[JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate

Type: Bug
Resolution: Fixed
Priority: Major
Component/s: _unsorted, cli
Labels:
- 1.509.4-fixed
- 1.532.2-fixed
Environment:
Jenkins ver. 1.449

Similar Issues:
Powered by SuggestiMate

Show

We have Jenkins setup to use only HTTPS port with arguments "--httpPort=-1 --httpsPort=8080" that starts server with self signed certificate.

Using web browser is all ok but when connecting with jenkins-cli.jar it fails due to hostname not being the same as server actual hostname.

Steps to reproduce (using bash):

JENKINS_HOST=foo.bar.host
JENKINS_PORT=8080
JENKINS_URL=https://${JENKINS_HOST}:${JENKINS_PORT}

# Get HTTPS certificate for java
openssl s_client -connect ${JENKINS_HOST}:${JENKINS_PORT} </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${JENKINS_HOST}.cer
keytool -import -noprompt -trustcacerts -alias ${JENKINS_HOST} -file ${JENKINS_HOST}.cer -keystore myKeystore -storepass 123456
keytool -list -v -keystore myKeystore -storepass 123456

# Get jenkins-cli
wget --no-check-certificate ${JENKINS_URL}/jnlpJars/jenkins-cli.jar

# Test access
alias jcli="java -Djavax.net.ssl.trustStore=myKeystore -Djavax.net.ssl.trustStorePassword=123456 -jar jenkins-cli.jar -s ${JENKINS_URL,,}"
jcli help

Error displayed:

Exception in thread "main" java.io.IOException: Failed to connect to https://foo.bar.host:8080/
        at hudson.cli.CLI.getCliTcpPort(CLI.java:211)
        at hudson.cli.CLI.<init>(CLI.java:115)
        at hudson.cli.CLI._main(CLI.java:375)
        at hudson.cli.CLI.main(CLI.java:314)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name mat
ching localhost found
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at hudson.cli.CLI.getCliTcpPort(CLI.java:209)
        ... 3 more
Caused by: java.security.cert.CertificateException: No name matching localhost found
        at sun.security.util.HostnameChecker.matchDNS(Unknown Source)
        at sun.security.util.HostnameChecker.match(Unknown Source)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
        ... 15 more

I think the root cause is related to how the self-certificate is being generated that should be using the machine actual hostname in the CN part instead of "Test site":

Owner: CN=Test site, OU=Unknown, O=Unknown, C=Unknown
Issuer: CN=Test site, OU=Unknown, O=Unknown, C=Unknown

R. Tyler Croy added a comment - 2013-02-07 14:42

This bit me today as well, glad I'm not the only one with these issues. I think the better option would be for jenkins-cli to actually support self-signed certificates, since most installations will have that by default.

kohsuke is there any way I could beg for that option?

R. Tyler Croy added a comment - 2013-02-07 14:42 This bit me today as well, glad I'm not the only one with these issues. I think the better option would be for jenkins-cli to actually support self-signed certificates, since most installations will have that by default. kohsuke is there any way I could beg for that option?

Jose Sa added a comment - 2013-02-07 14:52

There is currently a better alternative which is to use SSH directly, if you configure Jenkins to lister on a sshd port on your choosing (example 12345).

This way you can execute cli commands like this:

alias jcli='ssh -p 12345 $JENKINS_HOST'
jcli help

All you need to make sure is to publish your public ssh key in your Jenkins account.

Jose Sa added a comment - 2013-02-07 14:52 There is currently a better alternative which is to use SSH directly, if you configure Jenkins to lister on a sshd port on your choosing (example 12345). This way you can execute cli commands like this: alias jcli= 'ssh -p 12345 $JENKINS_HOST' jcli help All you need to make sure is to publish your public ssh key in your Jenkins account.

R. Tyler Croy added a comment - 2013-02-11 11:31

Well, the SSH API doesn't work for the 'groovy' command, which is the only command that I need to run.

I'm trapped!

R. Tyler Croy added a comment - 2013-02-11 11:31 Well, the SSH API doesn't work for the 'groovy' command, which is the only command that I need to run. I'm trapped!

Jose Sa added a comment - 2013-02-11 12:42 - edited

I had that problem too, but managed to workaround it with groovysh redirecting from standard input. It must be a bug that "groovy" command doesn't not work with SSH CLI.

If you don't care about output returned you don't even need to filter it out, but here is an example how to bulk apply some changes to subversion update strategy on all jobs with e certain regular expression pattern:

## List jobs
JOBS_PAT=".*_analysis"
cat <<_EOF_ >list-jobs.groovy
for (job in Hudson.instance.items.findAll{ it.name =~ /^${JOBS_PAT}$/ }) println job.name;
exit
_EOF_
jobs=$(jcli groovysh < list-jobs.groovy | tail -n +4 | head -n -2 | sed "s,^[^ ]*groovy[^ ]*,,")

## get jobs
mkdir -p old
for job in $jobs; do
    echo $job
    jcli get-job $job > old/$job.xml
done

## change jobs
mkdir -p new
for job in $jobs; do
    echo $job
    sed 's/workspaceUpdater class.*/workspaceUpdater class="hudson.scm.subversion.UpdateWithRevertUpdater"\>/' old/$job.xml > new/$job.xml
    diff old/$job.xml new/$job.xml
done

## update jobs
for job in $jobs; do
    echo $job
    jcli update-job $job < new/$job.xml
done

Jose Sa added a comment - 2013-02-11 12:42 - edited I had that problem too, but managed to workaround it with groovysh redirecting from standard input. It must be a bug that "groovy" command doesn't not work with SSH CLI. If you don't care about output returned you don't even need to filter it out, but here is an example how to bulk apply some changes to subversion update strategy on all jobs with e certain regular expression pattern: ## List jobs JOBS_PAT= ".*_analysis" cat <<_EOF_ >list-jobs.groovy for (job in Hudson.instance.items.findAll{ it.name =~ /^${JOBS_PAT}$/ }) println job.name; exit _EOF_ jobs=$(jcli groovysh < list-jobs.groovy | tail -n +4 | head -n -2 | sed "s,^[^ ]*groovy[^ ]*,," ) ## get jobs mkdir -p old for job in $jobs; do echo $job jcli get-job $job > old/$job.xml done ## change jobs mkdir -p new for job in $jobs; do echo $job sed 's/workspaceUpdater class.*/workspaceUpdater class= "hudson.scm.subversion.UpdateWithRevertUpdater" \>/' old/$job.xml > new /$job.xml diff old/$job.xml new /$job.xml done ## update jobs for job in $jobs; do echo $job jcli update-job $job < new /$job.xml done

Kohsuke Kawaguchi added a comment - 2013-02-22 23:54

The reason SSH client doesn't work with the groovy command is because ssh(1) lacks the ability to read a script file for the master. You can work around this relatively easily by reading the script from stdin:

ssh yourjenkins.acme.com groovy = < myscript.groovy

This has obvious downside that you won't be able to access stdin from your groovy script, but it's probably prettier than the work around that involves the groovysh command.

Kohsuke Kawaguchi added a comment - 2013-02-22 23:54 The reason SSH client doesn't work with the groovy command is because ssh(1) lacks the ability to read a script file for the master. You can work around this relatively easily by reading the script from stdin : ssh yourjenkins.acme.com groovy = < myscript.groovy This has obvious downside that you won't be able to access stdin from your groovy script, but it's probably prettier than the work around that involves the groovysh command.

SCM/JIRA link daemon added a comment - 2013-02-23 00:07

Code changed in jenkins
User: Kohsuke Kawaguchi
Path:
cli/src/main/java/hudson/cli/CLI.java
cli/src/main/java/hudson/cli/NoCheckTrustManager.java
cli/src/main/resources/hudson/cli/client/Messages.properties
http://jenkins-ci.org/commit/jenkins/2edf32221f13e36c2c5c44c9f91a068966b59218
Log:
[FIXED JENKINS-12629]

Added the -noCertificateCheck option (the option name is consistent with
the slave.jar) that lets users bypass the HTTPS certificate check.

This allows trivial man-in-the-middle attack, so HTTPS will no longer be
HTTPS.

–
You received this message because you are subscribed to the Google Groups "Jenkins Commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-commits+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

SCM/JIRA link daemon added a comment - 2013-02-23 00:07 Code changed in jenkins User: Kohsuke Kawaguchi Path: cli/src/main/java/hudson/cli/CLI.java cli/src/main/java/hudson/cli/NoCheckTrustManager.java cli/src/main/resources/hudson/cli/client/Messages.properties http://jenkins-ci.org/commit/jenkins/2edf32221f13e36c2c5c44c9f91a068966b59218 Log: [FIXED JENKINS-12629] Added the -noCertificateCheck option (the option name is consistent with the slave.jar) that lets users bypass the HTTPS certificate check. This allows trivial man-in-the-middle attack, so HTTPS will no longer be HTTPS. – You received this message because you are subscribed to the Google Groups "Jenkins Commits" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-commits+unsubscribe@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out .

dogfood added a comment - 2013-02-23 01:05

Integrated in jenkins_main_trunk #2293
[FIXED JENKINS-12629] (Revision 2edf32221f13e36c2c5c44c9f91a068966b59218)

Result = SUCCESS
kohsuke : 2edf32221f13e36c2c5c44c9f91a068966b59218
Files :

cli/src/main/java/hudson/cli/CLI.java
cli/src/main/resources/hudson/cli/client/Messages.properties
cli/src/main/java/hudson/cli/NoCheckTrustManager.java

dogfood added a comment - 2013-02-23 01:05 Integrated in jenkins_main_trunk #2293 [FIXED JENKINS-12629] (Revision 2edf32221f13e36c2c5c44c9f91a068966b59218) Result = SUCCESS kohsuke : 2edf32221f13e36c2c5c44c9f91a068966b59218 Files : cli/src/main/java/hudson/cli/CLI.java cli/src/main/resources/hudson/cli/client/Messages.properties cli/src/main/java/hudson/cli/NoCheckTrustManager.java

Jose Sa added a comment - 2013-02-23 10:58

I tried using the suggestion with 'ssh host groovy = < file', on 1.491 and 1.501 and both still fails with message "This command can only run with Jenkins CLI. See https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+CLI"

Jose Sa added a comment - 2013-02-23 10:58 I tried using the suggestion with 'ssh host groovy = < file', on 1.491 and 1.501 and both still fails with message "This command can only run with Jenkins CLI. See https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+CLI "

Matt Certain added a comment - 2013-05-04 01:58

This issue does not seem to be completely fixed. Here's the output I see when trying to use this fix.

Skipping HTTPS certificate checks altogether. Note that this is not secure at all.
Exception in thread "main" java.io.IOException: Failed to connect to https://<REMOVED>/
        at hudson.cli.CLI.getCliTcpPort(CLI.java:274)
        at hudson.cli.CLI.<init>(CLI.java:134)
        at hudson.cli.CLIConnectionFactory.connect(CLIConnectionFactory.java:72)
        at hudson.cli.CLI._main(CLI.java:469)
        at hudson.cli.CLI.main(CLI.java:384)
        Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available
                at sun.security.ssl.Alerts.getSSLException(Unknown Source)
                at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
                at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
                at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
                at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
                at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
                at sun.security.ssl.Handshaker.processLoop(Unknown Source)
                at sun.security.ssl.Handshaker.process_record(Unknown Source)
                at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
                at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
                at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
                at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
                at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
                at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
                at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
                at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source)
                at hudson.cli.FullDuplexHttpStream.<init>(FullDuplexHttpStream.java:77)
                at hudson.cli.CLI.connectViaHttp(CLI.java:164)
                at hudson.cli.CLI.<init>(CLI.java:138)
                ... 3 more
        Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available
                at sun.security.ssl.DummyX509TrustManager.checkServerTrusted(Unknown Source)
                ... 18 more
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available
        at sun.security.ssl.Alerts.getSSLException(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
        at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
        at sun.security.ssl.Handshaker.processLoop(Unknown Source)
        at sun.security.ssl.Handshaker.process_record(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at hudson.cli.CLI.getCliTcpPort(CLI.java:272)
        ... 4 more
Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available
        at sun.security.ssl.DummyX509TrustManager.checkServerTrusted(Unknown Source)
        ... 16 more

Matt Certain added a comment - 2013-05-04 01:58 This issue does not seem to be completely fixed. Here's the output I see when trying to use this fix. Skipping HTTPS certificate checks altogether. Note that this is not secure at all. Exception in thread "main" java.io.IOException: Failed to connect to https://<REMOVED>/ at hudson.cli.CLI.getCliTcpPort(CLI.java:274) at hudson.cli.CLI.<init>(CLI.java:134) at hudson.cli.CLIConnectionFactory.connect(CLIConnectionFactory.java:72) at hudson.cli.CLI._main(CLI.java:469) at hudson.cli.CLI.main(CLI.java:384) Suppressed: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available at sun.security.ssl.Alerts.getSSLException(Unknown Source) at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) at sun.security.ssl.Handshaker.processLoop(Unknown Source) at sun.security.ssl.Handshaker.process_record(Unknown Source) at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source) at hudson.cli.FullDuplexHttpStream.<init>(FullDuplexHttpStream.java:77) at hudson.cli.CLI.connectViaHttp(CLI.java:164) at hudson.cli.CLI.<init>(CLI.java:138) ... 3 more Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available at sun.security.ssl.DummyX509TrustManager.checkServerTrusted(Unknown Source) ... 18 more Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available at sun.security.ssl.Alerts.getSSLException(Unknown Source) at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) at sun.security.ssl.Handshaker.processLoop(Unknown Source) at sun.security.ssl.Handshaker.process_record(Unknown Source) at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source) at hudson.cli.CLI.getCliTcpPort(CLI.java:272) ... 4 more Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available at sun.security.ssl.DummyX509TrustManager.checkServerTrusted(Unknown Source) ... 16 more

Beho Alheit added a comment - 2013-05-23 08:02

I am having exactly the same issue as Matt Certain.

Jenkins: 1.515

Beho Alheit added a comment - 2013-05-23 08:02 I am having exactly the same issue as Matt Certain. Jenkins: 1.515

Wilder Rodrigues added a comment - 2013-09-25 07:08

Hello guys,

Unfortunately, I'm facing the same problem. I already tried importing the certificate into my /etc/pki/java/cacerts and also the -noCertificateCheck option. The same issue as mentioned by Maat Certain happens.

We are using Jenkins Enterprise, deployed along with the Jenkins HA Monitor.

Anyway to get this issue fixed?

> java -jar jenkins-cli.jar -s https://jenkins.XXX.com/ -noCertificateCheck --username wrodrigues --password-file passwd help
Skipping HTTPS certificate checks altogether. Note that this is not secure at all.
Exception in thread "main" java.io.IOException: Failed to connect to https://jenkins.schubergphilis.com/
at hudson.cli.CLI.getCliTcpPort(CLI.java:274)
at hudson.cli.CLI.<init>(CLI.java:134)
at hudson.cli.CLIConnectionFactory.connect(CLIConnectionFactory.java:72)
at hudson.cli.CLI._main(CLI.java:469)
at hudson.cli.CLI.main(CLI.java:384)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1764)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:958)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1203)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1230)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1214)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:133)
at hudson.cli.CLI.getCliTcpPort(CLI.java:272)
... 4 more
Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available
at com.sun.net.ssl.internal.ssl.DummyX509TrustManager.checkServerTrusted(SSLContextImpl.java:232)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1198)
... 15 more

Wilder Rodrigues added a comment - 2013-09-25 07:08 Hello guys, Unfortunately, I'm facing the same problem. I already tried importing the certificate into my /etc/pki/java/cacerts and also the -noCertificateCheck option. The same issue as mentioned by Maat Certain happens. We are using Jenkins Enterprise, deployed along with the Jenkins HA Monitor. Anyway to get this issue fixed? > java -jar jenkins-cli.jar -s https://jenkins.XXX.com/ -noCertificateCheck --username wrodrigues --password-file passwd help Skipping HTTPS certificate checks altogether. Note that this is not secure at all. Exception in thread "main" java.io.IOException: Failed to connect to https://jenkins.schubergphilis.com/ at hudson.cli.CLI.getCliTcpPort(CLI.java:274) at hudson.cli.CLI.<init>(CLI.java:134) at hudson.cli.CLIConnectionFactory.connect(CLIConnectionFactory.java:72) at hudson.cli.CLI._main(CLI.java:469) at hudson.cli.CLI.main(CLI.java:384) Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1764) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:958) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1203) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1230) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1214) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:133) at hudson.cli.CLI.getCliTcpPort(CLI.java:272) ... 4 more Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available at com.sun.net.ssl.internal.ssl.DummyX509TrustManager.checkServerTrusted(SSLContextImpl.java:232) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1198) ... 15 more

SCM/JIRA link daemon added a comment - 2013-09-25 08:49

Code changed in jenkins
User: Stephen Connolly
Path:
cli/src/main/java/hudson/cli/NoCheckTrustManager.java
http://jenkins-ci.org/commit/jenkins/0ab79882978292f3751be8e0acf5ae7edb0751f1
Log:
[FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate.

NoCheckTrustManager needed to implement X509TrustManager not just plain TrustManager

SCM/JIRA link daemon added a comment - 2013-09-25 08:49 Code changed in jenkins User: Stephen Connolly Path: cli/src/main/java/hudson/cli/NoCheckTrustManager.java http://jenkins-ci.org/commit/jenkins/0ab79882978292f3751be8e0acf5ae7edb0751f1 Log: [FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate. NoCheckTrustManager needed to implement X509TrustManager not just plain TrustManager

Stephen Connolly added a comment - 2013-09-25 08:50

Adding as an lts-candidate as the latest fix (0ab79882978292f3751be8e0acf5ae7edb0751f1) is just a widening of the implemented interface of NoCheckTrustManager from implements TrustManager to implements X509TrustManager so is zero risk and fixes the bug.

Stephen Connolly added a comment - 2013-09-25 08:50 Adding as an lts-candidate as the latest fix (0ab79882978292f3751be8e0acf5ae7edb0751f1) is just a widening of the implemented interface of NoCheckTrustManager from implements TrustManager to implements X509TrustManager so is zero risk and fixes the bug.

dogfood added a comment - 2013-09-25 10:20

Integrated in jenkins_main_trunk #2893
[FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate. (Revision 0ab79882978292f3751be8e0acf5ae7edb0751f1)

Result = UNSTABLE
Stephen Connolly : 0ab79882978292f3751be8e0acf5ae7edb0751f1
Files :

cli/src/main/java/hudson/cli/NoCheckTrustManager.java

dogfood added a comment - 2013-09-25 10:20 Integrated in jenkins_main_trunk #2893 [FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate. (Revision 0ab79882978292f3751be8e0acf5ae7edb0751f1) Result = UNSTABLE Stephen Connolly : 0ab79882978292f3751be8e0acf5ae7edb0751f1 Files : cli/src/main/java/hudson/cli/NoCheckTrustManager.java

SCM/JIRA link daemon added a comment - 2013-10-09 08:45

Code changed in jenkins
User: Stephen Connolly
Path:
cli/src/main/java/hudson/cli/NoCheckTrustManager.java
http://jenkins-ci.org/commit/jenkins/fb71d62ae163d39e289d9cb11b57abd9aabbef4d
Log:
[FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate.

NoCheckTrustManager needed to implement X509TrustManager not just plain TrustManager

(cherry picked from commit 0ab79882978292f3751be8e0acf5ae7edb0751f1)

SCM/JIRA link daemon added a comment - 2013-10-09 08:45 Code changed in jenkins User: Stephen Connolly Path: cli/src/main/java/hudson/cli/NoCheckTrustManager.java http://jenkins-ci.org/commit/jenkins/fb71d62ae163d39e289d9cb11b57abd9aabbef4d Log: [FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate. NoCheckTrustManager needed to implement X509TrustManager not just plain TrustManager (cherry picked from commit 0ab79882978292f3751be8e0acf5ae7edb0751f1)

Daniel Beck added a comment - 2014-01-13 15:36

Does not seem to be in 1.532.x, so should probably be backported to 1.532.2, as it's effectively a regression from 1.509.4.

Daniel Beck added a comment - 2014-01-13 15:36 Does not seem to be in 1.532.x, so should probably be backported to 1.532.2, as it's effectively a regression from 1.509.4.

SCM/JIRA link daemon added a comment - 2014-01-13 19:49

Code changed in jenkins
User: Stephen Connolly
Path:
cli/src/main/java/hudson/cli/NoCheckTrustManager.java
http://jenkins-ci.org/commit/jenkins/867a35523c2f6cf7a88e1ddb11c471652c7df5a9
Log:
[FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate.

NoCheckTrustManager needed to implement X509TrustManager not just plain TrustManager

(cherry picked from commit 0ab79882978292f3751be8e0acf5ae7edb0751f1)

Compare: https://github.com/jenkinsci/jenkins/compare/de78db8d6ba0...867a35523c2f

SCM/JIRA link daemon added a comment - 2014-01-13 19:49 Code changed in jenkins User: Stephen Connolly Path: cli/src/main/java/hudson/cli/NoCheckTrustManager.java http://jenkins-ci.org/commit/jenkins/867a35523c2f6cf7a88e1ddb11c471652c7df5a9 Log: [FIXED JENKINS-12629] Using jenkins-cli connecting to HTTPS port fails due to hostname mismatch in certificate. NoCheckTrustManager needed to implement X509TrustManager not just plain TrustManager (cherry picked from commit 0ab79882978292f3751be8e0acf5ae7edb0751f1) Compare: https://github.com/jenkinsci/jenkins/compare/de78db8d6ba0...867a35523c2f

Assignee:: Unassigned

Reporter:: Jose Sa

Votes:: 3 Vote for this issue

Watchers:: 13 Start watching this issue

Created:: 2012-02-02 12:30

Updated:: 2017-04-15 23:15

Resolved:: 2013-09-25 08:49

Details

Description

Attachments

Activity

Collapse comment: R. Tyler Croy added a comment - 2013-02-07 14:42

Expand comment: R. Tyler Croy added a comment - 2013-02-07 14:42

Collapse comment: Jose Sa added a comment - 2013-02-07 14:52

Expand comment: Jose Sa added a comment - 2013-02-07 14:52

Collapse comment: R. Tyler Croy added a comment - 2013-02-11 11:31

Expand comment: R. Tyler Croy added a comment - 2013-02-11 11:31

Collapse comment: Jose Sa added a comment - 2013-02-11 12:42, Edited by Jose Sa - 2013-02-11 12:43

Expand comment: Jose Sa added a comment - 2013-02-11 12:42, Edited by Jose Sa - 2013-02-11 12:43

Collapse comment: Kohsuke Kawaguchi added a comment - 2013-02-22 23:54

Expand comment: Kohsuke Kawaguchi added a comment - 2013-02-22 23:54

Collapse comment: SCM/JIRA link daemon added a comment - 2013-02-23 00:07

Expand comment: SCM/JIRA link daemon added a comment - 2013-02-23 00:07

Collapse comment: dogfood added a comment - 2013-02-23 01:05

Expand comment: dogfood added a comment - 2013-02-23 01:05

Collapse comment: Jose Sa added a comment - 2013-02-23 10:58

Expand comment: Jose Sa added a comment - 2013-02-23 10:58

Collapse comment: Matt Certain added a comment - 2013-05-04 01:58

Expand comment: Matt Certain added a comment - 2013-05-04 01:58

Collapse comment: Beho Alheit added a comment - 2013-05-23 08:02

Expand comment: Beho Alheit added a comment - 2013-05-23 08:02

Collapse comment: Wilder Rodrigues added a comment - 2013-09-25 07:08

Expand comment: Wilder Rodrigues added a comment - 2013-09-25 07:08

Collapse comment: SCM/JIRA link daemon added a comment - 2013-09-25 08:49

Expand comment: SCM/JIRA link daemon added a comment - 2013-09-25 08:49

Collapse comment: Stephen Connolly added a comment - 2013-09-25 08:50

Expand comment: Stephen Connolly added a comment - 2013-09-25 08:50

Collapse comment: dogfood added a comment - 2013-09-25 10:20

Expand comment: dogfood added a comment - 2013-09-25 10:20

Collapse comment: SCM/JIRA link daemon added a comment - 2013-10-09 08:45

Expand comment: SCM/JIRA link daemon added a comment - 2013-10-09 08:45

Collapse comment: Daniel Beck added a comment - 2014-01-13 15:36

Expand comment: Daniel Beck added a comment - 2014-01-13 15:36

Collapse comment: SCM/JIRA link daemon added a comment - 2014-01-13 19:49

Expand comment: SCM/JIRA link daemon added a comment - 2014-01-13 19:49

People

Dates