It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Active Directory SSL Integration

Currently we have LDAPS configured on our AD controller with a certificate from an external PKI.  I have followed the instructions on how to add the certificate(s) to the keystore but I still get an error.

I've added the Root and the Intermediate to the cacerts file with their own alias's and then imported the server cert from the ad controller.  The error I get seems to suggest that the chain is not able to be followed:


Connection test failed. Response from the server:
adserver.fqdn.local:636; nested exception is javax.naming.CommunicationException: adserver.fqdn.local:636 [Root exception is PKIX path building failed: unable to find valid certification path to requested target]

I've tried a few other things but I can't seem to figure out how to link the certs together.  it seems like it should use the thumbprint from each cert to follow the chain of trust but doesn't seem to be working...


4 answers

2 accepted

1 vote
Answer accepted
Davin Studer Community Leader Sep 26, 2017

Did you restart Confluence after importing the certs? Also, try opening the keystore in "keystore explorer". See if it all looks good through there.

Davin Studer Community Leader Sep 26, 2017

Also, did you import the certs to {ConfluenceInstall}/jre/lib/security/cacerts?

1 vote
Answer accepted
Ann Worley Atlassian Team Sep 26, 2017

I imagine you saw this page, since you are aware of the cacerts truststore for Java: Unable to Connect to SSL Services due to PKIX Path Building Failed

That error PKIX path building failed is definitely an SSL error as you surmised. The article I linked above has several points to check under the resolution section. It also links to diagnostic tools that can help you find where the misconfiguration is. Sometimes it's as simple as adding the certs to the right truststore.

I didn't actually see that PKIX website...thanks for that....

C:\Program Files\Atlassian\Confluence\jre\bin>java SSLPoke ad01server.domain.local 636
Successfully connected

So it did connect successfully so the trust is in place it looks like.

You both get a gold star because once i confirmed the ssl cert, I restarted the server (which i didn't see in any of the instructions before) and its working now

Ok..another wrinkle...the LDAP connection to the AD controller is working and passing testing but I can't look up any users.


Test retrieve user : Failedorg.springframework.ldap.PartialResultException: nested exception is javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: domain.local:636 [Root exception is No name matching domain.local found]]

Obviously the ldap is pointing a the AD controller using a certificate for the ADcontroller name....and also obviously there are no certificates for just the domain.local (its just a self signed cert and NOT a SAN cert.

Why does it keep trying to just lookup domain.local when doing a user test.

Our users are just using the account part of the upn (or samAccountName) to login

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Confluence

Confluence Server & Data Center 7.0 is here!

Hello Community 👋🏼 I’m Makisa, a product manager on Confluence Server and Data Center. Confluence Server & Data Center 7.0, our latest platform release, is now available and we wanted to shar...

157 views 0 11
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you