Public key of the first certificate in chain

This issue is archived. You can view it, but you can't modify it. Learn more

XMLWordPrintable

      After upgrading to the version Jenkins 2.462.1 pods in k8s have stopped connecting
      Pods os ubuntu22

      Picked up _JAVA_OPTIONS: -XX:-UsePerfDataSep 
      WARNING: The "-jnlpUrl" argument is deprecated. Use "-url" and "-name" instead, potentially also passing in "-webSocket", "-tunnel", and/or work directory options as needed. 02, 2024 12:44:07 PM hudson.remoting.Launcher createEngineINFO: Setting up agent: job-name-11-8p1xh-2ph6sSep 02, 2024 12:44:07 PM hudson.remoting.Engine startEngineINFO: Using Remoting version: 3248.3250.v3277a_8e88c9b_Sep 02, 2024 12:44:07 PM hudson.remoting.Engine startEngineWARNING: No Working Directory. Using the legacy JAR Cache location: /home/jenkins/.jenkins/cache/jarsSep 02, 2024 12:44:08 PM hudson.remoting.Launcher$CuiListener statusINFO: Locating server among [https://jenkins-xxx.com/]Sep 02, 2024 12:44:09 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver resolveINFO: Remoting server accepts the following protocols: [JNLP4-connect, Ping]Sep 02, 2024 12:44:09 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver resolveINFO: Remoting TCP connection tunneling is enabled. Skipping the TCP Agent Listener Port availability checkSep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: Agent discovery successful  Agent address: jenkins-xxx.com  Agent port:    50000  Identity:      df:1d:61:39:1d:bc:f9:db:97:a7:c7:ed:ee:d7:b5:19Sep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: HandshakingSep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: Connecting to jenkins-xxx.com:50000Sep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: Server reports protocol JNLP4-connect-proxy not supported, skippingSep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: Trying protocol: JNLP4-connectSep 02, 2024 12:44:09 PM org.jenkinsci.remoting.protocol.impl.BIONetworkLayer$Reader runINFO: Waiting for ProtocolStack to start.Sep 02, 2024 12:44:09 PM org.jenkinsci.remoting.protocol.impl.SSLEngineFilterLayer onRecvSEVERE: [JNLP4-connect connection to jenkins-xxx.com/hide_ip:50000] javax.net.ssl.SSLHandshakeException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=36d8c2e4c768f70758506cb3496a7887) is not in the list of trusted keys    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:360)    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:303)    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:298)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1076)    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1063)    at java.base/java.security.AccessController.doPrivileged(Native Method)    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1010)    at org.jenkinsci.remoting.protocol.impl.SSLEngineFilterLayer.processRead(SSLEngineFilterLayer.java:378)    at org.jenkinsci.remoting.protocol.impl.SSLEngineFilterLayer.onRecv(SSLEngineFilterLayer.java:119)    at org.jenkinsci.remoting.protocol.ProtocolStack$Ptr.onRecv(ProtocolStack.java:677)    at org.jenkinsci.remoting.protocol.impl.AckFilterLayer.onRecv(AckFilterLayer.java:256)    at org.jenkinsci.remoting.protocol.ProtocolStack$Ptr.onRecv(ProtocolStack.java:677)    at org.jenkinsci.remoting.protocol.NetworkLayer.onRead(NetworkLayer.java:137)    at org.jenkinsci.remoting.protocol.impl.BIONetworkLayer.access$1400(BIONetworkLayer.java:51)    at org.jenkinsci.remoting.protocol.impl.BIONetworkLayer$Reader.run(BIONetworkLayer.java:293)    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)    at hudson.remoting.Engine$1.lambda$newThread$0(Engine.java:140)    at java.base/java.lang.Thread.run(Thread.java:829)Caused by: java.security.cert.CertificateException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=36d8c2e4c768f70758506cb3496a7887) is not in the list of trusted keys    at org.jenkinsci.remoting.protocol.cert.PublicKeyMatchingX509ExtendedTrustManager.checkPublicKey(PublicKeyMatchingX509ExtendedTrustManager.java:216)    at org.jenkinsci.remoting.protocol.cert.PublicKeyMatchingX509ExtendedTrustManager.checkServerTrusted(PublicKeyMatchingX509ExtendedTrustManager.java:262)    at org.jenkinsci.remoting.protocol.cert.DelegatingX509ExtendedTrustManager.checkServerTrusted(DelegatingX509ExtendedTrustManager.java:147)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)    ... 20 more
      Sep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: Protocol JNLP4-connect encountered an unexpected exceptionjava.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=36d8c2e4c768f70758506cb3496a7887) is not in the list of trusted keys    at org.jenkinsci.remoting.util.SettableFuture.get(SettableFuture.java:223)    at hudson.remoting.Engine.innerRun(Engine.java:890)    at hudson.remoting.Engine.run(Engine.java:574)Caused by: javax.net.ssl.SSLHandshakeException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=36d8c2e4c768f70758506cb3496a7887) is not in the list of trusted keys    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:360)    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:303)    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:298)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1076)    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1063)    at java.base/java.security.AccessController.doPrivileged(Native Method)    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1010)    at org.jenkinsci.remoting.protocol.impl.SSLEngineFilterLayer.processRead(SSLEngineFilterLayer.java:378)    at org.jenkinsci.remoting.protocol.impl.SSLEngineFilterLayer.onRecv(SSLEngineFilterLayer.java:119)    at org.jenkinsci.remoting.protocol.ProtocolStack$Ptr.onRecv(ProtocolStack.java:677)    at org.jenkinsci.remoting.protocol.impl.AckFilterLayer.onRecv(AckFilterLayer.java:256)    at org.jenkinsci.remoting.protocol.ProtocolStack$Ptr.onRecv(ProtocolStack.java:677)    at org.jenkinsci.remoting.protocol.NetworkLayer.onRead(NetworkLayer.java:137)    at org.jenkinsci.remoting.protocol.impl.BIONetworkLayer.access$1400(BIONetworkLayer.java:51)    at org.jenkinsci.remoting.protocol.impl.BIONetworkLayer$Reader.run(BIONetworkLayer.java:293)    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)    at hudson.remoting.Engine$1.lambda$newThread$0(Engine.java:140)    at java.base/java.lang.Thread.run(Thread.java:829)Caused by: java.security.cert.CertificateException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=36d8c2e4c768f70758506cb3496a7887) is not in the list of trusted keys    at org.jenkinsci.remoting.protocol.cert.PublicKeyMatchingX509ExtendedTrustManager.checkPublicKey(PublicKeyMatchingX509ExtendedTrustManager.java:216)    at org.jenkinsci.remoting.protocol.cert.PublicKeyMatchingX509ExtendedTrustManager.checkServerTrusted(PublicKeyMatchingX509ExtendedTrustManager.java:262)    at org.jenkinsci.remoting.protocol.cert.DelegatingX509ExtendedTrustManager.checkServerTrusted(DelegatingX509ExtendedTrustManager.java:147)    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)    ... 20 more
      Sep 02, 2024 12:44:09 PM hudson.remoting.Launcher$CuiListener statusINFO: reconnect rejected, sleeping 10s: java.lang.Exception: The server rejected the connection: None of the protocols were accepted    at hudson.remoting.Engine.onConnectionRejected(Engine.java:969)    at hudson.remoting.Engine.innerRun(Engine.java:916)    at hudson.remoting.Engine.run(Engine.java:574)
       

      Why did we start checking ssl for the jenkins tunnel.

      I analyzed a little bit that the connection via websocket works correctly

      Kubernetes plugin
      Version: 4285.v50ed5f624918

      I have a running Jenkins version 2.440.1 аnd I don't see any such problems there.

      Picked up _JAVA_OPTIONS: -XX:-UsePerfDataWARNING: The "-jnlpUrl" argument is deprecated. Use "-url" and "-name" instead, potentially also passing in "-webSocket", "-tunnel", and/or work directory options as needed.Sep 02, 2024 12:33:11 PM hudson.remoting.Launcher createEngineINFO: Setting up agent: job-name-fdwtdSep 02, 2024 12:33:11 PM hudson.remoting.Engine startEngineINFO: Using Remoting version: 3206.vb_15dcf73f6a_9Sep 02, 2024 12:33:11 PM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDirINFO: Using /home/jenkins/agent/remoting as a remoting work directorySep 02, 2024 12:33:11 PM org.jenkinsci.remoting.engine.WorkDirManager setupLoggingINFO: Both error and output logs will be printed to /home/jenkins/agent/remotingSep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Locating server among [https://jenkins-xxx.com/]Sep 02, 2024 12:33:11 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver resolveINFO: Remoting server accepts the following protocols: [JNLP4-connect, Ping]Sep 02, 2024 12:33:11 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver resolveINFO: Remoting TCP connection tunneling is enabled. Skipping the TCP Agent Listener Port availability checkSep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Agent discovery successful  Agent address: jenkins-xxx.com  Agent port:    50000  Identity:      19:ba:eb:ac:c0:2c:66:b8:0b:79:ff:c0:26:7b:2a:05Sep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: HandshakingSep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Connecting to jenkins-xxx.com:50000Sep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Server reports protocol JNLP4-connect-proxy not supported, skippingSep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Trying protocol: JNLP4-connectSep 02, 2024 12:33:11 PM org.jenkinsci.remoting.protocol.impl.BIONetworkLayer$Reader runINFO: Waiting for ProtocolStack to start.Sep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Remote identity confirmed: 19:ba:eb:ac:c0:2c:66:b8:0b:79:ff:c0:26:7b:2a:05Sep 02, 2024 12:33:11 PM hudson.remoting.Launcher$CuiListener statusINFO: Connected

      Kubernetes plugin
      Version: 4144.vfd176ec18694

       

       

            Assignee:
            Jeff Thompson
            Reporter:
            Oleg
            Archiver:
            Jenkins Service Account

              Created:
              Updated:
              Archived: