LDAP SSL Failed

[Ian Carson]

Hi,

I am trying to connect to my ad.domain.com and whenever the JIRA server tries to connect it throws an error about the SSL. I have gone through the steps online and have tried the SSLPoke tool  to see what is going wrong... I ran these two commands

/opt/atlassian/jira# $JAVA_HOME/bin/java SSLPoke ad.domain.com 443
Successfully connected
/opt/atlassian/jira# $JAVA_HOME/bin/java SSLPoke ad.domain.com 636
Successfully connected

And both connected without a problem. This is the error I get from JIRA...

Connection test failed. Response from the server:
ad.domain.com:636; nested exception is javax.naming.CommunicationException: ad.domain.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

[Alexander Pappert]

@kamrulhussain @Ian Stuart 

step 3 solved my Problem with SSL

https://confluence.atlassian.com/adminjiraserver0710/configuring-an-ssl-connection-to-active-directory-953144428.html 

[Ian Stuart]

Thanks for responding! I tried this initially and it didn't work... I ended up moving our certs into a different directory, performing the above operation again, then rebooting. Then it worked.

[Ian Carson]

Those are the instructions I followed exactly. That's where the SSLPoke came from. As you can see, they are coming as Successfully Connected.

[Ian Stuart]

Did you ever get this resolved? I'm running into the same issue.

[kamrulhussain]

Same, were you able to get the issue resolved? 

[Fabio Racobaldo _Herzum_]

Hi Ian,

did you try to add the certificate into java cacert? Here a guide that could help you https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-779355358.html

Ciao,

Fabio

[Ian Carson]

I followed those instructions already, the keystore has my ssl. I don't quite know why it still fails. I am unsure if the JIRA install has it's own java instance it's using?

[Fabio Racobaldo _Herzum_]

If you are a JIRA Administrator, you can go to System-> System Info and find "java.home".

Based on this you will be sure that JIRA is using the jdk in which you need to install the correct cacert.

Hope this helps,

Fabio

[Ian Carson]

It's using a local install of java. How can I make JIRA use the system JAVA installation?

[Fabio Racobaldo _Herzum_]

You need to setup it in <JIRA-HOME>/bin/setenv.sh (on linux) or <JIRA-HOME>/bin/setenv.bat (on windows)

Please, read the following instruction

https://confluence.atlassian.com/jirakb/how-to-use-a-jdk-or-jre-exclusively-on-jira-765594330.html

Ciao,

Fabio