MacOS Jenkins: Locate JRE and import self-signed certificate


learning spirit

Newbie here with macOS.

We installed Jenkins on MacOS.

I need to know which JREs and cacerts it uses, because I need to import the self-signed certificate of GitHub Enterprise Server for integration. I have an SSL error and am trying to follow the Resolving PKIX-path-building-failed-error-message guide I successfully completed in Windows .

In a Windows Jenkins installation, it has its own JENKINS_HOME/jre folder where lib/security/cacerts can be found.

Question 1 : Where/how to find the jre used by Jenkins in MacOS?

What I've found so far is that in java_home

/usr/libexec/java_home

But this one I'm not so sure about because my next step fails with results.

Question 2 : How to add the truststore and password of the modified cacerts file to the jenkins startup?

Using jre in /usr/libexec/java_home, I have copied /jre/lib/security/cacerts to my JENKINS_HOME/custom-keystore/cacerts and imported the self-signed certificate there.

sudo keytool -importcert -alias github -file JENKINS_HOME/custom-keystore/selfsigned.cer -keystore JENKINS_HOME/custom-keystore/cacerts

After that, I modified the Jenkins startup parameters:

-Djavax.net.ssl.trustStore=$JAVA_HOME/jre/lib/security/cacert
-Djavax.net.ssl.trustStorePassword=changeit

use:

defaults write /Library/Preferences/org.jenkins-ci.plist Djavax.net.ssl.keyStore JENKINS_HOME/custom-keystore/cacerts
defaults write /Library/Preferences/org.jenkins-ci.plist Djavax.net.ssl.keyStorePassword changeit

Then restart Jenkins with:

sudo launchctl unload /Library/LaunchDaemons/org.jenkins-ci.plist
sudo launchctl load /Library/LaunchDaemons/org.jenkins-ci.plist

After this, I ran into various issues:

  1. Proxy issue - (solved after adding server URL in proxy list - macOS network configuration)

  2. GitHub and other previously successful integrations now give the following error:

    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

Other Questions Am I missing something in my steps?

Is the way I am adding parameters at Jenkins startup the correct way? (In Windows, I just modified jenkins.xml to also use parameters with "-", which doesn't seem to be needed here?)

Do I have to reboot the system since I'm using the Launch Daemon instead of the Launch Agent? - Or should the default unload and load be enough to apply the changes?

learning spirit

The problem has now been successfully resolved. I corrected one step and added another.

  1. instead of using

sudo defaults write /Library/Preferences/org.jenkins-ci.plist Djavax.net.ssl.trustStore /Users/Shared/Jenkins/Home/custom-keystore/cacerts

sudo defaults write /Library/Preferences/org.jenkins-ci.plist Djavax.net.ssl.trustStorePassword changeit

I edited what I found jenkins_runner.shat /Library/Application\ Support/Jenkins:

javaArgs="-Dfile.encoding=UTF-8 -Djavax.net.ssl.trustStore=/Users/Shared/Jenkins/Home/custom-keystore/cacerts -Djavax.net.ssl.trustStorePassword=changeit"
  1. (reboot) after execution

    launchctl unload /Library/LaunchDaemons/org.jenkins-ci.plist

    launchctl load /Library/LaunchDaemons/org.jenkins-ci.plist

I found that the changes I made didn't quite apply. So I had to restart my mac.

It turns out that the Java/JRE in /usr/libexec/java_home I used for keytool and import cacerts was correct.

Related


Import Self-Signed SSL Certificate on MacOS

Ryan Bell I generated a self signed certificate with openssl and added it to my linux server. Then I imported the certificate with Keychain Access on the Mac into the system keychain using the setting "Always Trust". However, when I view the page in Chrome, I

Import Self-Signed SSL Certificate on MacOS

Ryan Bell I generated a self signed certificate with openssl and added it to my linux server. Then I imported the certificate with Keychain Access on the Mac into the system keychain using the setting "Always Trust". However, when I view the page in Chrome, I

Import Self-Signed SSL Certificate on MacOS

Ryan Bell I generated a self signed certificate with openssl and added it to my linux server. Then I imported the certificate with Keychain Access on the Mac into the system keychain using the setting "Always Trust". However, when I view the page in Chrome, I

Jenkins git plugin self-signed certificate

Tobias I'm currently trying to get Jenkins to build a project hosted in a GitHub enterprise repository. We're using a self-signed certificate for the GitHub server, which is causing some issues. Most of the problems I was able to solve: git command line: Get t

Jenkins git plugin self-signed certificate

Tobias I'm currently trying to get Jenkins to build a project hosted in a GitHub enterprise repository. We're using a self-signed certificate for the GitHub server, which is causing some issues. Most of the problems I was able to solve: git command line: Get t

Jenkins git plugin self-signed certificate

Tobias I'm currently trying to get Jenkins to build a project hosted in a GitHub enterprise repository. We're using a self-signed certificate for the GitHub server, which is causing some issues. Most of the problems I was able to solve: git command line: Get t

Jenkins git plugin self-signed certificate

Tobias I'm currently trying to get Jenkins to build a project hosted in a GitHub enterprise repository. We're using a self-signed certificate for the GitHub server, which is causing some issues. Most of the problems I was able to solve: git command line: Get t

Import a certificate using self-signed in AWS

Melasu AWS ELB supports having multiple certificates, I can add multiple certificates (Amazon issued certificates and some signed by a private CA in AWS). I have some self-signed private certificates that I have successfully imported and would like to use them

Jenkins fails to deploy due to self-signed certificate

walter van denput We made a Java keystore and configured our Jenkins as follows: <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true"

Jenkins fails to deploy due to self-signed certificate

walter van denput We made a Java keystore and configured our Jenkins as follows: <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true"

Jenkins fails to deploy due to self-signed certificate

walter van denput We made a Java keystore and configured our Jenkins as follows: <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true"

Jenkins fails to deploy due to self-signed certificate

walter van denput We made a Java keystore and configured our Jenkins as follows: <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true"

Jenkins fails to deploy due to self-signed certificate

walter van denput We made a Java keystore and configured our Jenkins as follows: <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true"