1

Is there a way that I can tell Jenkins to ignore certificates for the update site.

Background

I have an air-gapped Jenkins installation and there is currently proper way to make a proxy repo. Thus I have the following setup: - I have modified the hosts file on the Jenkins host so that updates.jenkins-ci.org points to the host of the internal artifact repo - There is a reverse-proxy in front of artifact repo which handles traffic for updates.jenkins-ci.org

However we are only allowed to use https thus there will be a name mismatch error as the certificate does not match the hostname of the artifact repo host

Remark: I don't want to generally disable the checks but only for the update site so the The Skip Certificate Check plugin is not the solution for me

  • I don't think it is possible. Can you consider using certs signed by your own created CA, either on the artifact repo host or on a specific reverse proxy you control ? – Zeitounator May 27 at 18:54
  • Well I obviously can use self-signed certificates, but the problem is the host-name missmatch as the hostname of my repo server or reverse proxy is not updates.jenkins-ci.org – papanito May 28 at 17:22
  • 2
    I would take a look at the following project and plugin: github.com/jenkinsci/juseppe wiki.jenkins.io/display/JENKINS/UpdateSites+Manager+plugin – casey vega May 28 at 19:55
  • Thanks @casey vega didn't knew about this – papanito Jun 2 at 9:17
0

Following your comment confirming you can use your own signed certificates internally.

One solution would be to replace the current certificate on your repo with a new one holding updates.jenkins-ci.org as an alias. This response on stackoverflow has the necessary info to get you going.

Meanwhile, the plugin higlighted above by @casey vega in the comments (which I didn't know) seems to be a solution much easier to manage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.