After I replace our SSL Certificate, the old certificate still shows at the website

[kns_jeinhorn]

Dear Jira Gurus,

I successfully replaced SSL Certificates in many of our Atlassian application environments (Bitbucket, Bamboo, and Jira).  All of our Atlassian products run on Linux (CentOS 7) and we use a corporate certificate authority to create our certificates. 

We are transitioning to a new internal CA server, so I need to replace the SSL Certificate in our Jira Development environment.  This development uses CentOS 7 and Jira version 7.13.0.  I followed all the usual steps:

• Found existing keystore file /home/jira/.keystore
• Confirmed that "  keystoreFile="/home/jira/.keystore"  "  is configured in our server.xml file
• Stopped Jira
• Renamed "/home/jira/.keystore" as "/home/jira/.keystore.OLD"
• Used "keytool" to create a new keystore

$ /jira-data/atlassian/jira/jre/bin/keytool -genkeypair -keysize 2048 -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keystore /home/jira/.keystore

• Converted the keystore file as suggested by the warning

sudo /jira-data/atlassian/jira/jre/bin/keytool -importkeystore -srckeystore /home/jira/.keystore -destkeystore /home/jira/.keystore -deststoretype pkcs12

• Used "keytool" to create a certificate request

sudo /jira-data/atlassian/jira/jre/bin/keytool -certreq -keyalg RSA -alias tomcat -file myhost.csr -keystore /home/jira/.keystore -ext san=dns:myhost.corp.mycompany.com,ip:10.xx.yy.zz

• Used our corporate Certificate Authority to generate a certificate file, plus additional certificates for the certificate authority host and internal root certificate authority

$ sudo ls -latr /home/jira
. . . <SNIP> . . .
-rw-------  1 jeinhorn jeinhorn   970 Apr 30 16:01 mycahost.cer
-rw-------  1 jeinhorn jeinhorn   963 Apr 30 16:01 mycompanyRootCA.cer
-rw-------  1 jeinhorn jeinhorn  2090 Apr 30 16:01 myhost.cer

• Imported each certificate into the new keystore

sudo /jira-data/atlassian/jira/jre/bin/keytool -import -alias MycompanyRootCA -trustcacerts -file /home/jira/mycompanyRootCA.cer -keystore /home/jira/.keystore

sudo /jira-data/atlassian/jira/jre/bin/keytool -import -alias LocalCA         -trustcacerts -file /home/jira/mycahost.cer -keystore /home/jira/.keystore

sudo /jira-data/atlassian/jira/jre/bin/keytool -import -alias tomcat                        -file /home/jira/myhost.cer -keystore /home/jira/.keystore

• Used "keytool list -v" to confirm that the new .keystore file reflects the identify of our new certificate authority server
• Restarted Jira

When I connect to Jira and inspect the certificate that is being used, it shows the OLD certificate signed by the OLD certificate server.

I have perused uncountable blogs, articles, and guides on this topic.  And as I said, I have successfully replaced many SSL Certificates in many of our other Atlassian environments.  This environment is a baffling exception. 

To investigate, I tried using "strace -f" with my startup command:

sudo strace -f -o /tmp/strace_start_jira.out /jira-data/atlassian/jira/bin/start-jira.sh

I searched through all the "open" statements of the trace log and found only two files that relate to certificates: 

/home/jira/.keystore and /jira-data/atlassian/jira/jre/lib/security/cacerts 

I meticulously used "keytool list -v" on both these files to confirm that our OLD CA server is NOT referenced in either file, and our NEW CA server IS referenced in /home/jira/.keystore

Still, after I restart Jira, our Jira login page is using the old SSL certificate.  I have spent 3 days hunting for other certificate files on this server, and found none.  Could Jira be caching the old certificate somewhere?  I tried removing all log files in folders /jira-data/atlassian/jira/logs and  /jira-data/var/atlassian/application-data/jira/log and then reviewing these logs after startup.  I don't see any error that could relate to our SSL Certificate.

This has been baffling and painful, considering that I have accomplished the equivalent task in so many other environments.  I would be grateful for any suggestions.

Thanks,
Janet

[Taranjeet Singh · Accepted solution]

@kns_jeinhorn Are you running any proxy server in front of JIRA Server? If yes, there are chances that SSL Certificates have been configured at proxy server.

If no, then you may also try to clear your browser cache and see if the new SSL certificates are picked up.

[kns_jeinhorn]

Hello Taranjeet,

Thanks very much for your suggestion.  I have been sick, and I have not yet had the chance to investigate.  It might be a day or two before I can respond.  I hope the community will leave the thread active and give me some time to reply again.

Regards,
Janet

[kns_jeinhorn]

Hello Taranjeet,

Before I saw your suggestion, I had been searching for files named ".keystore" or "cacerts"

Your response helped me find the solution.  I searched through the http configuration files and found /etc/httpd/conf.d/jira.conf

In this file were the following lines:

    SSLCertificateFile /etc/ssl/myhost.fqdn.com/myhost.fqdn.com.cer
    SSLCertificateKeyFile  /etc/ssl/myhost.fqdn.com/myhost.fqdn.com.key

I was able to replace the SSLCertificateFile and SSLCertificateKeyFile.  Problem solved.

Many Thanks!!

Regards,

Janet