Open JDK Certs and Key store required?

[Sriram Subramanian]

Guys,

I have migrated from Java JDK to Open JDK for my jira service desk, just need to know if it is required to use any certs, keystore and trust store for open JDK? Remember we were using it for Java JDK as Jira software runs under SSL certs. So post this migration is this really required to have those certs, key store and truststore? Please clarify. 

Thanks

Sriram 

[Daniel Eads · Accepted solution]

Hi Sriram,

I've just answered your question from a few days ago and think the response there will serve you here at well. In the interest of having answers in both places though, I think you may have two considerations;

Importing certificates into the keystore

There are two situations you might need to do this still:

1. You want Jira to connect to a server that uses a certificate signed by an internal authority (example: LDAPS, Exchange, etc - most common in Windows environments), a public authority that isn't in the default Java keystore, or a self-signed certificate. In this case, you'll import the public certificate using these instructions.
2. You are serving HTTPS/TLS from Jira directly - your users connect to Jira over HTTPS and their connection is not terminated at a reverse proxy. In this case, you'll need to import the public and private certificates into the keystore. Instructions for that are in this document - Running Jira applications over SSL or HTTPS .

Running Jira over SSL

You mentioned you were doing this directly from the application previously. I would recommend, if it fits in your environment setup, to terminate your TLS/SSL connection at a reverse proxy. In my opinion, the setup is less complicated, and it provides more flexibility in your setup. My favourite reverse proxy is nginx, and we have a guide for setting that up with Jira here.

Cheers,
Daniel

[Sriram Subramanian]

Daniel,

Thanks for the response on the certs/keystore thing, I would give it a try, Post the migration to Open JDK, I infact tested my application with Enterprise jira by doing create epic, link epic - which was successful, this does mean that the open JDK is working even without certs required or might be part of the bundle which does authenticate it. 

Regards