SSL Set up

[Burton Simonds]

I am trying to set up SSL and I am having some trouble really understanding how to get the cert and cert path into a Keystore that the Jira application can read. We have our own PKI and I will need to set up the store so that it has our root, sub and cert.

Thanks,

B

[FagnerF · Accepted solution]

Hi Burton,

As a guide you could check out in Running JIRA over SSL or HTTPS documentation.

Also, are you using proxy in front of JIRA? I mean Apache, IIS.

Would you please explain a little bit more what is the main problem you're facing?

Have you configured SSL as described above and got some error? If so which error was it?

I hope it helps.

Cheers.

[Burton Simonds]

Hi, I have read the guide. Where my confusion starts is where is the keystore I should be using? Also, we are using our own PKI so I need to add my own root ca and sub ca to the trusted roots. I am not using an apache reverse proxy.

Thanks for the feedback!

Burton

[FagnerF]

Hi Burton,

Once you have already created a certificate, basically you'll need to:

1. Copy the certificate (including "BEGIN" and "END" lines) and save it on a "YourCertificateName.cert" text file;
2. Import it using Keytool to your keystore file:

   $JAVA_HOME/jre/bin/keytool -import -alias YourCertificateName -file YourCertificateName.cert -keystore /path/to/your/keystore

3. Tip: If you're using Tomcat with SSL, you have to configure *server.xml* file (JiraDirectory\install\conf\sever.xml) as below:

   <Connector 
              port="8443" maxThreads="200"
              scheme="https" secure="true" SSLEnabled="true"
              keystoreFile="/path/to/your/keystore" keystorePass="CertificatePassword"
              clientAuth="false" sslProtocol="TLS"/>
   -->

4. Otherwise, you can just import it on a new keystore and add it on your JIRA startupoptions with the following argument:

   -Djavax.net.ssl.trustStore=/path/to/your/keystore -Djavax.net.ssl.trustStorePassword="CertificatePassword"

5. Restart JIRA and check if SSL is working.

I hope it helps.

Kind Regards