The first part of this page describes the specific SSL errors that can be diagnosed automatically by application links and the actions you can take to correct those errors.

The second part provides a general troubleshooting guide to help you identify and correct errors that may occur when using HTTPS with application links.

On this page:

Common SSL errors with application links

javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException: PKIX path building failed: 
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

javax.net.ssl.SSLException: hostname in certificate didn't match
javax.net.ssl.SSLException: <message>

Error messages in the logs

You may see these error messages in the application logs:

• javax.net.ssl.SSLException: hostname in certificate didn't match

• javax.net.ssl.SSLHandshakeException

• sun.security.validator.ValidatorException: PKIX path building failed

• sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Follow a link above for detailed information on this page.

Application log locations

Troubleshoot general SSL errors with application links

This section provides a troubleshooting guide to help you identify and correct general errors that occur when using HTTPS (HTTP over SSL) with application links. 

Check if there was a recent upgrade

Know your network topology

There are two common ways to configure secure connections between applications. These approaches determine where SSL certificates should be stored and the application URLs that should be used when setting up application links.

Terminate SSL at a reverse proxy

Clients connect to the reverse proxy over SSL. The reverse proxy communicates over an unsecured connection with the application server.

Terminate SSL at the application server

For installations that do not use a reverse proxy, Tomcat can be configured to allow SSL connections. Terminating at the application server can also be used with a reverse proxy to ensure that the communication between the reverse proxy and application server is secure.

Configure Atlassian applications to use HTTPS

Check you are using the correct base URL

Ensure that your application has the correct base URL defined (including the http or  https protocol) and that you're using that same URL in your application link.

Check your SSL certificate configuration

There are some minimum requirements that your SSL certificate must meet:

• The certificate common name (CN) must match the host name (the URL address) for the application.
• The certificate timestamp must still be valid.
• The certificate must be installed into the correct Java trust store (Atlassian server products are Java applications that bundle the Tomcat application server).
• The local trust store must contain the certificate for the remote application you're trying to connect to.
• Intermediate certificates must exist in the trust store.
• The local and remote certificates must be of the correct format to be imported into the default trust store type (JKS).

To see details of a certificate, visit the application in your browser and click the padlock in the browser address bar. You can also check SSL certificate details online (for example using https://www.digicert.com/help/.

To check that certificates are present in the Java trust store see Check the SSL certificate location below.

Check the SSL certificate location

Java applications such as Atlassian server products expect to find SSL certificates in particular locations in the filesystem.

By default, Java applications use the JRE cacerts trust store, located at:

JAVA_HOME/jre/lib/security/cacerts

where JAVA_HOME is an environment variable that points to the Java installation directory. Note, however, that some Atlassian products may bundle a JRE, in which case they will use the trust store for the JRE.

You can specify alternative stores by specifying JVM arguments when starting the application. See this Oracle documentation for further details.

Typically, you must export the certificate from the remote application and then import it into the local application. This is common when applications are run on separate machines, or are using a bundled JVM.

Export a certificate from a key store

keytool -export -alias <existing_alias_in_keystore> -file <any_filename_here> -keystore <path/to/keystore>

Import a certificate into a trust store

keytool -import -alias <new_unique_alias> -file <any_filename_here_from_above> -keystore <path/to/truststore>

Where is the keytool utility?

The keytool is provided with the Java Runtime Environment (JRE). If you're using a product with a bundled JRE, you can find keytool in <product-install-path>/jre/bin/keytool.