How to better manage Java keystores?

We have an on-premise installation of various Atlassian products (JIRA, Confluence, Bamboo, Fisheye, Crucible, and Stash) all running behind a corporate firewall. We have enabled HTTPS access for each of these applications by utilizing our F5 load balancer to act as a proxy (which terminates the SSL and handles all certificates).

However, in order to get certain things working correctly (namely, Application Links), I have to import the SSL certificates from each of the applications into the Java keystore files on each server. This can be kind of a pain to maintain... any time a single certificate gets updated, I have several places to go to for importing the new certificate (all of which requires a restart of each application). Also, any time I upgrade Java (or upgrade an application that is using its own internal Java), then I have to re-import each of those certificates.

Is there any way to make this easier? I was hoping that I could just import the Root CA certificate for our corporate network and have that handle all downstream certificates, but that doesn't seem to work.... Does anybody out there have better ideas? How are you handling this in your organizations?

1 answer

1 accepted

Yep this is a pain!  Try the following:

  1. Goto the target app in the browser - most of them will provide a means to look at the certificate chain that is used in the HTTPS connection.
  2. If it's self-signed you have to import that certificate into all of the key stores
  3. If it's locally signed (by your organization) you need to import all of the certificates between the leaf and the root (including the root but not the leaf).  This lets you work with any host that uses a certificate signed by the same local authority.
  4. If signed by a public authority, it should be ok, except I've actually seen situations where an interim certificate needed to be imported.

hth,

 

-Rich 

 

That did the trick, thank you so much! I had tried importing the very top (or root, in your terms), but I hadn't tried doing everything else in the chain, minus the "leaf".

Suggest an answer

Log in or Join to answer
Community showcase
Sarah Schuster
Posted Jan 29, 2018 in Jira

What are common themes you've seen across successful & failed Jira Software implementations?

Hey everyone! My name is Sarah Schuster, and I'm a Customer Success Manager in Atlassian specializing in Jira Software Cloud. Over the next few weeks I will be posting discussion topics (8 total) to ...

3,319 views 14 20
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot