JIRA macro on Confluence returning error "Data cannot be retrieved due to an unexpected error"

[Ramy]

We are using JIRA Cloud in combination with Confluence Server v. 5.7.1.

In our Confluence pages we are using JIRA Macro to link the issues to JIRA. This was working till 15.02.2021. After that date we see now the following message: JIRA Issues Macro: Data cannot be retrieved due to an unexpected error

If I open this URL on our Confluence Server: https://<domain>/admin/listapplicationlinks.action

and try to add new connection our JIRA Domain (https://<username/company>.atlassian.net), we receive the following error (developer tool):

https://<domain>/rest/applinks/2.0/applicationlinkForm/manifest.json?url=https%3A%2F%2F<username/company>.atlassian.net&_=1614161882388

{
"warning": "No response was received from the URL entered. It may not be valid. Please correct the URL below if necessary and click Next.",
"code": "applinks.warning.unknown.host"
}

We checked all setups and network settings. Everything look great and there were no changes.

Both environment are available and accessible.

Do you have an idea where the problem could be?

Thank you in advance

BR, Ramy 

[Daniel Eads · Accepted solution]

Hi Ramy,

On the date you mentioned (February 15), we dropped support for some less-secure ciphers in Atlassian Cloud. You can read the specific details about which ciphers were dropped on this Community post.

It's quite possible that your Confluence 5.7 instance is running on Java 7 still. Java 7 and even some early versions of Java 8 lack the cipher suites necessary to communicate securely with Atlassian Cloud now that we've deprecates the less-secure ciphers. You'll need to update the Java used by Confluence in order to resolve the problem.

You can follow the instructions outlined in this article to upgrade the Java version used by your Confluence install. If you need additional help with changing the Java used, I can assist but will need to know what operating system you're running on. You should be able to use the most recent Java 8 release with your Confluence 5.7 install (at the time of this answer, Java SE 8u281).

Cheers,
Daniel | Atlassian Support

[Ramy]

Hi @Daniel Eads 

Thanks a lot for your detailed answer. 

We already use JAVA version 8 update 211 (Build 1.8.0_211-b12). 

Our Server: Windows Server 2019 Standard

Thank you for your assistance 

Cheers, Ramy

[Daniel Eads]

Interesting! It is worth noting that the Confluence installer comes bundled with its own JDK - you can check and see which Java the instance is using in Confluence's web interface:

1. Choose the cog icon , then choose General Configuration
2. Choose System Information in the left-hand panel.
3. Scroll down to the section titled System Properties.

If Confluence is using the Java that came bundled with the installer, you might find that it doesn't list 1.8.0_211 here. Hopefully this is what you find, as we can continue troubleshooting but it gets a little more difficult. 

https://confluence.atlassian.com/confkb/how-to-use-system-java-instead-of-the-bundled-jre-302811269.html outlines the steps to have Confluence use your system-installed Java rather than the JRE that came bundled with Confluence, assuming the System Properties listed an older version than the one you were expecting from your system install.

-----------

If that's not the case, then there's a cipher mismatch somewhere along the chain between your Confluence server and Atlassian Cloud.

I've tested a 1.8.0_202 jre (just slightly older than your noted 211) and found that it definitely supports the following two ciphers by default, which we have enabled on Atlassian Cloud:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (TLS 1.2)

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (TLS 1.2)

It's possible (although unlikely) that some ciphers were disabled by someone in the past on the JRE you're using. You can follow the instructions on this KB article to test which ciphers are enabled in your specific JRE - although you do need to confirm the same java is being called as you found in the System Properties list in Confluence.

What I think is more likely than disabled ciphers - there might be a proxy or web application firewall trying to intercept traffic between your Confluence server and the Atlassian Cloud site. That application will need to accept connections over TLS 1.2 or 1.3 using the cipher suites noted here. Without knowing the full details of your network setup, that will be a little more difficult to determine. There are a myriad of products that could be doing this function, so if you have a network engineer available, it might be best to simply ask if the outbound connections from your Confluence install are being proxied anywhere.

Cheers,
Daniel

[Ramy]

Hi @Daniel Eads 

Once more thanks a lot for your detailed information and links. We were able to solve our issue :)

Our Confluence Servers was using the bundled JAVA version (1.7.0)

We followed the instruction form the link that you have provided, but it didn't work for us. After a while we found out, that will not work, because our Confluence Servers is running as service.

Therefore we followed the following instruction and that one has helped us: https://confluence.atlassian.com/confkb/how-to-set-system-properties-for-confluence-running-as-a-service-on-windows-873858384.html

On step 4 we used tomcat7w instead of tomcat9w.

Thanks again and stay safe

Ramy