Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-57197

Anchore plugin won't connect to self-signed cert

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      We have Anchore Engine running in Kubernetes with a self-signed certificate. Locally, to connect to the remote service we need to use the --insecure flag. However, in the Jenkins Anchore plugin configuration, the "Verify SSL" checkbox appears to have no bearing. We have it deselected, but either way we cannot connect to anchore. The only way to connect to it is to use the internal Cluster IP given Jenkins is deployed also within Kubernetes. Is this a plugin issue or is this something within Kubernetes itself?

      The error we see is:

      2019-04-26T09:51:27.963 ERROR  AnchoreWorker   Failed to add image(s) to anchore-engine due to an unexpected error
      javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      	at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
      	at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
      	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
      	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
      	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
      	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
      	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
      	at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
      	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
      	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
      	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
      	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
      	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:396)
      	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)
      	at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
      	at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:359)
      	at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
      	at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
      	at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
      	at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
      	at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
      	at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
      	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
      	at com.anchore.jenkins.plugins.anchore.BuildWorker.runAnalyzerEngine(BuildWorker.java:250)
      	at com.anchore.jenkins.plugins.anchore.BuildWorker.runAnalyzer(BuildWorker.java:177)
      	at com.anchore.jenkins.plugins.anchore.AnchoreBuilder.perform(AnchoreBuilder.java:335)
      	at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:80)
      	at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:67)
      	at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
      	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
      	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
      	at java.lang.Thread.run(Thread.java:748)
      Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
      	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
      	at sun.security.validator.Validator.validate(Validator.java:262)
      	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
      	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
      	at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:105)
      	at org.apache.http.conn.ssl.SSLContextBuilder$TrustManagerDelegate.checkServerTrusted(SSLContextBuilder.java:192)
      	at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:992)
      	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
      	... 29 more
      Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      	at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
      	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
      	at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
      	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
      	... 37 more
      2019-04-26T09:51:27.966 ERROR  AnchorePlugin   Failing Anchore Container Image Scanner Plugin step due to errors in plugin execution
      hudson.AbortException: Failed to add image(s) to anchore-engine due to an unexpected error. Please refer to above logs for more information
      	at com.anchore.jenkins.plugins.anchore.BuildWorker.runAnalyzerEngine(BuildWorker.java:280)
      	at com.anchore.jenkins.plugins.anchore.BuildWorker.runAnalyzer(BuildWorker.java:177)
      	at com.anchore.jenkins.plugins.anchore.AnchoreBuilder.perform(AnchoreBuilder.java:335)
      	at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:80)
      	at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:67)
      	at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
      	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
      	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
      	at java.lang.Thread.run(Thread.java:748)
      

        Attachments

          Activity

          There are no comments yet on this issue.

            People

            Assignee:
            nurmi Daniel Nurmi
            Reporter:
            jremitz Jake Remitz
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated: