root certificate is showing not trusted even after updating the certificate in the server

Question

the certificate is a SAN certificate and it is uploaded in the keystore configured at Djavax.net.ssl.trustStore=/path/to/keystore and also i have imported in the system-wide keystore also in $JAVA_HOME/jre/lib/security/cacerts.Then i restarted the server,even then it was not working,showing the error like the root certificate is not in the trusted root authorities store.

Andy Heinzer · Answer

I'm not sure why you might not be able to download that file, but I posted it to my google share drive as well, you should also be able to download this class file from this link:

https://drive.google.com/file/d/1X5eobuFPDPk6pJwr2xKYQ9FGiFt4Pkqu/view?usp=sharing

I would recommend that you try to run that utility directly on the Jira Server first, and do so from the Java installation directory that Jira is using to start up.   If you have defined a $JAVA_HOME variable on your system this can help make it more clear exactly where Java is installed, which java Jira is using, and set a standard location of the keystore.   If you have not done this yet, I would recommend doing so per the steps in Installing Java.

This way when you test with sslpoke utility, it can then use the same keystore Jira is using.  This will help us better understand if the problem is with the certificates in the keystore, or something else.

ramani_chandran · Answer

Thanks for your reply on this issue Andrew..

I have tried the Connecting to SSL services article and imported the certificates and restarted the application,still the error did not get resolved.

But when asking the jira support team about the sslpoke test,they told that from the logs which i have sent,it is not required to run the sslpoke.

But now i wish to try that too to see the connectivity issue.kindly help me in installing that sslpoke class file,actually i tried by entering the download url in the server but it gave connection timed out error.

Andy Heinzer · Answer

Could you try to follow the steps in Unable to Connect to SSL Services due to PKIX Path Building Failed?   I'm not sure you're seeing that specific error here yet or not, but I'd like you to try to use the SSLpoke utility listed there to try to connect to this same SSL service from the server running Jira.  I'm interested to see what results you get back.

Did you follow the steps listed in Connecting to SSL services?  I am interested to learn more about your specific problem and the steps you have taken so far here.