0
PS C:\Program Files (x86)\Jenkins\.cacerts> java -version                                                                                                                         java version "11.0.10" 2021-01-19 LTS
Java(TM) SE Runtime Environment GraalVM EE 21.0.0 (build 11.0.10+8-LTS-jvmci-21.0-b06)
Java HotSpot(TM) 64-Bit Server VM GraalVM EE 21.0.0 (build 11.0.10+8-LTS-jvmci-21.0-b06, mixed mode, sharing)

Jenkins on Windows10 : version: 2.263.1

I have added certs for updates.jenkins-ci.org:443. Install fails with

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)

My jenkins xml

<arguments>-Xrs -Xmx256m -Dhudson.lifecycle=hudson.lifecycle.WindowsServiceLifecycle -Djavax.net.debug=all -Djavax.net.ssl.trustStore="C:\Program Files (x86)\Jenkins\.cacerts\jssecacerts"  -Djavax.net.ssl.trustStorePassword=changeit  -jar "%BASE%\jenkins.war" --httpPort=8080  --httpsPort=443 --httpsKeyStore="C:\Program Files (x86)\Jenkins\.cacerts\keystore.jks" --httpsKeyStorePassword=changeit --webroot="%BASE%\war" </arguments>

PS C:\Program Files (x86)\Jenkins\.cacerts> keytool -list -keystore .\jssecacerts -alias  updates.jenkins-ci.org-1                                                                Enter keystore password:
updates.jenkins-ci.org-1, Jul 29, 2021, trustedCertEntry,
Certificate fingerprint (SHA-256): EB:EB:2C:AA:6F:EC:17:12:97:04:EC:C3:77:E8:77:2F:9D:E1:AC:B4:54:2D:F8:FE:99:98:6C:3F:0C:EB:90:95

Why Java is not trusting though I have given truststore and added cert. I do see the logs, it is reading truststore

javax.net.ssl|DEBUG|01 AD|Update center installer thread [#1]|2021-07-29 19:58:38.469 EDT|TrustStoreManager.java:112|trustStore is: C:\Program Files (x86)\Jenkins\.cacerts\jssecacerts
trustStore type is: pkcs12
trustStore provider is:

Jenkins error log

javax.net.ssl|ERROR|05 89|Update center installer thread [#2]|2021-07-29 20:18:58.818 EDT|TransportContext.java:344|Fatal (CERTIFICATE_UNKNOWN): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (
"throwable" : {
  sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Naveen Chandra Sekhara
  • 73
  • 1
  • 2
  • 8
  • Try to update the Java version on your Jenkins server, it should solve your issue. – Noam Helmer Aug 01 '21 at 07:56
  • After updating Java. I see this. Which certs I need to download. I already added "openssl s_client -connect updates.jenkins-ci.org:443 < /dev/null | openssl x509 -out jenkins_update.pem". Imported to TrustStore.log file(truncated) ` "certificate" : { "issuer" : "CN=Cloud Services Root CA, O="BlueCoat Systems, Inc.", C=US", "extensions" : [ { accessLocation: URIName: http://pki-ocsp.symauth.com javax.net.ssl|ERROR|01 0A|Update center installer thread [#1]|2021-08-02 14:31:08.259 EDT|TransportContext.java:361|Fatal (CERTIFICATE_UNKNOWN): – Naveen Chandra Sekhara Aug 02 '21 at 19:04
  • I put few important logs above due to character restrictions. – Naveen Chandra Sekhara Aug 02 '21 at 19:05
  • As everyone's case is different. I had to import symmantec certs our company uses. Java was not trusting this. Now its working. Moral This is a good link everyone knows already https://stackoverflow.com/questions/24563694/jenkins-unable-to-find-valid-certification-path-to-requested-target-error-whil Also enable SSL login with -Djavax.net.debug=all in jenkins.xml for further debugging. – Naveen Chandra Sekhara Aug 02 '21 at 21:40

0 Answers0