2

The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My situation is as follows:

There are two machines, a debian 9 machine [DEB] and a win10 machine [WIN]. In [WIN] I installed Acunetix v11 and jenkins in [DEB], and I configured acunetix to be accessible from outside (following this tutorial: https://www.acunetix.com/blog/docs/use-acunetix-host-localhost/). After that, I followed another tutorial (https://www.acunetix.com/blog/docs/install-acunetix-root-certificate-another-computer/) to connect jenkins with acunetix. I managed to access to acunetix webpage from [DEB] via web (Not issues in network or configuration in that sense).

However, I could not connect with acunteix from jenkins despite the fact I followed every single step explained in acunetix web page. I got this error: "Please add the Acunetix scanner certificate to Java CA store" when I tested the connection from jenkins (obviously, acunetix plugin is installed in jenkins). I checked that the certificate obtained from acunetix installation (in [WIN]) "ca.cer" was correctly added in the keystore of [DEB]. Then, I made a custom keystore to be used by jenkins (as it is explained in this other tutorial: https://support.cloudbees.com/hc/en-us/articles/203821254-How-to-install-a-new-SSL-certificate-) and I got the same result...At that time, I thought that maybe something was wrong in [DEB], so I used another windows 10 machine [WIN2] to repeat the process...and I got the same result... The acunetix certificate was also included in the OS apart from java keystore in all cases.

My company contacted Acunetix support about this issue but no solution has been provided so far... Currently, we don't what to do right now... Have you dealt with this? Have you found a solution?

Thank you in advance, mates!

See you!

Improve this question
7
  • You've tried this with other servers, so this is not an explicit issue with Jenkins?
    – Preston Martin ♦
    Commented Jan 18, 2018 at 16:50
  • Hi PrestonM, thank you for your interest in this! Acunetix license is linked to MAC address of the machine, but we can try that to discard acunetix server issues.
    – 4LB3R70
    Commented Jan 18, 2018 at 16:57
  • I would see if you can connect acunetix to a non-jenkins server to see which system is causing the issue.
    – Preston Martin ♦
    Commented Jan 18, 2018 at 19:30
  • mmm I see your point, I do not know how to do that but it's something that might be interesting to explore too...
    – 4LB3R70
    Commented Jan 19, 2018 at 7:20
  • How are you connecting to acunetix from Jenkins? Are you making HTTP requests from within a job? Is some Jenkins plugin responsible for communicating with the acunetix service? Something else?
    – jayhendren
    Commented Jan 19, 2018 at 17:30

1 Answer 1

Reset to default
1

We've configured the plugin properly (we're able to invoke acunetix from jenkins although we're having issues getting the report copied into the Jenkins workspace). The issue he might have run into is that you might have more than one jre installed and you have to register the certificate on the keystore JRE that Jenkins is using (you can check which one is being used by jenkins by looking at the "<executable>" tag in the jenkins.xml config file)

In a default installation the jre being used by jenkins and its keystore are located inside the jenkins folder: .\jenkins\jre\bin\keytool and .\jenkins\jre\lib\security\cacerts

With this configuration, you can verify if the certificate is in the keystore by using the command: keytool -list -keystore "jenkins\jre\lib\security\cacerts"

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.