SSL certificate Issue : Unable to get local issuer certificate issue for Jira app over HTTPs

Question

Hello Atlassian Community,

Before diving into problem, here are the details of Jira setup that I have,

* Jira Server : 9.4.14 Data Center
* Base URL : https://qa-jira.com
* Host platform : Kubernetes
* SSL Certificate : Self Signed, Managed by Nginx Ingress controller
* Nginx Ingress : Host = qa-jira.com, Target port = 443, Backend port = 443
* Jira Webserver (server.xml) : Configured with 2 connectors. (1) for HTTP/HTTPS without proxy. Port=8080, Redirect_port=8443 (2) for HTTPS with proxy. Port=8443, ProxyName=qa-jira.com, ProxyPort=443

With this setup, Jira application starts without an issue and can be accessed at 'qa-jira.com'.

But issue is gadgets are not properly getting loaded and internal API calls executed via scripts returns 'Unable to get local issuer certificate'.

Also when I test it with openssl s_client -connect qa-jira.com:443 returns 'verify error:num=20:unable to get local issuer certificate'

Do I have to make any additional configuration in Jira to get this 'Self Signed' certificate to be trusted in Jira? I am not sure.

Your help or suggestions to get more insights on the issue would be very much appreciated.

Thank you.

Yevhen_5guu4k · Answer

You need to follow https://atlassian.github.io/data-center-helm-charts/userguide/CONFIGURATION/#self-signed-certificates

bhimashankar_poddar · Answer

I followed this documentation for SSL certificate configuration in Jira.

https://thejiraguy.com/2021/10/14/adding-ssl-to-jira/

And I am facing the SSL certificate issue...Is there anything missing in this document? I am not sure.

bhimashankar_poddar · Answer

Hi @Ralf Fehling

Thank you for your reply.

I configured 2 connector because one for handling traffic over HTTPs and another for redirecting HTTP --> HTTPs.

But as per your suggestion, i modified 'server.xml' with only one connector 443 with 8443 port for HTTPs and removed another connector.

As per link to redirect http-->https in nginx, tried to configured annotations such as 'ssl-redirect', 'force-ssl-redirect', but issue still persists. Gadgets are not getting loaded and API calls still shows 'unable to get local issuer certificate'

I am not sure, where the things are wrong? At Ingress level (k8s) or at webserver (Jira side) level?