Jira / Confluence SSL certificate expired

Project leads cannot open boards on iOS because the reverse proxy still serves last year’s cert—confluence ssl certificate expired breaks Jira Software and Confluence from the same Tomcat server.xml connector or shared nginx front door.

Data Center clusters expose one public URL per product. Tomcat hosts multiple connectors; proxyName and scheme settings must align with the hostname on the renewed certificate. Mobile apps pin the configured base URL and fail PKIX before login forms render.

Ops renewed Apache TLS in front of Jira while the Tomcat Java keystore on 8080 direct access (forgotten admin URL) still leaks expired material to auditors scanning all vhosts.

First response

Capture product (jira, confluence, both), public URL from Application properties, and whether TLS ends at load balancer, Apache, or Tomcat. Read connector config:

grep -E 'SSLEnabled|certificateKeystoreFile|proxyName' $ATL_INSTALL/conf/server.xml
openssl x509 -in /path/to/keystore-export.crt -noout -dates 2>/dev/null
echo | openssl s_client -connect jira.example.com:443 -servername jira.example.com 2>/dev/null | openssl x509 -noout -dates

For Data Center: check each node's listener if health checks bypass the LB to individual members.

What this error means

Atlassian applications run on JVM Tomcat. HTTPS either terminates in Tomcat with a JKS keystore or at a reverse proxy forwarding HTTP to localhost:8080. Clients only see the edge certificate; expired notAfter blocks REST, WebSudo, and mobile sync.

Jira and Confluence are separate installs with separate certs unless you share a wildcard on one SAN cert. Renewing jira.example.com does not extend confluence.example.com unless both names sit on the same reissued SAN list.

Application links and SSO (SAML/OIDC) redirect browsers through multiple hostnames—each must validate independently during the redirect chain.

Smart links and unfurl in Slack or Teams fetch Confluence over HTTPS using the same base URL mobile apps use—chat integrations break in parallel with browser errors, widening the incident audience beyond agile leads.

Automation for Jira Service Management incoming email and webhook automations relies on HTTPS callbacks to your tenant URL. Expired listener material stops ticket updates that appear unrelated to “wiki down” reports from engineering.

Insight or Assets API consumers and marketplace apps using OAuth 2.0 loops hit multiple redirects; one expired hostname in the chain fails the entire authorization dance with generic browser errors.

Common causes

atlassian-http.cfg still points Tomcat at old keystoreFile after admins copied new .jks with a new alias. certbot renewed on RHEL Apache vhost; ProxyPass to Tomcat never reloaded.

Data Center upgrade restored server.xml backup with obsolete certificateKeystorePassword. Crowd or reverse proxy SSO URL still references expired cert on ancillary id.example.com.

Synthetics hit /status over HTTP on port 8080 while users use HTTPS on 443—monitoring green, users red.

Splitter load balancers in multi-product estates route jira and confluence hostnames to different backend pools; renewing only the Jira pool leaves Confluence users red while Jira appears healthy in executive dashboards.

Java truststore experiments for outbound app links sometimes confuse teams into editing the wrong keystore file during incidents—outbound trust does not fix inbound expired listener certs.

Temporary HTTP downgrade in base URL after partial outage embeds http links in notifications, prolonging mixed-content pain after TLS is actually fixed until administrators normalize settings.

Confirm from the outside

OpenSSL per product URL

for h in jira.example.com confluence.example.com; do
  echo "== $h =="
  echo | openssl s_client -connect "$h:443" -servername "$h" 2>/dev/null | openssl x509 -noout -dates -subject
done

curl

curl -vI https://confluence.example.com/login.action 2>&1 | grep -Ei 'expire|SSL certificate'

How to read the output

SAN must list the hostname in Base URL admin setting. After renewal, serial changes—if serial is unchanged, you are still hitting old material on one cluster node.

Walk the SAML or OIDC login flow with browser devtools open on each redirect host—note the first hop that throws certificate errors. Fixing only product URL while IdP or Crowd listener expired leaves login broken after initial page load.

Data Center per-node checks

When health checks use per-node ports, openssl each node FQDN or accept IP SNI patterns your LB uses. One stale node poisons a fraction of sessions.

Fix checklist

1. Export new cert + intermediates from CA in PEM, convert to PKCS12/JKS (keytool -importkeystore or Atlassian docs).
2. Update server.xml or proxy SSLCertificateFile paths; align proxyName / proxyPort with public URL.
3. For terminating proxies: reload Apache/nginx; for Tomcat: rolling restart each Data Center node.
4. Validate Base URL settings still match certificate SAN (no accidental http:// downgrade).
5. Test mobile app, smart link unfurl, and OAuth/SAML login round trip.
6. Run Support Tools health check; clear stuck plugin caches only after TLS is clean.
7. Update incoming webhooks and automation tokens relying on HTTPS callbacks.
8. Archive openssl output and keystore alias list in change record.

Rolling restart one Data Center node at a time while monitoring Hazelcast or Atlassian clustering health APIs—rushing parallel restarts extends quorum blips.

After keystore import, verify connector alias password in server.xml matches new PKCS12—Tomcat fails boot with obscure errors if password entries drift during copy/paste renewals.

Re-test mobile apps on both platforms with app cache cleared; mobile pinning caches failures aggressively compared to desktop browsers.

Coordinate with IdP team when SAML metadata lists ACS URLs that must match renewed cert hostnames—metadata republish may be required even when only cert dates changed.

When to use automation

Wiki and ticket traffic dies when confluence ssl certificate expired—same urgency for Jira if agile teams cannot update sprints. Monitor each product’s configured Base URL as live HTTPS.

/check Jira and Confluence hostnames separately even when one wildcard covers both—SNI and redirect chains differ. Coordinate alerts with Jenkins and GitLab for delivery toolchain visibility.