How to add CA cert to Jira's trust store?

[Sanaz Afshar]

Hi everyone,

please participate and help me:

I am going to describe my issue better:

we have our JIRA/Confluence/Bitbucket instance installed on a VMware RHEL server.

we are using :

http://jira.mycompany.com:port#

and

http://confluence.mycompany.com:port#

and

https://bitbucket.mycompany.com

The JIRA and Confluence are connected just fine.

But I can not connect JIRA and Bitbucket.

I am not sure how to trouble shoot this?

Do you think this is relevant with http and https ?

if so, what do I do to resolve this?

Sanaz

[somethingblue · Accepted solution]

Hi Sanaz,

There are a couple kb's that we've produced that go through the steps to add a cert either via the Portecle app or via Terminal.  A basic kb that specifically deals with importing the certificates into the keystore is titled How to import a public SSL certificate into a JVM:

Using Portecle

1. Download and install the Portecle app onto the server that runs your application.
    This is a third-party application and not supported by Atlassian.

2. Ensure the <JAVA_HOME> variable is pointing to the same version of Java that your application uses. See our Setting JAVA_HOME docs for further information on this.
    If running on a Linux/UNIX server, X11 will need to be forwarded when connecting to the server (so you can use the GUI), as below:

   ssh -X user@server

3. Select the Examine menu and then click Examine SSL/TLS Connection
4. Enter the SSL Host and Port of the target system
5. Wait for it to load, then select the public certificate and click on PEM
6. Export the certificate and save it.
7. Go back to the main screen and select the Open an existing keystore from disk option, select cacerts (for example $JAVA_HOME/lib/security/cacerts) then enter the password (the default is changeit).
8. Select the Import a trusted certificate into the loaded keystore button
9. Select the certificate that was saved in step 6 and confirm that you trust it, giving it an appropriate alias (e.g.: confluence).
   • Note: You may hit an error stating "Could not establish a trust path for the certificate.  The certificate information will now be displayed after which you may confirm whether or not you trust the certificate." 
   • If so, hit OK, and then accept the certificate as trusted.
10. Save the Key Store to disk
11. Restart your application.
12. Test that you can connect to the host.

Command Line Installation

1. Fetch the certificate, replacing google.com with the FQDN of the server JIRA is attempting to connect to:
   Unix:

   openssl s_client -connect google.com:443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

   Windows:

   openssl s_client -connect google.com:443 < NUL | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

   The command above will only be executed if you have Sed for Windows as well as OpenSSL installed on your environment. If you don't have Sed or OpenSSL or you don't want to install it, use the instructions below as an alternative. Issue the following command:

   openssl s_client -connect google.com:443

   Save the output to a file called public.cert. Edit the the public.cert file so it contains only what is between the BEGIN CERTIFCATE and END CERTIFICATE lines. This is how your file should look like after you edited it:

   -----BEGIN CERTIFICATE-----
   < Certificate content as fetched by the command line. 
   Don't change this content, only remove what is before 
   and after the BEGIN CERTIFICATE and END CERTIFICATE. 
   That's what your Sed command is doing for you :-) >
   -----END CERTIFICATE-----

2. Import the certificate:

   <JAVA_HOME>/bin/keytool -import -alias <server_name> -keystore <JAVA_HOME>/jre/lib/security/cacerts -file public.crt

   Then enter the password if prompted (the default is changeit).

 Alternative KeyStore Locations

Java will normally use a system-wide keystore in $JAVA_HOME/jre/lib/security/cacerts, but it is possible to use a different keystore by specifying a parameter, -Djavax.net.ssl.trustStore=/path/to/keystore, where '/path/to/keystore' is the absolute file path of the alternative keystore. Information on how to configure JIRA startup variables can be found here.

However, setting this is not recommended because if Java is told to use a custom keystore (eg. containing a self-signed certificate), then Java will not have access to the root certificates of signing authorities found in $JAVA_HOME/jre/lib/security/cacerts, and accessing most CA-signed SSL sites will fail. It is better to add new certificates (eg. self-signed) to the system-wide keystore (as above).

Hopefully that helps!

Cheers,

Branden

[Thomas Deiler]

@somethingblue, ah, your have some templates at hand ... not bad! :)

[Sanaz Afshar]

Wow! that is great.

I did not know that Atlassian has the rock stars like you to support users like me.

:)

I will give it a try, if I face to issue I'll come back here again!

Thanks you all,

Sanaz

[Sanaz Afshar]

@somethingblue

Ok, Finally I am going to start doing this!

wish me luck!

but before that, I have installed JIRA on a VMware server which I is a RedHat linux server.

Does the command just work for unix or it would work for Linux server too?

The reason I am asking this is I am comping from a different background and I want to be sure I'm doing right.

Thanks for helping me.

Best,

Sanaz

[Sanaz Afshar]

I ran the command and I tried to configure application link from the JIRA server, but it give me error:

"Errors of link application on JIRA:

No outgoing authentication

We can't display the status for this application link, because outgoing authentication is disabled. You can enable outgoing authentication to see the status."

I clicked on the link but still lost I'm not sure what to do and how ?

:(

[somethingblue]

Hi Sanaz,

In most instances where I've seen this it was accompanied by the following in the logs:

2017-12-04 12:45:29,500 http-nio-8080-exec-8 ERROR mcelveen 765x249x2 xqjq7g x.x.x.x,x.x.x.x /rest/applinks/3.0/applicationlinkForm/manifest.json [c.a.a.c.rest.ui.CreateApplicationLinkUIResource] ManifestNotFoundException thrown while retrieving manifest
com.atlassian.applinks.spi.manifest.ManifestNotFoundException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

To remedy this:

This means, you're facing the error that I mentioned:

• Unable to Connect to SSL Services due to PKIX Path Building Failed

To fix it, you will need to follow the Resolution here to import the SSL cert of JIRA to the application's truststore and vice versa:

• Connecting to SSL services - Resolution

Let me know how it goes!

Cheers,

Branden

[Sanaz Afshar]

@somethingblue

I have ran the command below on JIRA instance:

openssl s_client -connect google.com:443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

and After that what I should do?

I am lost...

Sorry, it is stressful since this is a production install eI afraid that little mistake can cause bigger issues.

[Sanaz Afshar]

[Sanaz Afshar]

Hi everyone,

please participate and help me:

I am going to describe my issue better:

we have our JIRA/Confluence/Bitbucket instance installed on a VMware RHEL server.

we are using :

http://jira.mycompany.com:port #

and

http://confluence.mycompany.com:port#

and

https://bitbucket.mycompany.com

The JIRA and Confluence are connected just fine.

But I can not connect JIRA and Bitbucket.

I am not sure how to trouble shoot this?

Do you think this is relevant with http and https ?

if so, what do I do to resolve this?

Sanaz

[Thomas Deiler]

Dear @Sanaz Afshar,

do you want just to add a fingerprint of another host certificate to the trust store, so that a connection with a hosts self-signed certificate will be accepted?

Or do you want to do something totally different?

So long

Thomas

[Sanaz Afshar]

Any comment?

please participate for help...

[Thomas Deiler]

The bitbucket uses ssl. What kind of certificate is it? Self-signed? CA signed?

[Sanaz Afshar]

Hi Thomas, 

thank you for the respond, 

Certificate authority (CA)

[Sanaz Afshar]

Once I go to the Configure Application link, some how it is not recognize the https://bitbucket.mycompany.com 

and it says:

"No response was received from the URL you entered - it may not be valid. Please fix the URL below, if needed, and click Continue."

not sure why it is not recognizing it?

I have the CA certification on my Mac at keychain.

[Thomas Deiler]

Dear @Sanaz Afshar,

are all applications installed on the same host? Or 3 different virtual hosts?

Can you login on the host of Jira and do

wget https://bitbucket.mycompany.com

dose this work? What's the output'?

So long

Thomas

[Sanaz Afshar]

yes ,they are on 3 different VMs.

I will do it and will share the result with you.

[Thomas Deiler]

Dear @Sanaz Afshar,

did you get some good results?

So long

Thomas

[Sanaz Afshar]

Hi Thomas,

Thanks for follow up, yes finally!

so I have imported the CA cert and restart the VM and configured the application link!

Thank you all for your support.

Best,

Sanaz