39

I have a Fedora server running Jenkins which I install via yum. Everything is okay, I can access it with http://ci.mydomain.com.

But now, I want to access it with https://ci.mydomain.com so the login with username and password is encrypted.

How can I do this?

The following is my /etc/sysconfig/jenkins file. Starting Jenkins works, but I can not access Jenkins with the webbrowser with https://ci.mydomain.com or http://ci.mydomain.com:443, ...

## Path:        Development/Jenkins
## Description: Configuration for the Jenkins continuous build server
## Type:        string
## Default:     "/var/lib/jenkins"
## ServiceRestart: jenkins
#
# Directory where Jenkins store its configuration and working
# files (checkouts, build reports, artifacts, ...).
#
JENKINS_HOME="/var/lib/jenkins"

## Type:        string
## Default:     ""
## ServiceRestart: jenkins
#
# Java executable to run Jenkins
# When left empty, we'll try to find the suitable Java.
#
JENKINS_JAVA_CMD=""

## Type:        string
## Default:     "jenkins"
## ServiceRestart: jenkins
#
# Unix user account that runs the Jenkins daemon
# Be careful when you change this, as you need to update
# permissions of $JENKINS_HOME and /var/log/jenkins.
#
JENKINS_USER="jenkins"

## Type:        string
## Default:     "-Djava.awt.headless=true"
## ServiceRestart: jenkins
#
# Options to pass to java when running Jenkins.
#
JENKINS_JAVA_OPTIONS="-Djava.awt.headless=true"

## Type:        integer(0:65535)
## Default:     8080
## ServiceRestart: jenkins
#
# Port Jenkins is listening on.
#
JENKINS_PORT="8080"

## Type:        integer(1:9)
## Default:     5
## ServiceRestart: jenkins
#
# Debug level for logs -- the higher the value, the more verbose.
# 5 is INFO.
#
JENKINS_DEBUG_LEVEL="5"

## Type:        yesno
## Default:     no
## ServiceRestart: jenkins
#
# Whether to enable access logging or not.
#
JENKINS_ENABLE_ACCESS_LOG="no"

## Type:        integer
## Default:     100
## ServiceRestart: jenkins
#
# Maximum number of HTTP worker threads.
#
JENKINS_HANDLER_MAX="100"

## Type:        integer
## Default:     20
## ServiceRestart: jenkins
#
# Maximum number of idle HTTP worker threads.
#
JENKINS_HANDLER_IDLE="20"

## Type:        string
## Default:     ""
## ServiceRestart: jenkins
#
# Pass arbitrary arguments to Jenkins.
# Full option list: java -jar jenkins.war --help
#
JENKINS_ARGS="--httpsPort=443 --httpsKeyStore=/root/.keystore --httpsKeyStorePassword=MYPASSWORD"

migrated from stackoverflow.com Jun 9 '11 at 2:41

This question came from our site for professional and enthusiast programmers.

  • you can use authbind to use any port below 1000 and still run jenkins as non-root. – user262227 Jan 3 '15 at 18:04
17

This page should help you set it up behind Apache (which would handle HTTPS): https://wiki.eclipse.org/Hudson-ci/Running_Hudson_behind_Apache

Apart from being a "normal" reverse-proxy, you'll need this (as shown on that page):

Header edit Location ^http://www.example.com/hudson/ https://www.example.com/hudson/
  • 2
    Thanks for the reply. I do not have Apache up and running, I only have the Linux server with Jenkins. – Tim Jun 7 '11 at 13:32
  • 3
    In this case, create a keystore with your certificate and use httpsPort (and related parameters): groups.google.com/group/jenkinsci-users/browse_thread/thread/… – Bruno Jun 7 '11 at 13:40
  • Okay, I have my own certificate added into the keystore. But what should I call now? Where should I do this? In any case: if I put only --httpsPort=8443 or i put --httpsKeyStore=/ path/to/keystore --httpsKeyStorePassword=myPassowrd in my HUDSON_ARGS? – Tim Jun 7 '11 at 14:22
  • Put all the required parameters (port, store location and password). Then, start Jenkins and point your browser to http://yourhostname:8443/. – Bruno Jun 7 '11 at 14:25
  • 1
    @Umesh.ABhat It should be fixed now. – Bruno Apr 25 '18 at 16:47
21

Just in case you're using Nginx and not Apache, you might want to use proxy_redirect http:// https://; to rewrite the Location header as the response comes back from Jenkins.

A complete nginx setup where SSL is terminated with Nginx and proxied internally to Jenkins using 8080 might look like this:

upstream jenkins {
  server 127.0.0.1:8080 fail_timeout=0;
}

server {
  listen 80 default;
  server_name 127.0.0.1 *.mydomain.com;
  rewrite ^ https://$server_name$request_uri? permanent;
}

server {
  listen 443 default ssl;
  server_name 127.0.0.1 *.mydomain.com;

  ssl_certificate           /etc/ssl/certs/my.crt;
  ssl_certificate_key       /etc/ssl/private/my.key;

  ssl_session_timeout  5m;
  ssl_protocols  SSLv3 TLSv1;
  ssl_ciphers HIGH:!ADH:!MD5;
  ssl_prefer_server_ciphers on;

  # auth_basic            "Restricted";
  # auth_basic_user_file  /home/jenkins/htpasswd;

  location / {
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect http:// https://;

    add_header Pragma "no-cache";

    proxy_pass http://jenkins;
  }
}
15

Note that (as of sometime?) Jenkins can generate the key for you, all you need to do is set the --httpsPort=(portnum) parameter in JENKINS_ARGS.

In my case I set JENKINS_PORT="-1" (disable http) and set --httpsPort=8080 which worked well for my own purposes.

Just note that any port below 1000 generally requires root access, so pick a port higher than that...

(Link for more info)

9

For an Ubuntu server (assuming you installed with apt-get install jenkins):

You'll want to edit /etc/default/jenkins at the bottom of the file, edit Jenkins_args. In my args, I've disabled http access (using -1) and put SSL on the default Jenkins port (8080). The most important part here is that you sent an httpsPort and certificate/key (if you have one, otherwise you can leave those off for the self generated one). I place the crts in apache and then use them for both, but you could put them anywhere.

JENKINS_ARGS="--webroot=/var/cache/jenkins/war --httpsPort=$HTTP_PORT --httpPort=-1 --httpsCertificate=/etc/apache2/ssl.crt/CERT.crt --httpsPrivateKey=/etc/apache2/ssl.key/KEY.key --ajp13Port=$AJP_PORT"

In some cases, you'll have to use a Java Key Store. First, convert your keys:

openssl pkcs12 -inkey /var/lib/jenkins/jenkins.key.pem -in /var/lib/jenkins/jenkins.crt.pem  -export -out keys.pkcs12

keytool -importkeystore -srckeystore keys.pkcs12 -srcstoretype pkcs12 -destkeystore jenkins.jks

Now use Jenkins args like

JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpsPort=$HTTP_PORT --httpPort=-1 --httpsKeyStore=/etc/apache2/ssl.crt/jenkins.jks --httpsKeyStorePassword=thePassword --ajp13Port=$AJP_PORT"

Also, see https://serverfault.com/a/569898/300544

  • 1
    Ensure that the export password you supply to openssl matches the "source keystore password" requested by keytool. Further, the password cannot be blank. – bishop Jul 28 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.