Using LDAPS from JIRA

[Ryan Rigby]

Hello,
I would like to switch JIRA from using regular LDAP on port 389 to LDAPS (SSL) on 636.
I followed the guide here: https://confluence.atlassian.com/adminjiraserver073/configuring-an-ssl-connection-to-active-directory-861253201.html
But the connection is still failing.
I tried after importing just the cert from the DC as per the guide, which failed, then i saw a post suggesting the full certificate chain was required so i also imported the intermediate and root CA certs - still no joy.
I can make a LDAPS connection to the same DC from the same server using ldp.exe so there is no network/firewall restriction in place, nor is there an issue with there DC accepting LDAP over SSL requests.
The one thing that's different in my environment to the one in the guide is that i do not have JDK installed, instead the certs are in the JRE installation folder.

Error when I switch to LDAPS:
Connection test failed. Response from the server:
DC.domain.com:636; nested exception is javax.naming.CommunicationException: DC.domain.com:636 [Root exception is java.net.SocketException: Connection reset]
It could not be determined whether you chose to save or test. Please try again.

Can anyone offer any guidance?

[Aiden Marriott]

Jira server is bunled with a JRE - verify that there are not multiple versions of Java set up and which one Jira is actually using (System Info panel in admin settings).  Check if your jira startup parameters include Djavax.net.ssl.trustStore which may point Java to an alternative keystore.

[Ryan Rigby]

Hi Aiden, thank you for the response, I have indeed learned that Jira is using a different installation of Java and I have added the certs to the keystore under the installation directory listed in system info under the Java.home parameter.
That is yielding the same results.

[Ryan Rigby]

I found the startup parameters and there is no entry for a trust store.