The correct solution is to NOT disable the certificate checks as a lot people have suggested but rather to add the website certificate to the Java keystore instead.
I'll list my own guide below which should work for Linux. I suspect the same imports will work in Windows as the keytool is bundled with Java but you're on your own when it comes to any openssl commands.
Download all required certificates in the chain (this is a command I found on SO, I can't find the link but it's not my own creation):
openssl s_client -showcerts -verify 5 -connect updates.jenkins-ci.org:443 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".crt"; print >out}' && for cert in *.crt; do newname=$(openssl x509 -noout -subject -in $cert | sed -n 's/^.*CN=\(.*\)$/\1/; s/[ ,.*]/_/g; s/__/_/g; s/^_//g;p').pem; mv $cert $newname; done
You should now have 2 files:
Let's_Encrypt_Authority_X3.pem
pkg_jenkins_io.pem
Concatenate the 2 files:
cat "Let's_Encrypt_Authority_X3.pem" pkg_jenkins_io.pem > full_chain.pem
This next step is useful as the Java keytool is picky and the openssl package will fix any spacing issues. I have seen the keytool import fail even though openssl claimed it was valid so don't skip this step:
openssl x509 -in full_chain.pem -out full_chain_sanitized.pem
Now comes the fun part. I assume your Jenkins instance is running with some of the following arguments:
-Djavax.net.ssl.keyStore=/applications/configuration/pki/keystore.jks
-Djavax.net.ssl.keyStorePassword=GOOD_PASSWORD
-Djavax.net.ssl.trustStore=/applications/configuration/pki/truststore.jks
-Djavax.net.ssl.trustStorePassword=GOOD_PASSWORD
Also note that you might not be using the custom keystores. In that case, you could try to include the certificate in the default cacerts file instead. Check the next section for details. If you are using any truststores, you will have configured a password so enter it when prompted.
Now we can import the Jenkins plugin site certificate. Make sure to use your own keytool path as it will differ from my own.
/applications/java/latest/bin/keytool -trustcacerts -import -v -alias pkg_jenkins_io_full_chain -file correct.pem -keystore /applications/configuration/pki/keystore.jks
/applications/java/latest/bin/keytool -trustcacerts -import -v -alias pkg_jenkins_io_full_chain -file correct.pem -keystore /applications/configuration/pki/truststore.jks
Restart your Jenkins server and the plugin site should work. If it doesn't (or if you weren't using custom keystores to begin with), you could try adding the certificate to the Java cacerts file but this is usually frowned upon as it will get replaced during any updates. A better option might be to instead create a backup, include the certificate in the copy and run Jenkins with using the copy as a truststore.
Remember that the default password for the cacerts store is 'changeit'
cp /apps/java/latest/jre/lib/security/cacerts /apps/java/latest/jre/lib/security/cacerts_copy
# Add the certificate to the keystore
/applications/java/latest/bin/keytool -trustcacerts -import -v -alias pkg_jenkins_io_full_chain -file correct.pem -keystore /apps/java/latest/jre/lib/security/cacerts_copy
# Add -Djavax.net.ssl.trustStore= property to the Jenkins startup parameters, depending on your own OS.
# Just make sure to append it as such:
-Djavax.net.ssl.trustStore=/apps/java/latest/jre/lib/security/cacerts_copy
The https://stackoverflow.com/a/47316409/7569335 answer is good but it does not account for the custom keystore files scenario that I faced. Check it out as well as it has good info.
