使用PEM证书启动Jenkins时出现错误

Question

我最近设置了我的jenkins ci服务器，我想添加HTTPS SSL认证。我从Let's Encrypt获得了证书，并且我有证书和私钥作为PEM文件，根据文档，我可以通过命令行参数将这两个文件的路径传递给jenkins (我在jenking WAR文件中使用集成的Winston服务器)。我的启动命令如下所示：

java -jar jenkins.war 
     --httpPort=8080
     --httpsPort=443
     --httpsCertificate=path/to/certificate.pem
     --httpsPrivateKey=path/to/key.pem

但是当我启动jenkins时，我得到了这个错误：

java.io.IOException: Failed to start a listener: winstone.HttpsConnectorFactory
        at winstone.Launcher.spawnListener(Launcher.java:212)
        at winstone.Launcher.<init>(Launcher.java:172)
        at winstone.Launcher.main(Launcher.java:355)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at Main._main(Main.java:375)
        at Main.main(Main.java:151)
Caused by: winstone.WinstoneException: Cannot load private key; try using a Java keystore instead.
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:156)
        at winstone.AbstractSecuredConnectorFactory.configureSsl(AbstractSecuredConnectorFactory.java:81)
        at winstone.HttpsConnectorFactory.start(HttpsConnectorFactory.java:33)
        at winstone.Launcher.spawnListener(Launcher.java:210)
        ... 8 more
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:151)
        ... 11 more
Caused by: java.io.IOException: DerValue.getBigInteger, not an int 48
        at sun.security.util.DerValue.getBigInteger(DerValue.java:545)
        ... 16 more
2020-05-02 16:14:21.351+0000 [id=1]     SEVERE  winstone.Logger#logInternal: Container startup failed
java.io.IOException: DerValue.getBigInteger, not an int 48
        at sun.security.util.DerValue.getBigInteger(DerValue.java:545)
Caused: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:151)
Caused: winstone.WinstoneException: Cannot load private key; try using a Java keystore instead.
        at winstone.AbstractSecuredConnectorFactory.readPEMRSAPrivateKey(AbstractSecuredConnectorFactory.java:156)
        at winstone.AbstractSecuredConnectorFactory.configureSsl(AbstractSecuredConnectorFactory.java:81)
        at winstone.HttpsConnectorFactory.start(HttpsConnectorFactory.java:33)
        at winstone.Launcher.spawnListener(Launcher.java:210)
Caused: java.io.IOException: Failed to start a listener: winstone.HttpsConnectorFactory
        at winstone.Launcher.spawnListener(Launcher.java:212)
        at winstone.Launcher.<init>(Launcher.java:172)
        at winstone.Launcher.main(Launcher.java:355)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at Main._main(Main.java:375)
        at Main.main(Main.java:151)

Answer 1

旧的jenkins文档有关于使用java keystore的注释，不确定为什么最新的(2.235.3)将HTTPS注释更改为使用pem/key文件。

您可以参考https://github.com/garyttt/unattended_jenkins_image_build，选择外壳函数并运行generate_self_signed_jks.sh以生成测试.jks文件。

例如，语法为：

JENKINS_OPTS="--prefix=/jenkins --httpPort=-1 --httpsPort=8083 --httpsKeyStore=/var/jenkins_home/selfsigned.jks --httpsKeyStorePassword=secret"

如果您需要shell函数的内容，它是：

$ display_shell_function generate_self_signed_jks
generate_self_signed_jks ()
{
    keytool -genkey -keyalg RSA -alias selfsigned -keystore selfsigned.jks -validity 365 -keysize 4096;
    keytool -export -alias selfsigned -keystore selfsigned.jks -rfc -file selfsigned.cer;
    keytool -list -v -keystore selfsigned.jks;
    keytool -importkeystore -srckeystore selfsigned.jks -destkeystore selfsigned.p12 -deststoretype pkcs12
}

或者你可以按照convert certificate from pem into jks将.pem文件转换成.jks