0

Bitbucket and Jenkins, in-order to talk to each other we have installed SSL certs in Bitbucket server. Issue started when Jenkins team used to mess up with their configuration and end up changing their SSL cert which disturbs the communication between Bitbucket and Jenkins. This happens frequently in a month.

I was assigned with a task to automate the effort of installing the new cert every time they change cert. i.e., check the URL cert and the cert in server keystore and alert us when there is difference so that we can import the newer certs.

So, this is what I did. I got the SSL cert from the keystore using commands

keytool -export -alias jenkins -file jenkins.der -keystore keystore.path

openssl x509 -inform der -in jenkins.der -out jenkins.crt

Then retrieved the SSL cert from openssl command which I assume is taken from browser URL

openssl s_client -connect jenkins:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > jenkins_new.crt

After this when I compare, there are differences in few lines between the files. The SSL certs have not changed after the last import, then how does the installed SSL and the browser SSL differ?

IS what I am trying to do incorrect?

0

The point is, there is not only one place where the certificate is installed, but two, hence the source of the confusion. Or depending on the setup, even two different certificates (but most usually it is the same certificate installed in two places).

To get to the specifics, there are in fact two sets of certificate "stores", the applicational certificate keystore from Java (backend), and the certificate configurations from the system/web server (frontend).

Usually, when installing a new certificate, it has to be updated on both places.

Since you already have shown us you are dealing with the Java keystore (e.g. using the keytool command), you also need to look to the system/webserver side too.

Making the supposition the frontend web server is Apache, usually ssl.conf or the vhost configuration is pointing to the location in the filesystem of the certificate using the directive SSLCertificateFile (and SSLCertificateKeyFile).

Nevertheless, supposing you are from the development team, I advise having a friendly chat with the local system administrators. They should be able to point out how certificates are configured on the web server/Linux side.

PS Be aware the web frontend and applicacional backend can either be on the same VM/server, or in a different VM/server.

  • 1
    Thanks for the update Rui. I am working with my server team on how certs are installed in the server. Marking this as correct since this points me to the right direction. – Charl Feb 25 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.