Configure Atlassian Crowd Server - Connection test failed

[Mike Allen]

Attempting to set up Confluence to use Crowd.  Following these steps - https://confluence.atlassian.com/crowd/integrating-crowd-with-atlassian-confluence-198573.html.  Trying to test my connection and get this error - Connection test failed. Response from the server:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Trying to find a log file with more info, but not finding one.  Looked at both Confluence and Crowd folders.

Any ideas of what/where to look?

[Shankar Asam {Appfire} · Accepted solution]

Hi Mike,

It seems your are trying to connect crowd on HTTPS (i.e https://your-crowd-url). Please note that when connecting on https or SSL, it is expected that your SSL certificates should be loaded into Java's Keystore (Confluence's JAVA keystore). Please have your crowd's ssl certificates should be imported into Java keystore. Please take a look at the following atlassian docs for more info;

https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-779355358.html

https://confluence.atlassian.com/kb/connecting-to-ssl-services-802171215.html

-Shankar

[Mike Allen]

I have imported our certs into both confluence and jira and crowd jre\lib\security\cacerts file.  Running SSLPoke shows success.  Restarted all 3 services.  I'm able to log in to each individual site. 

Any other suggestions?

[Mike Allen]

I finally found the correct cacerts file the application was looking for.  Once i added my certs to that one, i was able to link up Crowd to Confluence.

[Shankar Asam {Appfire}]

Good news

[Juho Itä]

TL;DR: Check which cert is offered with by your Crowd:

openssl s_client -showcerts -connect crowd.yourdomain.com:443

I'll add to this topic as it's one of the first that I found via Google and I was fighting quite long time with the certs.

I copied root CA via Firefox to JAVA keystore, but I was still getting the error:

Connection test failed. Response from the server:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I have CentOS 8 as an Apache HTTPS reverse proxy in front of Crowd. With the command above I realised that for some reason, the Apache offers default SSL cert configured in /etc/httpd/conf.d/ssl.conf and not the SSL cert that has been configured in Apache virtual host configuration for crowd.yourdomain.com.

All the browsers are using the certs configured in the Apache virtual host configuration, which made me quite confused as I thought that maybe some certs are cached in browser or something.

You can check which certs the server is offering via command line in Linux and Windows with the command above. Similar command is used also in this Atlassian documentation:
https://confluence.atlassian.com/jira/connecting-to-ssl-services-117455.html