Jira Gadgets not working when using ssl

[forums-5]

When SSL is enabled the gadgets are showing Error loading gadget: org.apache.shindig.gadgets.GadgetException: Unable to retrieve gadget xml. HTTP error 500

My Configuration:
I am using IIS to proxy the requests to Tomcat.  This works fine for Confluence and Fisheye.
I am using a certificate issued from a local CA.

Relevant sections of my server.xml connector is as follows:
{code}
<Engine name="Catalina" defaultHost="server.domain.com">
      <Host name="server.domain.com" appBase="webapps" unpackWARs="true" autoDeploy="true">

 <Connector port="8443" maxHttpHeaderSize="8192"
              maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
              enableLookups="false" disableUploadTimeout="true"
              acceptCount="100" scheme="https" secure="true"
              useBodyEncodingForURI="true"
              clientAuth="false" sslProtocol="TLS"
              truststoreFile="C:\cacerts2" truststorePass="changeit" truststoreType="JKS"
              keystoreType= "PKCS12" keystoreFile="C:\toolsCert.p12" keystorePass="changeit">
{code}

The cacerts2 (truststore) file contains the CA issued cert:
{code}
C:\Program Files\Java\jdk1.6.0_16\bin>keytool -list -keystore C:\cacerts2
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

server.domain.com, Oct 31, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 9D:EE:16:4E:18:68:0E:B2:CC:D6:BB:0C:D3:64:0C:28
{code}

The toolscert.p12 file contains the server cert:
{code}
Keystore type: PKCS12
Keystore provider: SunJSSE

Your keystore contains 1 entry

server.domain.com, Nov 1, 2009, PrivateKeyEntry,
Certificate fingerprint (MD5): 9D:EE:16:4E:18:68:0E:B2:CC:D6:BB:0C:D3:64:0C:28
{code}

I have been through all the documentation and previous posts regarding the same issue, and as far as I can tell it is setup correctly.  Any help would be very appreciated!

Thanks,
Trevor
--
Post by Trevor - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[Sohail Somani-3]

On 01/11/09 2:30 AM, forums@... wrote:
> When SSL is enabled the gadgets are showing Error loading gadget: org.apache.shindig.gadgets.GadgetException: Unable to retrieve gadget xml. HTTP error 500
>

See
http://confluence.atlassian.com/display/JIRAKB/Gadgets+do+not+display+correctly+after+upgrade+to+JIRA+4.0

You have to tell Java itself about the cert.

--
Sohail Somani
Hassle-free time tracking for JIRA

Website: http://worklogassistant.com
Blog   : http://blog.worklogassistant.com
Twitter: http://twitter.com/wlogassistant


_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[nuigiggle]

Dear friend,
I would like to introduce a really good company that mainly do the electornic products trade.
Now the company is doing promotion,all of it's products are sold nearly as same as their cost.
It redeners the best service to customers,it provide you original products which is
good quality,and what's more,the pricewill give you a big surprise!
It is realy a good opportunity for doing shopping.Just grasp the opportunity,or there will be no more than that!
The web address:(www.) kingacme.com

_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[Sohail Somani-3]

On 01/11/09 10:55 AM, Sohail Somani wrote:
> On 01/11/09 2:30 AM,forums@...  wrote:
>> >  When SSL is enabled the gadgets are showing Error loading gadget: org.apache.shindig.gadgets.GadgetException: Unable to retrieve gadget xml. HTTP error 500
>> >
> See
> http://confluence.atlassian.com/display/JIRAKB/Gadgets+do+not+display+correctly+after+upgrade+to+JIRA+4.0
>
> You have to tell Java itself about the cert.
>

Also see http://jira.atlassian.com/browse/JRA-19337

--
Sohail Somani
Hassle-free time tracking for JIRA

Website: http://worklogassistant.com
Blog   : http://blog.worklogassistant.com
Twitter: http://twitter.com/wlogassistant


_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[forums-5]

Sohail,

Thanks for the replies.  I have tried importing the certificates multiple times, and still no luck.  If I understand correctly the way Java know about the certificate is through the two keystores: truststore which is by default the lib\security\cacerts file and is used to allow trusting of CA's and individual certificates, and the keystore which holds the private key information.  Both of these stores have the installed certificates as shown by the keytool -list commands above.  I have also told Tomcat about these files in the server.xml file as shown above.

Any other suggestions?

Thanks,
Trevor

Edited by: Trevor Christiansen on Nov 1, 2009 11:02 AM
--
Post by Trevor - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[forums-5]

While I am not using the default truststore currently, I have imported the certificate into that file but gadgets still do not work:
{code}
.............
server.domain.com, Oct 31, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 9D:EE:16:4E:18:68:0E:B2:CC:D6:BB:0C:D3:64:0C:28
digicerthighassuranceevrootca, Jan 7, 2008, trustedCertEntry,
Certificate fingerprint (MD5): D4:74:DE:57:5C:39:B2:D3:9C:85:83:C5:C0:65:49:8A
secomvalicertclass1ca, May 1, 2008, trustedCertEntry,
Certificate fingerprint (MD5): 65:58:AB:15:AD:57:6C:1E:A8:A7:B5:69:AC:BF:FF:EB
equifaxsecureglobalebusinessca1, Jul 18, 2003, trustedCertEntry,
............
{code}
--
Post by Trevor - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[Sohail Somani-3]

On 01/11/09 12:02 PM, forums@... wrote:
> Thanks for the replies.  I have tried importing the certificates multiple times, and still no luck.  If I understand correctly the way Java know about the certificate is through the two keystores: truststore which is by default the lib\security\cacerts file and is used to allow trusting of CA's and individual certificates, and the keystore which holds the private key information.  Both of these stores have the installed certificates as shown by the keytool -list commands above.  I have also told Tomcat about these files in the server.xml file as shown above.
>
> Any other suggestions?

Nope, no other ideas. Have you restarted JIRA? What message are you
getting in the server log file?

--
Sohail Somani
Hassle-free time tracking for JIRA

Website: http://worklogassistant.com
Blog   : http://blog.worklogassistant.com
Twitter: http://twitter.com/wlogassistant


_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[forums-5]

I have restarted Jira (and the box).

Here is the stdout log entries:
{code}
2009-11-01 15:08:21,263 TP-Processor3 ERROR anonymous 58100x2x1 gh9zkd /secure/Dashboard.jspa [renderer.internal.http.HttpClientFetcher] Unable to retrieve response
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
..............
2009-11-01 15:08:21,591 TP-Processor3 WARN anonymous 58100x2x1 gh9zkd /secure/Dashboard.jspa [gadgets.embedded.internal.GadgetUrlBuilder] GadgetUrlBuilder: could not parse spec at rest/gadgets/1.0/g/com.atlassian.jira.gadgets:introduction-gadget/gadgets/introduction-gadget.xml
2009-11-01 15:08:21,638 TP-Processor3 ERROR anonymous 58100x2x1 gh9zkd /secure/Dashboard.jspa [renderer.internal.http.HttpClientFetcher] Unable to retrieve response
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
{code}

Thanks again for your help.
--
Post by Trevor - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[forums-5]

I am having this exact same issue, so I'm watching with eager eyes.  Thanks!
--
Post by ptakers - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[forums-5]

I have opened a support ticket, so hopefully I will have this fixed up soon.  As soon as I do, I will post the fix here.
--
Post by Trevor - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user

[forums-5]

Solved:  Support pointed out the issue.  Jira was using its own JRE as noted in the system info:
java.home C:\Program Files\Atlassian\JIRA 4.0\jre

So by adding the certificate to the cacerts file in lib\security things worked as they are supposed to.

Trevor
--
Post by Trevor - online at:
http://forums.atlassian.com/thread.jspa?forumID=46&threadID=38382
_______________________________________________
Jira-user mailing list
Jira-user@...
To unsubscribe or change your options visit this page:
http://lists.atlassian.com/mailman/listinfo/jira-user