Set up Jenkins with HTTPS

Here is a quick guide on how to set up Jenkins with HTTPS. There are numerous guides available,...

Here is a quick guide on how to set up Jenkins with HTTPS. There are numerous guides available, already. And I read some of them. But two things struck me odd. First, some guides want you to change the central systemd file for Jenkins (instead of an override file) and secondly, they want you to create a JKS file (instead of PKCS #12).

So, my words of warning: Never overwrite files in/etc/systemd/system. These files are manged by your system and package manager. If you want to add or change settings for Jenkins, use /etc/systemd/system/jenkins.service.d/override.conf . JKS is a proprietary format. PCKS #12 on the other hand, is an industry standard and also the default keystore format since Java 9!

Generate SSL certificate

First, you'll need a certificate. You can create one with openssl:

 openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out jenkinns.pem

Naturally, if you already have a certificate, you do not need to create a new one. But you'll have to convert it to a PKCS #12 file.

Continuing with the example above, you'll have to merge the fileskey.pemandjenkins.pemin a PKCS #12 keystore:

openssl pkcs12 -inkey key.pem -in jenkins.pem -export -out jenkins.p12

Finally, put the filejenkins.p12somewhere accessible to Jenkins. I put it in/var/lib/jenkins.

sudo mv ./jenkins.p12 /var/lib/jenkins
# I assume you run Jenkins with default settings. If you run it with a different user, you'll have to adapt the 'chown', of course!
sudo chown jenkins:jenkins /var/lib/jenkins/jenkins.p12

Enable HTTPS in Jenkins service

With a new and shiny keystore in place, tell Jenkins how to use it. Create the file/etc/systemd/system/jenkins.service.d/override.confand put the following content in it.

[Service]
Environment="JENKINS_HTTPS_PORT=8443"
Environment="JENKINS_HTTPS_KEYSTORE=/var/lib/jenkins/jenkins.p12"
Environment="JENKINS_HTTPS_KEYSTORE_PASSWORD="

Now, restart the Jenkins service.

sudo systemctl daemon-reload

sudo systemctl restart jenkins.service 

All done

Accessinghttps://localhost:8443now should give you the Jenkins login page, but with a valid and secure https connection.