如何设置 Jenkins CI 以在 Windows 上使用 https？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5313703/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How can I set up Jenkins CI to use https on Windows?
提问by Nick Jones
We've recently set up a Jenkins CI server on Windows. Now in order to use Active Directory authentication I'd like to require https (SSL/TLS) for access. Given this setup, what is the recommended way to do this?
我们最近在 Windows 上设置了一个 Jenkins CI 服务器。现在为了使用 Active Directory 身份验证，我想要求使用 https (SSL/TLS) 进行访问。鉴于此设置，推荐的方法是什么？
采纳答案by aflat
Go to your %JENKINS_HOME% and modify the jenkins.xml. Where you see --httpPort=8080change it to --httpPort=-1 --httpsPort=8080you can make the ports anything you want of course, but in my testing (a while ago, it may have changed) if you don't keep --httpPort=<something>then Jenkins will always use 8080. So if you simply change --httpPort=8080to --httpsPort=8080, port 8080 will still use http.
转到您的 %JENKINS_HOME% 并修改 jenkins.xml。在您看到的地方--httpPort=8080将其更改为--httpPort=-1 --httpsPort=8080您当然可以将端口设置为您想要的任何内容，但是在我的测试中（不久前，它可能已更改）如果您不保留，--httpPort=<something>那么 Jenkins 将始终使用 8080。因此，如果您只是更改--httpPort=8080为--httpsPort=8080, 8080 端口仍会使用 http。
Also, if you want to use your own certificate, there are some instructions at the bottom of this page.
此外，如果您想使用自己的证书，本页底部有一些说明。
http://wiki.jenkins-ci.org/display/JENKINS/Starting+and+Accessing+Jenkins
http://wiki.jenkins-ci.org/display/JENKINS/Starting+and+Accessing+Jenkins
回答by Gabe
Run:
跑：
keytool -genkey -keyalg RSA -keystore Jenkins.jks -alias [Name of website] -keysize 2048
Answer the questions remembering that First and last nameis the website URL and should be lowercase. Example:
回答问题时记住First and last name是网站 URL 并且应该是小写的。例子：
build.jenkins-ci.org
State or provincecannot be abbreviated.
State or province不能缩写。
Run:
跑：
keytool -certreq -Keystore jenkins.jks -alias [Name of website] -file jenkins.csr -keysize 2048
Send Jenkins.csrto your cert provider and request a PKCS#7 cert which has a .p7bextension and starts with:
发送Jenkins.csr给您的证书提供商并请求一个 PKCS#7 证书，该证书具有.p7b扩展名并以以下内容开头：
-----BEGIN PKCS #7 SIGNED DATA-----
Note: Trial certs are not normally available in .p7bformat but you may be able to combine the .cerfiles using this tool which reported success but didn't work for me. (https://www.sslshopper.com/ssl-converter.html)
注意：试用证书的.p7b格式通常不可用，但您可以.cer使用此工具合并文件，该工具报告成功但对我不起作用。(https://www.sslshopper.com/ssl-converter.html)
Run:
跑：
keytool -import -trustcacerts -file jenkins.p7b -keystore jenkins.jks -alias [Name of website]
Change the argumentsnode in Jenkins.xml to the following prespectivly.
将argumentsJenkins.xml 中的节点分别更改为以下内容。
<arguments>-Xrs -Xmx256m -Dhudson.lifecycle=hudson.lifecycle.WindowsServiceLifecycle -jar "%BASE%\jenkins.war" --httpPort=-1 --httpsPort=443 --httpsKeyStore="%BASE%\Cert\Jenkins.jks" --httpsKeyStorePassword=[Cert password from step 1]</arguments>
Troubleshooting:
故障排除：
- If Jenkins doesn't start read the last lines from
Jenkins.err.log. - If Jenkins didn't start because of an issue with
Jenkins.xml, replace the–(weird Windows hyphen) characters with an actual-(ASCII hyphen). - If Jenkins starts but the cert still reads as bad, make sure the
[Name of website]is the actual URL without thehttps:example:https://build.jenkins-ci.orgwould bebuild.jenkins-ci.org. - If that isn't the issue inspect the
.jksfile usingKeyStore Explorer. The "Certificate Hierarchy" should show that each cert is nested in another; This is to illustrate the cert chain. If it shows the certs next to each other then it's not correct. - If it won't start on a specific port, 443 for example, then verify IIS or another app isn't currently using the port.
- If you can see the site on the PC it's hosted on, but not another PC, then verify you aren't getting blocked by a firewall.
- 如果詹金斯没有开始阅读最后几行
Jenkins.err.log。 - 如果 Jenkins 由于 问题而没有启动
Jenkins.xml，请将–（奇怪的 Windows 连字符）字符替换为实际的-（ASCII 连字符）。 - 如果 Jenkins 启动但证书仍然读取为错误，请确保
[Name of website]是没有https:示例的实际 URL ：https://build.jenkins-ci.org将是build.jenkins-ci.org. - 如果这不是问题，请
.jks使用KeyStore Explorer. “证书层次结构”应显示每个证书都嵌套在另一个证书中；这是为了说明证书链。如果它显示彼此相邻的证书，那么它是不正确的。 - 如果它不会在特定端口（例如 443）上启动，请验证 IIS 或其他应用程序当前未使用该端口。
- 如果您可以在托管站点的 PC 上看到该站点，但在另一台 PC 上看不到，请确认您没有被防火墙阻止。
回答by ravi creed
Step1: Create both public and private Certificate on your jenkin name (convert them into keysore file if its not) Step2: Import the public certificate into your browser certificate mananger (import into all tabs) Step3: Host your jenkin using JKS file which contain both public and private key.
步骤 1：在您的 jenkin 名称上创建公共和私有证书（如果不是，则将它们转换为密钥文件）步骤 2：将公共证书导入浏览器证书管理器（导入所有选项卡）步骤 3：使用包含两者的 JKS 文件托管您的 jenkin公钥和私钥。
For steps refer "Enable HTTPS in jenkins?"
有关步骤，请参阅“在 jenkins 中启用 HTTPS？”
