Details
-
Type:
Bug
-
Status: Fixed but Unreleased (View Workflow)
-
Priority:
Critical
-
Resolution: Not A Defect
-
Component/s: subversion-plugin
-
Labels:
-
Environment:Jenkins ver: 1.598
Subversion ver: 2.5
-
Similar Issues:
Description
I'm having trouble trying to setup Jenkins to talk to our SVN server..
Below is a error I get.
Unable to access https://svn.dut.testexeter.local/svn/Chianti : svn: E175002: handshake alert: unrecognized_name
svn: E175002: OPTIONS request failed on '/svn/Chianti'
org.tmatesoft.svn.core.SVNException: svn: E175002: handshake alert: unrecognized_name
svn: E175002: OPTIONS request failed on '/svn/Chianti'
at org.tmatesoft.svn.core.internal.wc.SVNErrorManager.error(SVNErrorManager.java:106)
at org.tmatesoft.svn.core.internal.wc.SVNErrorManager.error(SVNErrorManager.java:90)
at org.tmatesoft.svn.core.internal.io.dav.http.HTTPConnection.request(HTTPConnection.java:764)
at org.tmatesoft.svn.core.internal.io.dav.http.HTTPConnection.request(HTTPConnection.java:371)
at org.tmatesoft.svn.core.internal.io.dav.http.HTTPConnection.request(HTTPConnection.java:359)
at org.tmatesoft.svn.core.internal.io.dav.DAVConnection.performHttpRequest(DAVConnection.java:710)
at org.tmatesoft.svn.core.internal.io.dav.DAVConnection.exchangeCapabilities(DAVConnection.java:627)
at org.tmatesoft.svn.core.internal.io.dav.DAVConnection.open(DAVConnection.java:102)
at org.tmatesoft.svn.core.internal.io.dav.DAVRepository.openConnection(DAVRepository.java:1032)
at org.tmatesoft.svn.core.internal.io.dav.DAVRepository.testConnection(DAVRepository.java:94)
at hudson.scm.SubversionSCM$DescriptorImpl.checkRepositoryPath(SubversionSCM.java:2282)
at hudson.scm.SubversionSCM$ModuleLocation$DescriptorImpl.checkCredentialsId(SubversionSCM.java:3043)
at hudson.scm.SubversionSCM$ModuleLocation$DescriptorImpl.doCheckCredentialsId(SubversionSCM.java:3016)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:298)
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:161)
at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:96)
at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:121)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)
at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:249)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)
at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:249)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)
at org.kohsuke.stapler.Stapler.service(Stapler.java:238)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)
at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:686)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1494)
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:123)
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:114)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:48)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)
at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)
at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1474)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:499)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:533)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:428)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)
at org.eclipse.jetty.server.Server.handle(Server.java:370)
at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)
at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:949)
at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1011)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)
at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)
at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLProtocolException: handshake alert: unrecognized_name
at sun.security.ssl.ClientHandshaker.handshakeAlert(Unknown Source)
at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.writeRecord(Unknown Source)
at sun.security.ssl.AppOutputStream.write(Unknown Source)
at java.io.BufferedOutputStream.flushBuffer(Unknown Source)
at java.io.BufferedOutputStream.flush(Unknown Source)
at org.tmatesoft.svn.core.internal.io.dav.http.HTTPConnection.sendData(HTTPConnection.java:321)
at org.tmatesoft.svn.core.internal.io.dav.http.HTTPRequest.dispatch(HTTPRequest.java:170)
at org.tmatesoft.svn.core.internal.io.dav.http.HTTPConnection.request(HTTPConnection.java:463)
... 72 more
Attachments
Activity
I appreciate that there is a workaround, but the workaround is not feasible considering the current Oracle support plan for Java 6 (EOS 2013) and 7 (EOS April, 2015).
Curt Clayton
added a comment - I appreciate that there is a workaround, but the workaround is not feasible considering the current Oracle support plan for Java 6 (EOS 2013) and 7 (EOS April, 2015). First google hit for the error message points to http://stackoverflow.com/questions/7615645/ssl-handshake-alert-unrecognized-name-error-since-upgrade-to-java-1-7-0
Have you tried that?
with JDK >1.7 you have to add -Djsse.enableSNIExtension=false to JENKINS_JAVA_OPTIONS or configure properly your server, the reason is a wrong configuration of virtual hosts on the server side. The server sends a warning, browsers are ignoring it, but Java terminates. Oracle means it's "not a defect": http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7127374
Setting -Djsse.enableSNIExtension=false fixes the Subversion checkout error, but introduces a new error when initally starting Jenkins. The new error is:
ci_1 | javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching updates.jenkins.io found. ci_1 | at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ci_1 | at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964) ci_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328) ci_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322) ci_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614) ci_1 | at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ci_1 | at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ci_1 | at sun.security.ssl.Handshaker.process_record(Handshaker.java:987) ci_1 | at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072) ci_1 | at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385) ci_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413) ci_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397) ci_1 | at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559) ci_1 | at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) ci_1 | at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1564) ci_1 | at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492) ci_1 | at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:263) ci_1 | at hudson.model.DownloadService.loadJSON(DownloadService.java:167) ci_1 | at hudson.model.UpdateSite.updateDirectlyNow(UpdateSite.java:185) ci_1 | at hudson.model.UpdateCenter.updateDefaultSite(UpdateCenter.java:2185) ci_1 | at jenkins.install.SetupWizard.init(SetupWizard.java:179) ci_1 | at jenkins.install.InstallState$InitialSecuritySetup.initializeState(InstallState.java:164) ci_1 | at jenkins.model.Jenkins.setInstallState(Jenkins.java:1039) ci_1 | at jenkins.install.InstallUtil.proceedToNextStateFrom(InstallUtil.java:97) ci_1 | at jenkins.install.InstallState$Unknown.initializeState(InstallState.java:82) ci_1 | at jenkins.model.Jenkins$17.run(Jenkins.java:3201) ci_1 | at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:169) ci_1 | at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:296) ci_1 | at jenkins.model.Jenkins$5.runTask(Jenkins.java:1068) ci_1 | at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:214) ci_1 | at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117) ci_1 | at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ci_1 | at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ci_1 | at java.lang.Thread.run(Thread.java:748) ci_1 | Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching updates.jenkins.io found. ci_1 | at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:214) ci_1 | at sun.security.util.HostnameChecker.match(HostnameChecker.java:96) ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455) ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436) ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200) ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) ci_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596) ci_1 | ... 29 more
Rares Vernica
added a comment - Setting -Djsse.enableSNIExtension=false fixes the Subversion checkout error, but introduces a new error when initally starting Jenkins. The new error is:
ci_1 | javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching updates.jenkins.io found.
ci_1 | at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
ci_1 | at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
ci_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
ci_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
ci_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
ci_1 | at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
ci_1 | at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
ci_1 | at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
ci_1 | at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
ci_1 | at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
ci_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
ci_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
ci_1 | at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
ci_1 | at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
ci_1 | at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1564)
ci_1 | at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492)
ci_1 | at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:263)
ci_1 | at hudson.model.DownloadService.loadJSON(DownloadService.java:167)
ci_1 | at hudson.model.UpdateSite.updateDirectlyNow(UpdateSite.java:185)
ci_1 | at hudson.model.UpdateCenter.updateDefaultSite(UpdateCenter.java:2185)
ci_1 | at jenkins.install.SetupWizard.init(SetupWizard.java:179)
ci_1 | at jenkins.install.InstallState$InitialSecuritySetup.initializeState(InstallState.java:164)
ci_1 | at jenkins.model.Jenkins.setInstallState(Jenkins.java:1039)
ci_1 | at jenkins.install.InstallUtil.proceedToNextStateFrom(InstallUtil.java:97)
ci_1 | at jenkins.install.InstallState$Unknown.initializeState(InstallState.java:82)
ci_1 | at jenkins.model.Jenkins$17.run(Jenkins.java:3201)
ci_1 | at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:169)
ci_1 | at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:296)
ci_1 | at jenkins.model.Jenkins$5.runTask(Jenkins.java:1068)
ci_1 | at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:214)
ci_1 | at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
ci_1 | at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
ci_1 | at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
ci_1 | at java.lang. Thread .run( Thread .java:748)
ci_1 | Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching updates.jenkins.io found.
ci_1 | at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:214)
ci_1 | at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200)
ci_1 | at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
ci_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
ci_1 | ... 29 more
Please see https://serverfault.com/questions/807959/what-is-the-difference-between-san-and-sni-ssl-certificates and configure your certificates properly.
Ivan Fernandez Calvo I think the issue is with the updates.jenkins.io certificates. See note in the error trace.
Rares Vernica
added a comment - Ivan Fernandez Calvo I think the issue is with the updates.jenkins.io certificates. See note in the error trace. yep, you disable SNI to fix an issue with your certificates and you break the TLS extension, the protocols SSL, and TLS 1.0 are no longer secures and are disabled on most of the applications and servers, check your certificates if they are correct, they must work with the SNI extension enabled, you will fix both issues
http://www.chromium.org/administrators/policy-list-3#SSLVersionMin
https://security.stackexchange.com/questions/70719/ssl3-poodle-vulnerability/70724#70724
https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls
We have now resolved this.
Anyone wishing to know, this is what we did to resolve it:
1) Uninstall any Java version higher than 7.
2) Downloaded and installed JDK or JRE version 6u10.
3) Opened Jenkins.XML with Notepad ++.
4) Changed the following parameter from <executable>%BASE%\jre\bin\java</executable> to <executable>C:\Program Files\Java\jre6\bin\java</executable>
If you navigate to %BASE%\jre\bin\java and see what the file version is (java.exe) you will notice its version 7, which is what has caused this issue for us. So it looks like Java JRE 7 is bundled with the Jenkins(Windows) installation, and by changing the above parameter you're basically telling Jenkins to use the version you just installed, which works.
Might come in handy if anyone else experiences this issue.
Kind regards,
Alex