Application links over https
Asked by Rafal Niznik:

Hi All

I was just wondering if you can help me solve the configuration issue because I'm running out of ideas.

The whole thing is that I'm not able to establish application link between confluence and jira.

My current configuration:

Jira and Confluence is installed on single linux (debian) server with two network adapters and configured to use https with self-signed certificate.

Confluence is accessible from <https://192.168.1.100:8443> and Jira from <https://192.168.1.101:8444> or by fully qualifiaide doman name. This configuration works ok and I'm able to access those applications without any problems over https and even when switching back to https. Problem stars when I tried to add application links. I was able to add application links when confluence and jira were working on standard pors 8080 and 8090 but not able when I swith back to https.

The error I was able to see wans this "server name may be using a self-signed SSL certificate or a certificate that was issued by a certificate authority that isn't known locally."

Would you be able to assist because I'm running out of ideas how to fix this but I think this has something to do with java root CA

Best Regards

Raf


Answers:
author: Shannon S
body: Hi Raf,

Can you check that the certificate from each application is in the other application's Java truststore? You can read more information about this here:

* [Connecting to LDAP or JIRA applications or Other Services via SSL](https://confluence.atlassian.com/doc/connecting-to-ldap-or-jira-applications-or-other-services-via-ssl-133817.html)

Regards,

Shannon

comments: author: Rafal Niznik
body: Hi Shannon

Confluence and Jira are using currently different self signed certificates but those two certificates are placed in to one store so in this example /etc/ssl/cert.jks


author: AnnWorley
body: Frequently there is a keystore that the application uses to serve it's certificates and another keystore called a "truststore" that contains all the certificate authority certs and any self-signed certs you have added. By default, the truststore is in the Java directory, for example: JAVA_HOME/lib/security/cacerts

Although we are not seeing "pkix path building failed" this article has the details for adding your self-signed cert to the Java truststores for the applications. [Unable to Connect to SSL Services due to PKIX Path Building Failed](https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-779355358.html)

I am pretty sure this is a truststore issue based on "server name may be using a self-signed SSL certificate or a certificate that was issued by a certificate authority that isn't known locally." However, there are more troubleshooting options in this guide: [SSL and application link troubleshooting guide](https://confluence.atlassian.com/applinks/ssl-and-application-link-troubleshooting-guide-790632063.html)


author: Rafal Niznik
body: Ann thanks for advice :-)  
After importing self-signed certs in to default java cacerts the error is gone and I was able to link applications


author: AnnWorley
body: That's great news! Thanks for circling back and accepting the answer. :)


author: Rafal Niznik
body: Actually after linking the application I was not able to establish outgoing and incoming OAuth because configuration error. But I have figured out that under server.xml I had this setting

proxyName="confluence.loc" proxyPort="443"

After removing this everything works now :-)


author: Carl Wiedebaum
body: Hi,

I'm having similar issues, but I have dedicated servers for both Jira and Confluence. Does this mean that I need to have Jiras SSL certificate in Confluences JAVA_HOME/lib/security/cacerts and vice versa for Confluence?

Is there some command or config change that I also need to do? Running on windows server.

Thanks

comments: author: Carl Wiedebaum
body: I used the KeyTool Explorers "Examine SLL" feature to import the Cert to JAVA_HOME cacert file but still cant connect Jira to Confluence.

If I try to create the application link from JIRA I get error that Confluence cant be reached. When I try to create the link from Confluence, it finds the JIRA and creates the link from Confluence to Jira, when I'm forwarded to Jira to complete the application link, in JIRA the completion fails.


author: Carl Wiedebaum
body: Got it! I needed to import the Cert to JRE_HOME/cacert....


author: Ernesto Di Luccia
body: can anyone tell me in which folder do the cert files need to be in order to use HTTPS?

comments: author: Vickey Palzor Lepcha
body: Hello Ernesto - you can keep it in any location you like - but your ssl config file should have a line that points to the certificate location.


author: Vickey Palzor Lepcha
body: My ssl file has a configuration like this - it just points to the location where i have it.

SSLCertificateFile /apache/certificates/certificate_file.pem


author: Ernesto Di Luccia
body: I'll check that out. thank you very much


author: Vickey Palzor Lepcha
body: It was like 4-5 years back - when I introduced apache http infront of jira and confluence - it broke my app link.

I just settled with creating and unproxied link between the two.

Just a thought - is the cert issuing authority same for both the certs and have they been applied in both truststores ?


Tags: application-link