Jenkins插件安装与war包下载失败：证书过期错误求助

Jenkins插件安装或访问jenkins.io子域名时出现证书过期错误，示例如下：

插件安装错误日志：

ERROR: cannot verify pkg.jenkins.io 1’s certificate, issued by ‘/C=US/O=Let’s Encrypt/CN=R3’: Issued certificate has expired.

wget下载war包错误日志：

wget https://get.jenkins.io/war-stable/2.303.3/jenkins.war
--2023-05-10 19:47:32--  https://get.jenkins.io/war-stable/2.303.3/jenkins.war
Connecting to 10.65.1.6:8080... connected.
ERROR: cannot verify get.jenkins.io's certificate, issued by '/C=US/O=Let\'s Encrypt/CN=R3':
 ** Issued certificate has expired**.
To connect to get.jenkins.io insecurely, use `--no-check-certificate'.

解决步骤 #

1. 更新系统根证书信任库 #

Let's Encrypt的旧R3根证书已过期，需更新本地根证书以信任新的证书链：

• Debian/Ubuntu系列：

  sudo apt update && sudo apt install --reinstall ca-certificates
  sudo update-ca-certificates
  

• RHEL/CentOS系列：

  sudo yum update ca-certificates
  sudo update-ca-trust extract
  

• SUSE系列：

  sudo zypper refresh && sudo zypper update ca-certificates
  sudo update-ca-certificates
  

2. 验证证书有效性 #

执行以下命令检查get.jenkins.io的证书是否能正常验证：

openssl s_client -connect get.jenkins.io:443

查看输出末尾的Verify return code: 0 (ok)，确认证书验证通过。

3. 重启Jenkins服务 #

更新证书后重启Jenkins，确保服务加载新的信任库：

sudo systemctl restart jenkins

4. 临时应急方案（不推荐长期使用） #

若暂时无法更新证书，可临时绕过SSL验证（存在安全风险）：

• Jenkins插件安装：进入Manage Jenkins → Manage Plugins → Advanced，勾选Ignore SSL certificate errors
• wget下载：添加--no-check-certificate参数

  wget https://get.jenkins.io/war-stable/2.303.3/jenkins.war --no-check-certificate
  

内容的提问来源于stack exchange，提问作者My IT GURU