[JIRA] (JENKINS-58094) mTLS client certificates broken in 2.176.1+ by changes in jetty

[mtdegu...@geisigner.edu (JIRA)]

Title: Message Title

Michael DeGuzis commented on JENKINS-58094   Re: mTLS client certificates broken in 2.176.1+ by changes in jetty I found an answer for my issue, and I'm still not sure if it's related. For whatever reason, beyond Jenkins 2.176.1, the JVM acts as if it no longer is looking at the default trust store at /etc/ssl/certs/java/cacerts. There was no need to import the public cert from our AD LDAP server into the default truststore. export JAVA_OPTS="-Dhudson.plugins.active_directory.ActiveDirectorySecurityRealm.forceLdaps=true \ -Dorg.apache.commons.jelly.tags.fmt.timeZone=America/New_York \ -Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts \ -Djavax.net.ssl.trustStorePassword=changeit" Full docker run: + sudo docker run -d --name jenkins-server-test --network=jenkins-network --volume jenkins-test-data:/var/jenkins_home --publish 8555:8443 --env 'JAVA_OPTS=-Dhudson.plugins.active_directory.ActiveDirectorySecurityRealm.forceLdaps=true -Dorg.apache.commons.jelly.tags.fmt.timeZone=America/New_York -Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts -Djavax.net.ssl.trustStorePassword=changeit' geisinger-jenkins-test:2.176.2 --sessionTimeout=15 --httpPort=-15 --httpsPort=8443 --httpsKeyStore=/var/jenkins_home/.keystore/host.domain.com.all.jks --httpsKeyStorePassword=***************** Add Comment   This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.200136.1560952087000.5505.1566230940453%40Atlassian.JIRA.