ApplicationLink from Jira To Bitbucket is working, Same link from Confluence To Bitbucket not.
Asked by Jeff Stirn:

Hello,  

we configured our system (jira, confluence and bitbucket) from scheme http to scheme https (SSL-Security).  
We have connected Jira to Confluence and Bitbucket over here new https address and everything is working well. Now when is setup the binding in Confluence to Jira and Bitbucket, only Jira is working well. My bitbucket-link <https://bitbucket.convis.lu> is not working, because the message "The remote certificate can't be trusted".  

Please notice, that jira can connect to bitbucket over the same link.  

When i set the link via http://\<ip\>:\<port\> is it working, but i don't want this.  

I can't figure out why jira can connect and confluence not.  
Do you can help me to solve this issue, please?  

Best regards

**Kai Hagedorn**INFORMATIK / SERVICE INFORMATIQUE

**CONVIS s.c.**   
4, zone artisanale et commerciale  
L-9085 Ettelbruck

Tel.: +352 26 81 20-355  
Fax: +352 26 81 20-655  
E-Mail: [Kai.Hagedorn@convis.lu](mailto:Kai.Hagedorn@convis.lu)  
Website: [www.convis.lu](http://www.convis.lu)  


Answers:
author: Jeff Stirn
body: Finally solved.  

The problem was that jira and bitbucket used java under C:\\Program Files\\Java\\  
and confluence brings and use his own java installation under C:\\Program Files\\Atlassian\\Confluence\\jre.  

Both JAVA-Installations has had its own cacerts (Trust-Store for CA-Certs).  
After adding the missing certs in chain to the file  
"C:\\Program Files\\Atlassian\\Confluence\\jre\\lib\\security\\cacerts" too, confluence was able to connect to bitbucket.  

But there is still one thing, i still couldn't understand:  
Why was Confluence able to connect to Jira without the cert-chain in his trust-store?  
It was the same wildcard-cert.  

<br />

<br />

comments: author: Shannon S
body: Hi Jeff,

Keep in mind that each application can be configured with a different trust store location, so this could cause the issue you are seeing.

Another alternative would be that if they are running within a different JVM, or on a different server, it might not be configured to trust the certificate.

I'm happy to hear you resolve your issue at any rate, and glad the article helped you towards that resolution.

Take care!

Shannon


author: Shannon S
body: Hi Jeff,

According to [an SSL checker](https://www.sslshopper.com/ssl-checker.html?#hostname=bitbucket.convis.lu), you may not have the intermediate certificates installed.

Can you please do that running through this article and let me know if you still have any issues?

* [Unable to Connect to SSL Services Due to PKIX Path Building Failed](https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-779355358.html)

Regards,

Shannon

comments: author: Jeff Stirn
body: Thank you very much for the link.  

It helps me allready a bit.  

<br />

    $JAVA_HOME/bin/java SSLPoke jira.convis.com 443

That command failes as you expected with the error

    sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targe

<br />

If I add now the Parameter

    -Djavax.net.ssl.trustStore=/mypathToTheStoreFile

the test will pass.  

Why Jira doesn't use my keystore?  

Please, see my screenhots from the keystore, jira-configuration and confluence-configuration.  

Keystore  
![Screenshot_Keystore.png](https://community.atlassian.com/t5/image/serverpage/image-id/33191i1484D7C40303E709/image-size/large?v=v2&px=999 "Screenshot_Keystore.png")

Jira-Config![Screenshot_Jira_Configuiration.png](https://community.atlassian.com/t5/image/serverpage/image-id/33190i68AB29347B403909/image-size/large?v=v2&px=999 "Screenshot_Jira_Configuiration.png")  

Confluence-Config (Server.xml)  
For more info see <https://confluence.atlassian.com/x/s3UC>  
==============================================================================================================  
--\>  

\<Connector port="8444" maxHttpHeaderSize="8192"  
maxThreads="150" minSpareThreads="25"  
protocol="org.apache.coyote.http11.Http11NioProtocol"  
enableLookups="false" disableUploadTimeout="true"  
acceptCount="100" scheme="https" secure="true"  
clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1+TLSv1.1+TLSv1.2" SSLEnabled="true"  
URIEncoding="UTF-8"  
keystoreType="JKS" keystorePass="ConVis#2018!!!" keystoreFile="D:\\Atlassian\\ApplicationData\\JIRA\\jira.jks"  
keyAlias="1" /\>  

<br />

<br />

Thanks in advance  

<br />

<br />


author: Jeff Stirn
body: A Part of that problem is solved now. Thank you.  

In the java default cacerts file, was still one intermediate cert missing.  

C:\\Program Files\\Java\\jre1.8.0_151\\bin\>java SSLPoke bitbucket.convis.lu 443  
**Successfully connected**   

Now, i get no erros when i run  

*java SSLPoke bitbucket.convis.lu 443*   

**but the origin problem still exist** .  

![Screenshot_Confluence_AppLink_Settings.png](https://community.atlassian.com/t5/image/serverpage/image-id/33195iA5FA2230F3A9805E/image-size/large?v=v2&px=999 "Screenshot_Confluence_AppLink_Settings.png")![Screenshot_Confluence_AppLinks.png](https://community.atlassian.com/t5/image/serverpage/image-id/33196i221437EC8F03FF71/image-size/large?v=v2&px=999 "Screenshot_Confluence_AppLinks.png")  

<br />

<br />

<br />

<br />

<br />


Tags: bitbucket

confluence-server

server