Customer email response to Jira SD ticket is not received by Jira

Question

I have a self-hosted Jira SD instance and we are observing the following:

1: Customer emails our inbound support email

2: Ticket creates

3: Customer gets auto-notification that the ticket was created

4: Customer responds, but the email is lost. It does NOT update the ticket, and does not appear to be received by Jira.

We've tested email setup and that appears to be working. This looks like a configuration setting we can't find.

Andy Heinzer · Answer

Hi Lauren,
That error is a pretty specific one in regards to Jira being unable to connect to a host that is using an SSL certificate.  This can happen when Jira is configured to contact a website using SSL like in an application link or it could be a mail host using secure IMAP or secure POP that Jira is trying to get mail from or sending mail with.   We have a pretty comprehensive KB on this error over at Unable to Connect to SSL Services due to PKIX Path Building Failed.

I would recommend trying to follow the diagnosis steps in that KB from the Jira server and see if you can use that SSLPoke utility to reach the URL of your mail server as it is configured in Jira.   Depending on the results of the SSLPoke utility will determine what to do next.  But I suspect that this error most commonly happens because either the truststore Jira is using does not have the correct/valid certificate to connect to that site, or the certificate has expired, etc.   But walking through that KB should tell us more about the problem.

Andy

Lauren V · Answer

Hi Andy – thanks, this helped as a first step, but I do see errors. I’m attaching an image as well as the following text that we are seeing for failed responses. Do you have suggestions for next steps?

Date Email address Status Details Since 18/Dec/17 10:24 AM

Servicetickets@invivolink.com

FAILURE sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 16/Dec/17 9:38 AM 16/Dec/17 9:37 AM

Servicetickets@invivolink.com

FAILURE Connection reset 16/Dec/17 9:37 AM 16/Dec/17 9:36 AM

Servicetickets@invivolink.com

FAILURE Software caused connection abort: recv failed 16/Dec/17 9:36 AM 16/Dec/17 9:35 AM

Servicetickets@invivolink.com

FAILURE sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 10/Dec/17 6:46 AM

Andy Heinzer · Answer

Hi Lauren,

I think that the guide Ivan has suggested could be useful here.  However I wanted to explain in some more detail what to look for here.   Given the specific scenario you have described, it would probably help to take a closer look at the incoming mail log for Jira after the reply has been sent by that user.

You can find this log in the $JIRAHOME/log/ directory.  I would expect it to have a format such as "atlassian-jira-incoming-mail.log".   This log should tell us exactly why that message was not accepted in this case.   I am suspecting that the person that is replying might be doing so from a different email address than the address they received the notification on.  If this happens, then Jira should provide a rejection message along the lines of "abc@example.com does not have permission to comment on this request".   Whereas the notification was actually sent to xyz@example.com.

If that doesn't help progress this problem, then I would want to take a closer look at the specific email address that the user sees in their email client when replying to the message and in turn make sure this matches up with the mailbox in question that Jira is expecting to check for new messages.

Regards,

Andy