Application Link to JIRA stopped working after SSL implementation
Asked by Devin Marco:

Hi all,

I'm having this problem with our Confluence and JIRA, both are installed on the same CentOS Server and the application link between the two were established successfully. We recently obtained SSL certs and moved both apps to SSL, since then JIRA is seen as offline by Confluence no matter what URL we tried (and vice versa).

I've followed the instructions from <https://confluence.atlassian.com/display/CONFKB/Unable+to+Connect+to+SSL+Services+due+to+PKIX+Path+Building+Failed>  
however that doesn't seem to our problem because SSLPoke says: successfully connected

Has anyone else encountered similar issues before?  
Any tips of hints is much appreciated, thank you for your time!


Answers:
author: Devin Marco
body: Dear all,

Sorry it took me a while to respond.  
We finally managed to solve the problem, it turns out that for unknown reason, although accessing the Confluence / JIRA from outside will return the publicly signed SSL Cert, accessing either one of them from inside the server itself will return the server's self-signed SSL certificate. I am still not sure why this is the case as both external and internal request both go to the same Apache httpd server.

Therefore the resolution was to add the server's self-signed SSL Certificate to the cacerts of both JIRA and Confluence. Afterwards the Application Links works perfectly.

The Confluence KB has been updated with the step to check what is the SSL Cert being served for internal request and it's worth trying if anyone else is stuck on the same issue:  
<https://confluence.atlassian.com/display/CONFKB/Unable+to+Connect+to+SSL+Services+due+to+PKIX+Path+Building+Failed>

Thank you for all of your inputs!

Cheers,  
Devin


author: Giuliano C.
body: Can you confirm if the JIRA certificate was not inserted (or removed) into the Java that Confluence is using?

Mostly times when it happen, the certificate is not inside the the Java cacerts of your Confluence instance or JIRA, depending on which one not being able to do the connection. So, to check that can you navigate to \*Confluence Admin \> System Information\* and search for \*java.home\*. This will return a path similar to this in your file system:

{{\<$JAVA_HOME\>/jre}}

In this Java Home location you'll find the \*cacerts\* file, which is located at {{\<$JAVA_HOME\>/jre/lib/security/cacerts}}

After this, we can give a try to the steps mentioned in the linked KB article from your side, man.

Hope it helps ya!

Cheers,

Giuliano


author: Danilo Conrad
body: Hi Devin,

The SSLPoke test may pass if you are using a different Java than the one used by the application you are trying to test.

* Have you tried using the SSLPoke passing the trust store (cacerts file) used by JIRA's Java while trying to connect to Confluence (and vice versa)?

For instance, to test the connectivity from JIRA to Confluence, you should run the SSLPoke as below on your JIRA server (if you are using the JIRA bundled JRE):

```
$ java -Djavax.net.ssl.trustStore=/opt/atlassian/jira/jre/lib/security/cacerts SSLPoke &lt;CONFLUENCE_URL&gt; &lt;CONFLUENCE_SSL_PORT&gt;
```

If this does not work, I would highly recommend you to report a support ticket and attach your JIRA logs (Support Zip) to the ticket.

Cheers,

Danilo


author: rrudnicki
body: Hi Devin,

Could you please post any log or error message? So we can better understand what might causing this issue.

Regards,

Renato Rudnicki


Tags: confluence-administration