked in a pinch and our on-prem server's days are numbered anyway.