Problem connecting Confluence to Jira User Directories

Michael Wolfe_r4ge1i

I have both Jira and Confluence running on the same server, both over SSL.  Prior to implementing SSL on both sites, Confluence was capable of synchronizing its user directory with Jira.  Now that SSL is in place on both services, Confluence cannot connect.  When I try to create a new connector, I get this error if I specify https:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Over http I get this:

The following URL does not specify a valid Crowd User Management REST service: http://server.domain.com/rest/usermanagement/1/search?entity-type=user&start-index=0&max-results=1&expand=user

 

They are using the same Java keystore, which is in 

/usr/local/java/jre1.8.0_151, so they should be able to locate each others certs, unless there is a bug where they need to have their own, separate keystores with a copy of cert in the keystore.  Has anyone else experienced this issue?

Dave Theodore [Coyote Creek Consulting]

What type of x509 certs? If they are from a commercial CA, you need to be sure to include the intermediate (chain) cert along with the public and private keys in whatever method you are using to terminate SSL.  

If they are self-signed certs or from your internal or otherwise non-commercial CA, you will need to import them in to the Java key store for the version you are running. If both apps are running the same Java, this can be done once, as both will use the same keystore. I would expect your keystore to be located at /usr/local/java/jre1.8.0_151/lib/security/cacerts It would also be worth verifying you are actually running the Java located in /usr/local/java/jre1.8.0_151 via `ps -ef`

Worst case, set up a plain text connector on each app and use that for your Application Links and to hook Confluence up to JIRA. I'd bind it to localhost to ensure that unencrypted auth traffic stays internal to the box, as well.