How to configure SSL MySQL for Jira Server and Confluence Server

To connect Jira & Confluence using SSL with MySQL we need to download the MySQL certificates. Once downloaded (mysql-server-cert.pem, client-cert.pem and client-key.pem), we need to convert to a keystore format to be imported in Java when the services are started.

How to convert the MySQL certificates and store it in Jira & Confluence? Using “Keytool” inside the JRE (Java Runtime Edition) “bin” folder.

./keytool -import -alias MySQLCACert  -keystore ../lib/security/cacerts -file cert/mysql-server-cert.pem
 ./keytool -import -alias mysqlclientcertificate  -keystore ../lib/security/cacerts -file cert/client-cert.pem
 openssl pkcs12 -export -in cert/client-cert.pem -inkey cert/client-key.pem -name "mysqlclient" -passout pass:mypassword -out cert/client-keystore.p12
 ./keytool -importkeystore -srckeystore cert/client-keystore.p12 -srcstoretype pkcs12 -srcstorepass mypassword -destkeystore keystore -deststoretype JKS -deststorepass mypassword

(remember, the “cacerts” file is inside your JRE directory, take a look in Jira System Info to know the real path. Remember also the password of cacerts by default is “changeit”).

You must do the same operation for each instance (Jira & Confluence)

Now we are ready to do the changes, just edit the files:

• In Jira edit the file “dbconfig.xml” and add in the MySQL connection string useSSL=true
• In Confluence edit the file “confluence.cfg.xml” and add in the MySQL connection string useSSL=true

sometimes we need to add “&” to concatenate params in the dbconfig and confluence.cfg files. ( something like “&useSSL=true“)

Now edit in Jira and Confluence bin fiolder, the file “setenv.sh” to append those values

-Djavax.net.ssl.keyStore=path_to_keystore_file -Djavax.net.ssl.keyStorePassword=mypassword

Restart the services!

That’s all 😀

By MrAddon

.