在jenkins中配置LDAP全局设置

Question

目标服务器正在使用自签名证书。是否有方法禁用认证检查？在另一个web服务器实例中，我们使用

AUTH_LDAP_GLOBAL_OPTIONS = {
ldap.OPT_X_TLS_REQUIRE_CERT: False }

在使用詹金斯时，是否可以有类似的选择？

Answer 1

您可以重写Java默认SSL工厂，如https://plugins.jenkins.io/skip-certificate-check

或者您可以通过获取证书公钥并将其导入./jre/lib/security/cacert信任库来信任证书。

export JAVA_HOME='/path/to/your/jre'
export LDAPHOST='LDAPHOST01.domain.ccTLD'
export LDAPSSLPORT='636'
export CERTFILENAME='/tmp/ldapcert.cer'

echo "" | openssl s_client -connect $LDAPHOST:$LDAPSSLPORT 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > $CERTFILENAME
keytool -import -trustcacerts -alias $LDAPHOST -file $CERTFILENAME -keystore $JAVA_HOME/lib/security/cacerts

当您导入证书时，系统将要求您提供密钥存储库密码。默认值为“changeit”...否则，无论您将其更改为什么。将显示证书上的详细信息，并询问您是否真的要信任该证书。

[lisa@linux02 checkSSLCertExpiry]# keytool -import -trustcacerts -alias $LDAPHOST -file $CERTFILENAME -keystore $JAVA_HOME/lib/security/cacerts
Enter keystore password:
    Owner: CN=LDAPHOST01
    Issuer: CN=LDAPHOST01
    Serial number: 3a2542463f2d59bb4018f9e9179dd6a8
    Valid from: Mon Jun 02 16:55:08 EDT 2014 until: Sun Jun 02 16:55:08 EDT 2019
    Certificate fingerprints:
             MD5:  C3:33:62:B4:A8:30:05:54:3A:F9:AE:99:66:35:EB:22
             SHA1: FA:C2:7B:5D:BF:74:05:58:EF:37:F1:AD:8D:8B:DF:02:93:4C:D8:7E
             SHA256: BE:D6:DF:A9:4F:82:6B:AF:2C:C7:45:9B:B7:A4:0A:B4:9A:81:DB:8E:49:A2:38:16:49:83:F7:4C:D5:EC:61:E0
    Signature algorithm name: SHA1withRSA
    Subject Public Key Algorithm: 2048-bit RSA key
    ...
    #4: ObjectId: 2.5.29.17 Criticality=false
    SubjectAlternativeName [
      DNSName: LDAPHOST01
      DNSName: LDAPHOST01.domain.ccTLD
    ]
    Trust this certificate? [no]:  yes
    Certificate was added to keystore

    [lisa@linux02 checkSSLCertExpiry]# keytool -list -keystore $JAVA_HOME/lib/security/cacerts -alias $LDAPHOST
    Enter keystore password:
    LDAPHOST01.domain.ccTLD, Sep 28, 2018, trustedCertEntry,
    Certificate fingerprint (SHA1): FA:C2:7B:5D:BF:74:05:58:EF:37:F1:AD:8D:8B:DF:02:93:4C:D8:7E