Problems creating Application Link to Jira
Asked by Chad DeShaw:

Our Confluence uses SSL and LDAP/AD and our Jira is non SSL and uses built in database user store. I have not been able to create an application link from Confluence to Jira it fails on creating the reciprocal link in Jira back to Confluence

What do I need to change or do to make this work?

Does Jira also have to use SSL and LDAP/AD?

Both are server versions.


Answers:
author: Bastian Stehmann
body: Hi [@Chad DeShaw](/t5/user/viewprofilepage/user-id/671272),

What error do you get? Or is there anything in the log files? (INSTALLATION-HOME/logs/atlassian-jira.log or atlassian-confluence.log)

User Directories doesn't matter for application links and it should also work if one application uses SSL and one does not.

comments: author: Chad DeShaw
body: I will post the error in a minute but I have another question should check or uncheck I am an administrator on both instances if my users name is different on both instances?


author: Bastian Stehmann
body: You can check that, the other application will ask you for an admin account if your account does not exist there.


author: Chad DeShaw
body: 2019-01-03 13:35:11,672 http-nio-8080-exec-16 ERROR cdeshaw 815x425067x1 y0qhim 10.20.102.207 /rest/applinks/3.0/applicationlinkForm/manifest.json \[c.a.a.c.rest.ui.CreateApplicationLinkUIResource\] ManifestNotFoundException thrown while retrieving manifest  
com.atlassian.applinks.spi.manifest.ManifestNotFoundException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader.doDownload(AppLinksManifestDownloader.java:198)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader.access$000(AppLinksManifestDownloader.java:50)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader$1$1.\<init\>(AppLinksManifestDownloader.java:127)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader$1.load(AppLinksManifestDownloader.java:121)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader$1.load(AppLinksManifestDownloader.java:118)  
at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527)  
at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319)  
at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282)  
at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2197)  
at com.google.common.cache.LocalCache.get(LocalCache.java:3937)  
at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3941)  
at com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4824)  
at com.google.common.cache.LocalCache$LocalLoadingCache.getUnchecked(LocalCache.java:4830)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader.downloadInternal(AppLinksManifestDownloader.java:106)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader.download(AppLinksManifestDownloader.java:84)  
at com.atlassian.applinks.core.manifest.ManifestRetrieverDispatcher.getManifest(ManifestRetrieverDispatcher.java:43)  
at com.atlassian.applinks.core.rest.ui.CreateApplicationLinkUIResource.tryToFetchManifest(CreateApplicationLinkUIResource.java:163)  
... 3 filtered  
at java.lang.reflect.Method.invoke(Method.java:498)  
... 3 filtered  
at com.atlassian.applinks.internal.rest.interceptor.NoCacheHeaderInterceptor.intercept(NoCacheHeaderInterceptor.java:13)  
... 1 filtered  
at com.atlassian.applinks.core.rest.auth.AdminApplicationLinksInterceptor.intercept(AdminApplicationLinksInterceptor.java:35)  
... 1 filtered  
at com.atlassian.applinks.core.rest.context.ContextInterceptor.intercept(ContextInterceptor.java:16)  
... 15 filtered  
at com.atlassian.plugins.rest.module.RestDelegatingServletFilter$JerseyOsgiServletContainer.doFilter(RestDelegatingServletFilter.java:154)  
... 1 filtered  
at com.atlassian.plugins.rest.module.RestDelegatingServletFilter.doFilter(RestDelegatingServletFilter.java:68)  
... 41 filtered  
at com.atlassian.applinks.cors.rest.CorsFilter.doFilter(CorsFilter.java:99)  
... 3 filtered  
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)  
... 53 filtered  
at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66)  
... 1 filtered  
at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64)  
... 16 filtered  
at com.atlassian.plugins.rest.module.servlet.RestSeraphFilter.doFilter(RestSeraphFilter.java:37)  
... 19 filtered  
at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30)  
... 10 filtered  
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)  
... 4 filtered  
at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36)  
... 26 filtered  
at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25)  
... 24 filtered  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)  
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)  
at java.lang.Thread.run(Thread.java:748)  
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)  
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)  
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)  
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)  
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)  
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)  
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)  
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)  
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)  
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)  
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:396)  
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)  
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)  
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373)  
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)  
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)  
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)  
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)  
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)  
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)  
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)  
at com.atlassian.sal.core.net.HttpClientRequest.executeAndReturn(HttpClientRequest.java:103)  
at com.atlassian.plugins.rest.module.jersey.JerseyRequest.executeAndReturn(JerseyRequest.java:131)  
at com.atlassian.plugins.rest.module.jersey.JerseyRequest.execute(JerseyRequest.java:113)  
at com.atlassian.applinks.core.manifest.AppLinksManifestDownloader.doDownload(AppLinksManifestDownloader.java:165)  
... 256 more  
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)  
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)  
at sun.security.validator.Validator.validate(Validator.java:262)  
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)  
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)  
... 278 more  
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)  
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)  
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)  
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)  
... 284 more  
2019-01-03 13:46:21,854 Caesium-1-2 INFO ServiceRunner \[c.a.j.p.h.service.connect.InstallGlancesJobHandler\] Running InstallGlancesJobHandler...  
2019-01-03 13:46:21,854 Caesium-1-2 INFO ServiceRunner \[c.a.j.p.h.service.connect.InstallGlancesJobHandler\] There is no link to HipChat, no need to install glances.  
2019-01-03 13:46:23,523 Caesium-1-3 INFO ServiceRunner \[c.a.j.p.h.service.ping.RefreshConnectionStatusJobHandler\] Running RefreshConnectionStatusJobHandler...


author: Bastian Stehmann
body: > javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
>
This error often appears when the SSL certificate is not imported in the keystore of the application.

Maybe this helps <https://confluence.atlassian.com/jirakb/checking-ssl-keystore-for-imported-certificates-639238418.html>


author: Chad DeShaw
body: I am confused Jira Keystore or Confluence keystore? Because that was the Jira log I posted


author: Chad DeShaw
body: Not using SSL on jira so why would that need it?


author: Bastian Stehmann
body: You should check it on confluence if you are using SSL there.


author: Chad DeShaw
body: The certificate is imported into the keystore on confluence. So I am still stuck.


author: Bastian Stehmann
body: Hi, I just did some research on this. The certificate must be imported also in the keystore the Jira Application uses. So can you try this please.


author: Bastian Stehmann
body: Here is the link to the FAQ where I found it <https://confluence.atlassian.com/kb/ssl-and-application-link-troubleshooting-guide-719095282.html>


author: Chad DeShaw
body: I tried that too, the cert is also now in the Keystore on Jira


author: Chad DeShaw
body: This is what I see in popup when the reciprocal link is attempting to be created

It has not been possible to retrieve the required information from <https://sstconfluence01.ad.stauer.com:8443>. Therefore the link cannot be created.


author: Chad DeShaw
body: Do I need to restart Jira before this cert in the Keystore will work?

Does it matter that my Jira and Confluence use a different user data store?


author: Chad DeShaw
body: OK I got it to work, I had to restart the Jira server after importing the certificate for it to work.

Thank You!!!


author: Bastian Stehmann
body: You are welcome, great to hear that it works now.


Tags: application-link

jira