Does Jira and Confluence need different certs to enable SSL?

[Amos Nung]

I recently enabled SSL on both Jira and Confluence and I am trying to see if I need to create certs for both Jira and Confluence. Or can the cert in Jira be enough to enble SSL for both Jira and Confluence. For more context they are running on the same server with different ports.  

I am pretty new to the subject and want to have a better understanding.

[Andrew Laden]

Depends on if they will be using the same URL or not.

SSL Certs basically work off the hostname portion of the URL. When you sign a SSL Cert, the signer is validating that you own the hostname that the cert is signed for.

So if both your Jira and confluence are on the same server, but you use different paths for them you can use the same cert. (ie https://my.host.name/jira and https://my.host.name/confluence.)

SSL Certs also have a feature called "Subject Alternative Names" (or SAN) if you put all possible hostnames as additional SAN fields in the Sert signing request, then you can use that cert on any of the hosts listed in the SAN records.

[Amos Nung]

Thank you @Andrew Laden , your explanation really helps. Based on what you've explained I should only need one ssl cert for both sites. However I do have a follow up question.

Both Jira and Confluence is hosted on one server. Similar to your example, they use different paths. Currently, SSL is enabled on both sites.

However, my question/concern is when I initially created the certs, I had made one for Confluence and Jira. Will having two certs have a negative impact? Do I need to delete/remove the extra cert?  

[Andrew Laden]

Shouldn't make a difference. 

You have to tell your webserver/appserver what cert to use. Since you are running on different ports, I believe that each port needs to be told what cert to use. In your server.xml files in the connector port settings, there is a "keystoreFile" and related parameters. No reason why you couldn't have your jira point to a keystore holding your jira cert, and your confluence pointing to one holding the other cert. Also no reason why you couldn't have them pointing to the same keystore.

Make sure to read https://confluence.atlassian.com/adminjiraserver/running-jira-applications-over-ssl-or-https-938847764.html

if you haven't yet.

Also, depending on who signed your certs you might want to check if they are valid. If you requested 2 certs for the same host, some CA's may revoke the old one before signing the new.  You also should see what you are paying for signed ssl certs. (of course if you are self -signing or using your own CA. this doesnt apply)

I actually use nginx to front end my jira/confluence installation, and have the SSL terminate there.  Offloads the SSL decryption from the tomcat process to the nginx process, and is easier to set up.