Webhook stops sending notification to MS Teams.
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
Users are not receiving notification in MSTeams and SSL communication with *.office.com for the WebHook fails.
Environment
- Jira Service Manager any version
- Jira Software any version
Diagnosis
- One of the following entries are logged in the application logs (atlassian-jira.log)
2022-06-28 14:49:32,403+0300 I/O dispatcher 2 DEBUG anonymous [o.a.h.conn.ssl.DefaultHostnameVerifier] Certificate for <XXXX.YYYYY.office.com> doesn't match any of the subject alternative names: [*.internal.outlook.com, *.outlook.com, outlook.com, office365.com, *.office365.com, *.outlook.office365.com, *.office.com, outlook.office.com, substrate.office.com, attachment.outlook.live.net, attachment.outlook.office.net, attachment.outlook.officeppe.net, attachments.office.net, *.clo.footprintdns.com, *.nrb.footprintdns.com, ccs.login.microsoftonline.com, ccs-sdf.login.microsoftonline.com, substrate-sdf.office.com, attachments-sdf.office.net, *.live.com, mail.services.live.com, hotmail.com, *.hotmail.com]
javax.net.ssl.SSLPeerUnverifiedException: Certificate for <nokia.webhook.office.com> doesn't match any of the subject alternative names: [*.internal.outlook.com, *.outlook.com, outlook.com, office365.com, *.office365.com, *.outlook.office365.com, *.office.com, outlook.office.com, substrate.office.com, attachment.outlook.live.net, attachment.outlook.office.net, attachment.outlook.officeppe.net, attachments.office.net, *.clo.footprintdns.com, *.nrb.footprintdns.com, ccs.login.microsoftonline.com, ccs-sdf.login.microsoftonline.com, substrate-sdf.office.com, attachments-sdf.office.net, *.live.com, mail.services.live.com, hotmail.com, *.hotmail.com]
at org.apache.http.conn.ssl.DefaultHostnameVerifier.matchDNSName(DefaultHostnameVerifier.java:177)2022-07-14 15:47:29,991+0300 PsmqAsyncExecutors-then:thread-423 WARN bonzo 886x543x4 10to4pw 135.244.45.34,93.183.26.205 /secure/QuickCreateIssue.jspa [c.a.s.p.a.i.e.engine.asyncthen.AsyncThenJobProcessor] Failed executing ThenAction com.atlassian.servicedesk.plugins.automation.webhook.rulethen.WebhookThenAction asynchronously: 'Unable to obtain status code from webhook server: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching XXXXX.YYYYYY.office.com found.' - Checked and confirmed certificates are valid.
Cause
- JVM parameter -Djsse.enableSNIExtension is set as False.
Solution
Referring to oracle documentation:
jsse.enableSNIExtension system property. Server Name Indication (SNI) is a TLS extension, defined in RFC 4366. It enables TLS connections to virtual servers, in which multiple servers for different network names are hosted at a single underlying network address.
Some very old SSL/TLS vendors may not be able handle SSL/TLS extensions. In this case, set this property to false to disable the SNI extension.- If the SNIExtensions is set to false, the communication to subdomains which are hosted on the same virtual servers do not work.
- So get rid of this issue, either remove this switch or set the JVM parameter to True.