ssl - Jenkins 工作-DSL : How to accept URL over Https with own root-ca signed certificate?

Question

我想通过 HTTPS 读取 xml 流。网络服务器有一个由我们自己创建的非官方 CA 签名的证书。

我知道我需要导入 CA 证书才能使我的 Groovy 作业 DSL 脚本正常工作。

我需要在哪里导入 ca 证书或者我如何定义我自己的 trustStore 以使其工作？

我之前尝试过的:

• 使用 key 工具将 CA 证书导入到 C:\Program Files (x86)\Java\jre1.8.0_40\lib\security\cacert
• 使用 keytool 导入 CA 证书到 C:\Program Files (x86)\jenkins\jre\lib\security\cacert

当我在将 CA 证书导入到 cacert trustStore 后尝试与 groovyConsole 连接时，一切正常，但在 Jenkins 中不行。

所以我尝试在我的作业 DSL 脚本中设置一个 trustStore 但没有成功。仍然收到证书链错误异常:

def addr          = "https://example.com:8443/svn/"
def authString    = "user:pass".getBytes().encodeBase64().toString()
def jobNamePrefix = "Job"

println("${WORKSPACE}\\epedev.keystore")
System.setProperty("javax.net.ssl.trustStore", "${WORKSPACE}\\epedev.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

def conn = addr.toURL().openConnection()

控制台代码段:

Processing provided DSL script
C:\Jenkins\ps\seed\Seed PS Projects from SVN\workspace\epedev.keystore
FATAL: Unable to run script
java.io.IOException: Unable to run script
    at javaposse.jobdsl.dsl.DslScriptLoader.runDslEngineForParent(DslScriptLoader.java:92)
    at javaposse.jobdsl.dsl.DslScriptLoader.runDslEngine(DslScriptLoader.java:123)
    at javaposse.jobdsl.plugin.ExecuteDslScripts.perform(ExecuteDslScripts.java:216)
    at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
    at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:779)
    at hudson.model.Build$BuildExecution.build(Build.java:205)
    at hudson.model.Build$BuildExecution.doRun(Build.java:162)
    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:537)
    at hudson.model.Run.execute(Run.java:1741)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:98)
    at hudson.model.Executor.run(Executor.java:408)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
    at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
    at sun.security.ssl.Handshaker.processLoop(Unknown Source)
    at sun.security.ssl.Handshaker.process_record(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at java.net.HttpURLConnection.getResponseCode(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:90)
    at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:233)
    at groovy.lang.MetaClassImpl$GetBeanMethodMetaProperty.getProperty(MetaClassImpl.java:3500)
    at org.codehaus.groovy.runtime.callsite.GetEffectivePojoPropertySite.getProperty(GetEffectivePojoPropertySite.java:61)
    at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callGetProperty(AbstractCallSite.java:227)
    at script.run(script:12)
    at javaposse.jobdsl.dsl.DslScriptLoader.runDslEngineForParent(DslScriptLoader.java:80)
    ... 11 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
    at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
    at sun.security.validator.Validator.validate(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
    ... 35 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
    at java.security.cert.CertPathBuilder.build(Unknown Source)
    ... 41 more
Started calculate disk usage of build
Finished Calculation of disk usage of build in 0 seconds
Started calculate disk usage of workspace
Finished Calculation of disk usage of workspace in 0 seconds
Finished: FAILURE

更新:

我还使用 Jenkins JRE 启动了 groovyConsole。它也在工作。所以 cacerts keystore 包含工作 ca 证书。但为什么它在 Jenkins 脚本控制台或 Job DSL 插件中不起作用。这里有什么问题吗？

Answer 1

在我重新启动 Jenkins windows 服务后，我得到了这个工作。在此之前，我总是在应用程序本身中重新启动 Jenkins。重启服务和在控制台重启 Jenkins 似乎是有区别的。

然后找到我导入到 C:\Program Files (x86)\jenkins\jre\lib\security\cacert 的 CA 证书。