Proxy and certificate

[sebastie...@free.fr]

Hi,

We have just installed Jenkins and we want to install some plugins (Git, ...). But in plugins section, Advanced tab, the "validate proxy" fails with following message : "

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target". It seems we have a certificate issue. Can someone tell us where to get information about the good way to manage these certificates for Jenkins.

The "Test URL" was "http://jenkins-ci.org/" ; there is no problem for accessing this URL in brower with same proxy configuration.

Best regards,

Sébastien

(sorry for my english level, not sure of my translation)

[Mykola Nikishov]

sebastie...@free.fr writes:

> We have just installed Jenkins and we want to install some plugins (Git,
> ...). But in plugins section, Advanced tab, the "validate proxy" fails with
> following message : "
>
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target". It seems we have a
> certificate issue. Can someone tell us where to get information about the
> good way to manage these certificates for Jenkins.
>
> The "Test URL" was "http://jenkins-ci.org/" ; there is no problem for
> accessing this URL in brower with same proxy configuration.

Seems you have a transparent proxy that terminates HTTPS traffic from
the target site, re-encrypts/signs it with its own key/certificate and
forwards it to the client. Quite often such intermediate certificates
are self-signed thus breaking the chain of trust.

Check this SO question [1] to better understand and how to 'fix' this
issue.

[1] https://stackoverflow.com/questions/6908948/java-sun-security-provider-certpath-suncertpathbuilderexception-unable-to-find

--
Mykola
https://manandbytes.github.io/

[sebastie...@free.fr]

Thanks. Too much complicate for me at this moment, I'll look later.

[Daniel Beck]

> On 26.05.2016, at 16:46, sebastie...@free.fr wrote:
>
> The "Test URL" was "http://jenkins-ci.org/" ; there is no problem for accessing this URL in brower with same proxy configuration.

Could be Oracle Java not accepting letsencrypt certificates, while all modern browsers do.