SSL/HTTPS using Self Signed Certs with Portecle

[ISA Admin]

I am using Jira 7.13.0 on a Windows Server

I am using a base URL of Https://jira.companyname.com:8443

I have followed the following links instructions several times, so far unsuccessfully. https://confluence.atlassian.com/adminjiraserver073/running-jira-applications-over-ssl-or-https-861253906.html#RunningJIRAapplicationsoverSSLorHTTPS-jiraconfigtool

I have also imported my JIRA cert to the JAVA cacerts truststore AND to my local machines Trusted Root CA store.

The weird thing is that on my Jira server now when I use my base URL it appears that the certificate is good. If I use localhost:8443 it shows that its bad.

To test I loaded the certs on my office pc but it shows that the cert is no good as well.

[Andy Heinzer]

The fact that you get a bad cert response when using localhost is actually expected.  The certificate is specific to the URL being used to access the site.  And since this appears to work from the Jira server using the jira.example.com address, I suspect that you actually do have Jira setup correctly.

Instead I purpose to you that the limiting factor here is a combination of the use of a self-signed certificate and your client machine not properly having that cert in its own trust store.   Most of the Atlassian guides we have are explaining how to use portecle to install these certs to a java truststore, because our applications use Java.   However I don't think this will help you now, because your client machine using browsers like IE, Edge, Chrome, Firefox are not actually java applications.  Which means they don't use that same Java truststore/keystore that the Jira webserver will be using.  Hence you need to install this self signed cert to the Windows truststore.

With a CA signed cert, your client machine is more likely to already have the root CA cert needed, which can typically be enough for the client to get a secure session.  However since we know you're using a self-signed cert, there is no CA here.

Since you're using Windows, I'm guessing you're likely using IE or Edge browser here.  I would suggest trying to follow the steps in https://stackoverflow.com/questions/681695/what-do-i-need-to-do-to-get-internet-explorer-8-to-accept-a-self-signed-certific

in order to try to install that self-signed cert to your local machine.   I was surprised as well to find that there are a lot more steps to getting this working than just clicking that install certificate link.