Updating Atlassian Certificates Bundles

コンテキスト

To enable app signing, you need to set up your trust store by securely adding all certificates from trusted sources. There may be more than one trusted source. The next sections explain the two main scenarios.

Trust Atlassian app signing CA

Atlassian app signing Certificate Authority (CA) certificates are part of the certificate chain of trust used by Atlassian Marketplace to sign apps. The UPM validates apps' certificates by verifying their certificate path; therefore, the Atlassian CA certificates must be trusted and stored in the local trust store.

Installation process

1. Download the latest Certificates Bundle from the list below.
2. Verify bundle checksum. How to verify checksum on Windows, Linux, or MacOS
3. Extract the bundle certificates, which should include:
   1. Atlassian Root CA certificates
   2. Atlassian Intermediate CA certificates
4. Store all certificate files in your trust store. The trust store location is listed on the UPM Certificates admin page.
5. Make sure the file permissions are set correctly. For details, see Configuration resources location.
6. Remove any expired certificates.

Private builds and custom certificates

Marketplace partners and clients may generate their own signing certificates. For guidance, see 
Generating app signature and verification certificate using OpenSSL. These certificates must also be trusted to support private builds and custom app installations.

Installation process

1. Get the signing certificate using one of the following methods:
   • Private builds: the certificate will be provided by the Marketplace partner.
   • Custom apps: follow the instructions in the Generating app signature and verification certificate using OpenSSL documentation.
2. Add the certificate to your trust store. The trust store location is listed on the UPM Certificates admin page.
3. Make sure the file permissions are set correctly. For details, see Configuration resources location.
4. Remove any expired certificates.

Atlassian Certificates Bundles

Active certificates are those currently used to sign Marketplace apps. Scheduled certificates are the next certificates that will be used once they become active. Certificates are provided in advance to enable seamless app installation and prevent any service disruptions.