Connecting to LDAP or Jira applications or Other Services via SSL

This page describes how to get Confluence connecting to external servers over SSL, via the various SSL-wrapped protocols.

Here are some examples of when you may need to connect to an external server over SSL/HTTPS:

• You need to connect to an LDAP server, such as Active Directory, if the LDAP server is running over SSL.
  For specific instructions for Active Directory, see Configuring an SSL Connection to Active Directory.
• You want to set up your Jira application as a trusted application in Confluence, when Jira is running over SSL.
• You want to refer to an https://... URL in a Confluence macro.

If you want to run Confluence itself over SSL, see Running Confluence Over SSL or HTTPS.

Importing SSL Certificates

For more information on these commands, see the Keytool documentation.

1. Add the root certificate to your default Java keystore with the following command. This is the certificate that was used to authorize the LDAP server's certificate. It will be either the one that was used for signing it, or will come from further up in the trust chain, possibly the root certificate. This is often a self-signed certificate, when both ends of the SSL connection are within the same network. Again, the exact alias is not important.

   keytool -importcert -alias serverCert -file RootCert.crt -keystore %JAVA_HOME%/jre/lib/security/cacerts (Windows)
   keytool -importcert -alias serverCert -file RootCert.crt -keystore $JAVA_HOME/jre/lib/security/cacerts (Linux/Unix/Mac)
   

2. Import your LDAP or Jira server's public certificate into the JVM Keystore. This is the certificate that the LDAP server will use to set up the SSL encryption. You can use any alias of your choosing in place of "JIRAorLDAPServer.crt".

   keytool -importcert -alias ldapCert -file JIRAorLDAPServer.crt -keystore %JAVA_HOME%/jre/lib/security/cacerts (Windows)
   keytool -importcert -alias ldapCert -file JIRAorLDAPServer.crt -keystore $JAVA_HOME/jre/lib/security/cacerts (Linux/Unix/Mac)
   

3. Verify that the certificate has been added successfully by entering the following command:

   keytool -list -keystore %JAVA_HOME%/jre/lib/security/cacerts (Windows)
   keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts (Unix/Linux)
   keytool -list -keystore /Library/Java/Home/lib/security/cacerts (Mac)
   

4. Ensure that you have updated CATALINA_OPTS to specify the path to the keystore, as specified in Connecting to SSL services before restarting Confluence.
   There is no need to specify an alias for Confluence to use. On connecting to the LDAP server, it will search through the keystore to find a certificate to match the key being presented by the server.

Troubleshooting

Check the following knowledge base articles:

• Unable to Connect to SSL Services due to PKIX Path Building Failed
• SSL troubleshooting articles