Using self-signed certificate for your OIDC identity provider

Owned by Steinar Line
Last updated: Jan 26, 2023 by Mari Fuglem
3 min read

If you are running an internal identity provider that uses a self-signed certificate or a certificate from an internal CA, you will have to configure trust to this to allow OIDC. This trust must be set up by importing the certificate of the identity provider URL in your JAVA certificate trust store for your Atlassian installation. JAVA is a server platform that the Atlassian products run on top of.

Follow the guide below to set up the necessary trust to make OIDC work

Identifying the need to set up trust to self-signed certificate

During the OIDC setup wizard in Kantega SSO you may see this error on the Metadata step:

To solve this, you will have to follow the below steps to establish trust to your Identity Provider’s certificate.

Download the self-signed certificate from your identity provider URL

  1. Navigate to an URL on your identity provider. This could be for example the well-known address for your IdP. In our example this is: https://keycloak.example.com/auth/realms/master/.well-known/openid-configuration

  2. Click the lock symbol by the URL and then the right arrow on the right side. This example is for Firefox on OS X. It may look a little different in different browsers:

     

  3. Click More information

     

  4. Click View Certificate

     

  5. Click the PEM (cert) download link

  6. Save PEM file

  7. Run command in terminal window on your Atlasssian server (*).
    keytool -import -alias example_ca -cacerts -file example-com.pem
    On Linux you may need to add sudo in front of command.

    (*) If you need to find where Java runtime is located for your Atlassian product is running please open the path:

    https://<your-atlassian-server.example.com>/plugins/servlet/no.kantega.kerberosauth.kerberosauth-plugin/debuginfo
    and you find the Java home folder used under environment section:

  8. When the certificate is successfully installed in Java’s cacerts file then restart your Atlassian product to have the necessary trust estabilshed.