Getting an error when starting Jenkins with PEM certificate

Question

I recently set up my jenkins ci server, and I wanted to add HTTPS SSL certification. I got a certificate from Let's Encrypt and I have the certificate and private key as PEM files, according to the documentation, I can pass the paths of the two files to jenkins by command-line arguments(I use the integrated Winston server in the jenking WAR file). My startup command looks like this:

java -jar jenkins.war 
     --httpPort=8080
     --httpsPort=443
     --httpsCertificate=path/to/certificate.pem
     --httpsPrivateKey=path/to/key.pem

But when I start jenkins I get this error:

java.io.IOException: Failed to start a listener: winstone.HttpsConnectorFactory
        at winstone.Launcher.spawnListener(Launcher.java:212)
        at winstone.Launcher.<init>(Launcher.java:172)
        at winstone.Launcher.main(Launcher.java:355)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at Main._main(Main.java:375)
        at Main.main(Main.java:151)
Caused by: winstone.WinstoneException: Cannot load private key; try using a Java keystore instead.
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:156)
        at winstone.AbstractSecuredConnectorFactory.configureSsl(AbstractSecuredConnectorFactory.java:81)
        at winstone.HttpsConnectorFactory.start(HttpsConnectorFactory.java:33)
        at winstone.Launcher.spawnListener(Launcher.java:210)
        ... 8 more
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:151)
        ... 11 more
Caused by: java.io.IOException: DerValue.getBigInteger, not an int 48
        at sun.security.util.DerValue.getBigInteger(DerValue.java:545)
        ... 16 more
2020-05-02 16:14:21.351+0000 [id=1]     SEVERE  winstone.Logger#logInternal: Container startup failed
java.io.IOException: DerValue.getBigInteger, not an int 48
        at sun.security.util.DerValue.getBigInteger(DerValue.java:545)
Caused: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:151)
Caused: winstone.WinstoneException: Cannot load private key; try using a Java keystore instead.
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:156)
        at winstone.AbstractSecuredConnectorFactory.configureSsl(AbstractSecuredConnectorFactory.java:81)
        at winstone.HttpsConnectorFactory.start(HttpsConnectorFactory.java:33)
        at winstone.Launcher.spawnListener(Launcher.java:210)
Caused: java.io.IOException: Failed to start a listener: winstone.HttpsConnectorFactory
        at winstone.Launcher.spawnListener(Launcher.java:212)
        at winstone.Launcher.<init>(Launcher.java:172)
        at winstone.Launcher.main(Launcher.java:355)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at Main._main(Main.java:375)
        at Main.main(Main.java:151)

Gary Tay · Answer 1 · 2020-07-28T19:57:21.877

The old jenkins documentation has notes on using java keystore, not sure why the latest (2.235.3) has changed HTTPS notes to using pem/key files.

You may refer to https://github.com/garyttt/unattended_jenkins_image_build, pick up the shell functions and run the generate_self_signed_jks.sh to generate a testing .jks file.

The syntax is for example:

JENKINS_OPTS="--prefix=/jenkins --httpPort=-1 --httpsPort=8083 --httpsKeyStore=/var/jenkins_home/selfsigned.jks --httpsKeyStorePassword=secret"

In case you need the content of the shell function, it is:

$ display_shell_function generate_self_signed_jks
generate_self_signed_jks ()
{
    keytool -genkey -keyalg RSA -alias selfsigned -keystore selfsigned.jks -validity 365 -keysize 4096;
    keytool -export -alias selfsigned -keystore selfsigned.jks -rfc -file selfsigned.cer;
    keytool -list -v -keystore selfsigned.jks;
    keytool -importkeystore -srckeystore selfsigned.jks -destkeystore selfsigned.p12 -deststoretype pkcs12
}

OR You may convert .pem file to .jks as per convert certificate from pem into jks

Getting an error when starting Jenkins with PEM certificate

1 Answers1