Cadoles/Jenkins
Cadoles
/
Jenkins
21
0
Fork 0
Code Issues 3 Pull Requests Releases Wiki Activity

wpetit 2021-02-22 10:40:09 +01:00
parent 20c66fdfee
commit 8857afae0b
1 changed files with 61 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
Mettre-%C3%A0-jour-les-certificats-du-keystore-Jenkins.md Normal file

@ -0,0 +1,61 @@
## Mettre à jour les certificats du keystore Jenkins
Dans un pipeline, si des erreurs de ce type apparaissent:
```
Attempting to resolve master from remote references...
> git --version # timeout=10
> git --version # 'git version 2.18.4'
using GIT_ASKPASS to set credentials Identifiants Jenkins Forge
> git ls-remote -h -- https://forge.cadoles.com/Cadoles/Jenkins.git # timeout=10
ERROR: Checkout failed
hudson.plugins.git.GitException: Command "git ls-remote -h -- https://forge.cadoles.com/Cadoles/Jenkins.git" returned status code 128:
stdout:
stderr: fatal: unable to access 'https://forge.cadoles.com/Cadoles/Jenkins.git/': SSL certificate problem: certificate has expired
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2450)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2051)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1951)
[...]
```
Il est fort probable que le keystore java n'ait pas le certificat de la forge à jour (ce qui est probable avec LetsEncrypt).
Dans ce cas:
1. Se connecter sur la machine Jenkins en SSH avec le compte `root`
2. Si le script `/root/install-java-cert.sh` n'existe pas encore, le créer avec le contenu suivant:
```
#!/bin/sh
set -xe
DOMAIN=$1
JENKINS_HOME=/var/lib/jenkins
JAVA_HOME=/usr/lib/jvm/default-jvm
if [ -z "$DOMAIN" ]; then
echo "You must specify the domain as first argument"
exit 1
fi
# Import certificate
openssl s_client -showcerts -connect "$DOMAIN" < /dev/null 2> /dev/null | openssl x509 -outform PEM > ~/root_ca.pem
# Duplicate Java Keystore file and move into Jenkins...
mkdir -p $JENKINS_HOME/keystore/
cp $JAVA_HOME/jre/lib/security/cacerts $JENKINS_HOME/keystore/
# Add Certificate to Keystore
keytool -import -alias $DOMAIN -keystore $JENKINS_HOME/keystore/cacerts -file ~/root_ca.pem
# Add -Djavax.net.ssl.trustStore=$JENKINS_HOME/keystore/cacerts to the
# Jenkins startup parameters. For Debian/Ubuntu, this is /etc/default/jenkins
mkdir -p /etc/default
echo 'JAVA_ARGS="$JAVA_ARGS -Djavax.net.ssl.trustStore=$JENKINS_HOME/keystore/cacerts"' >> /etc/default/jenkins
rc-service jenkins restart
```
3. Lancer le script `/root/install-java-cert.sh forge.cadoles.com:443`. Le mot de passe par défaut du keystore est `changeit`.