2

The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My situation is as follows:

There are two machines, a debian 9 machine [DEB] and a win10 machine [WIN]. In [WIN] I installed Acunetix v11 and jenkins in [DEB], and I configured acunetix to be accessible from outside (following this tutorial: https://www.acunetix.com/blog/docs/use-acunetix-host-localhost/). After that, I followed another tutorial (https://www.acunetix.com/blog/docs/install-acunetix-root-certificate-another-computer/) to connect jenkins with acunetix. I managed to access to acunetix webpage from [DEB] via web (Not issues in network or configuration in that sense).

However, I could not connect with acunteix from jenkins despite the fact I followed every single step explained in acunetix web page. I got this error: "Please add the Acunetix scanner certificate to Java CA store" when I tested the connection from jenkins (obviously, acunetix plugin is installed in jenkins). I checked that the certificate obtained from acunetix installation (in [WIN]) "ca.cer" was correctly added in the keystore of [DEB]. Then, I made a custom keystore to be used by jenkins (as it is explained in this other tutorial: https://support.cloudbees.com/hc/en-us/articles/203821254-How-to-install-a-new-SSL-certificate-) and I got the same result...At that time, I thought that maybe something was wrong in [DEB], so I used another windows 10 machine [WIN2] to repeat the process...and I got the same result... The acunetix certificate was also included in the OS apart from java keystore in all cases.

My company contacted Acunetix support about this issue but no solution has been provided so far... Currently, we don't what to do right now... Have you dealt with this? Have you found a solution?

Thank you in advance, mates!

See you!

  • You've tried this with other servers, so this is not an explicit issue with Jenkins? – PrestonM Jan 18 '18 at 16:50
  • Hi PrestonM, thank you for your interest in this! Acunetix license is linked to MAC address of the machine, but we can try that to discard acunetix server issues. – 4LB3R70 Jan 18 '18 at 16:57
  • I would see if you can connect acunetix to a non-jenkins server to see which system is causing the issue. – PrestonM Jan 18 '18 at 19:30
  • mmm I see your point, I do not know how to do that but it's something that might be interesting to explore too... – 4LB3R70 Jan 19 '18 at 7:20
  • How are you connecting to acunetix from Jenkins? Are you making HTTP requests from within a job? Is some Jenkins plugin responsible for communicating with the acunetix service? Something else? – jayhendren Jan 19 '18 at 17:30
1

We've configured the plugin properly (we're able to invoke acunetix from jenkins although we're having issues getting the report copied into the Jenkins workspace). The issue he might have run into is that you might have more than one jre installed and you have to register the certificate on the keystore JRE that Jenkins is using (you can check which one is being used by jenkins by looking at the "<executable>" tag in the jenkins.xml config file)

In a default installation the jre being used by jenkins and its keystore are located inside the jenkins folder: .\jenkins\jre\bin\keytool and .\jenkins\jre\lib\security\cacerts

With this configuration, you can verify if the certificate is in the keystore by using the command: keytool -list -keystore "jenkins\jre\lib\security\cacerts"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.