Configuring Jenkins with StartSSL - adding the issuer chain

Question

I am unable to correctly configure Jenkins to use a StartSSL certificate. I'm running it with command line arguments that specify paths to the private key and my certificate as shown on the Jenkins Wiki (at the bottom: https://wiki.jenkins-ci.org/display/JENKINS/Starting+and+Accessing+Jenkins).

• I've obtained a private key and a certificate from StartSSL
• I've placed them in a particular folder
• I'm running Jenkins as follows: java -jar jenkins.war --httpPort=-1 --httpsPort=8080 --httpsCertificate=<mydomain.crt file> --httpsPrivateKey=<my private key file>

Jenkins starts successfully. Opening https://mydomain:8080/ in Firefox says that the connection is untrusted:

mydomain:8080 uses an invalid security certificate.
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)

I've tried verifying mydomain:8080 on various SSL checker websites:

OK mydomain resolves to xxx.xxx.xxx.xxx

OK The certificate was issued by StartCom.  

OK The certificate will expire in XXX days. 

OK The hostname (mydomain) is correctly listed in the certificate.

Not OK The certificate is not trusted in all web browsers.
       You may need to install an Intermediate/chain certificate
       to link it to a trusted root certificate.

StartSSL does not have explicit instructions for setting up Jenkins. I've tried following up on similar tutorials for other kinds of servers, and copied the intermediate authority files from StartCom into a unified certificate (ca.pem and sub.class1.server.ca.pem as noted here: http://www.startssl.com/?app=42).

However, this did not change anything.

SSL checkers like www.sslshopper.com/ssl-checker.html‎ still report that the website is untrusted. Also, the GitHub image caching service is not rendering the build status icon from Jenkins for the same reason.

How do I add the issuer chain correctly to my certificate?

Answer 1

I had a similar problem and after some research what got everything to be trusted was :

1. Merged the intermediate authority certificate and <mydomain.crt file> into 1 unified certificate called merged.cer using the link you mentioned

2. (From: https://serverfault.com/questions/569866/jenkins-wont-serve-with-ca-signed-certificate)

   openssl pkcs12 -inkey /location/to/key.pem -in /location/to/merged.cer  -export -out keys.pkcs12
   
   keytool -importkeystore -srckeystore keys.pkcs12 -srcstoretype pkcs12 -destkeystore jenkins.jks
   

NOTE: the key to use for the merged.cer should be the same as <my private key file>

Then follow the Jenkins Wiki to use the KeyStore instead of the certificate

    java -jar jenkins.war --httpPort=-1 --httpsPort=8080 --httpsKeyStore=/path/to/jenkins.jks --httpsPrivateKey=<my private key file>