ssl - 使用 PEM 证书启动 Jenkins 时出错

Question

我最近设置了我的 jenkins ci 服务器，我想添加 HTTPS SSL 认证。我从 Let's Encrypt 获得了证书，并且我将证书和私钥作为 PEM 文件，根据文档，我可以通过命令行参数将两个文件的路径传递给 jenkins(我在 jenking 中使用集成的 Winston 服务器WAR 文件)。我的启动命令如下所示:

java -jar jenkins.war 
     --httpPort=8080
     --httpsPort=443
     --httpsCertificate=path/to/certificate.pem
     --httpsPrivateKey=path/to/key.pem

但是当我启动 Jenkins 时，我得到了这个错误:

java.io.IOException: Failed to start a listener: winstone.HttpsConnectorFactory
        at winstone.Launcher.spawnListener(Launcher.java:212)
        at winstone.Launcher.<init>(Launcher.java:172)
        at winstone.Launcher.main(Launcher.java:355)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at Main._main(Main.java:375)
        at Main.main(Main.java:151)
Caused by: winstone.WinstoneException: Cannot load private key; try using a Java keystore instead.
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:156)
        at winstone.AbstractSecuredConnectorFactory.configureSsl(AbstractSecuredConnectorFactory.java:81)
        at winstone.HttpsConnectorFactory.start(HttpsConnectorFactory.java:33)
        at winstone.Launcher.spawnListener(Launcher.java:210)
        ... 8 more
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:151)
        ... 11 more
Caused by: java.io.IOException: DerValue.getBigInteger, not an int 48
        at sun.security.util.DerValue.getBigInteger(DerValue.java:545)
        ... 16 more
2020-05-02 16:14:21.351+0000 [id=1]     SEVERE  winstone.Logger#logInternal: Container startup failed
java.io.IOException: DerValue.getBigInteger, not an int 48
        at sun.security.util.DerValue.getBigInteger(DerValue.java:545)
Caused: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:151)
Caused: winstone.WinstoneException: Cannot load private key; try using a Java keystore instead.
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:156)
        at winstone.AbstractSecuredConnectorFactory.configureSsl(AbstractSecuredConnectorFactory.java:81)
        at winstone.HttpsConnectorFactory.start(HttpsConnectorFactory.java:33)
        at winstone.Launcher.spawnListener(Launcher.java:210)
Caused: java.io.IOException: Failed to start a listener: winstone.HttpsConnectorFactory
        at winstone.Launcher.spawnListener(Launcher.java:212)
        at winstone.Launcher.<init>(Launcher.java:172)
        at winstone.Launcher.main(Launcher.java:355)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at Main._main(Main.java:375)
        at Main.main(Main.java:151)

Answer 1

旧的 jenkins 文档有关于使用 java keystore 的注释，不确定为什么最新的 (2.235.3) 将 HTTPS 注释更改为使用 pem/key 文件。
您可以引用https://github.com/garyttt/unattended_jenkins_image_build ，拿起shell函数并运行generate_self_signed_jks.sh来生成一个测试.jks文件。
语法例如:

JENKINS_OPTS="--prefix=/jenkins --httpPort=-1 --httpsPort=8083 --httpsKeyStore=/var/jenkins_home/selfsigned.jks --httpsKeyStorePassword=secret"

如果您需要 shell 函数的内容，它是:

$ display_shell_function generate_self_signed_jks
generate_self_signed_jks ()
{
    keytool -genkey -keyalg RSA -alias selfsigned -keystore selfsigned.jks -validity 365 -keysize 4096;
    keytool -export -alias selfsigned -keystore selfsigned.jks -rfc -file selfsigned.cer;
    keytool -list -v -keystore selfsigned.jks;
    keytool -importkeystore -srckeystore selfsigned.jks -destkeystore selfsigned.p12 -deststoretype pkcs12
}

或者
您可以根据 convert certificate from pem into jks 将 .pem 文件转换为 .jks