title: Jenkins git plugin self signed certificate
body: <p>I'm currently trying to get Jenkins to build projects hosted in a GitHub enterprise repository. We are using a self signed certificate for the GitHub server which leads to some problems.</p>
  
  <p>Most of those problems I was able to solve:</p>
  
  <p><strong>git command line:</strong><br>
  Get the certificate in PEM format and teach git to look for information using the .config file:</p>
  
  <pre><code>[http "https://github.*******************.com"]
      sslCAInfo = "path\\to\\selvSignedCerts\\fileName.pem"
      sslCAPath = "path\\to\\selvSignedCerts\\"
      sslVerify = true
  </code></pre>
  
  <p><strong>Jenkins GitHub plugin:</strong><br>
  Add the certificate information to the java cacerts keystore:</p>
  
  <pre><code>keytool -import -trustcacerts -alias myAlias 
     -keystore "%JenkinsInstallDir\jre\lib\security\cacerts"
     -file "myCertsInfo.pem"
  </code></pre>
  
  <p>Restarting Jenkins after importing the information to the keystore finally did the trick so I was able to configure the GitHub Enterprise server in<br>
  <em>Manage Jenkins -> Configure System -> GitHub Enterprise Servers -> API Endpoint</em></p>
  
  <p>This configuration formerly was not possible due to:</p>
  
  <pre><code>SSL certificate problem: self signed certificate in certificate chain
  </code></pre>
  
  <p>Now, my git command-line is happy, the GitHub plugin in Jenkins is happy, which means Jenkins itself is happy but the git-client plugin is obviously not.</p>
  
  <p>I've created a <strong>GitHub Organizations</strong> job in jenkins, specifying the link to the organization on the enterprise server. The configuration uses the API endpoint configured in the global jenkins settings, using configured credentials and looking for a pipeline file with the default name <strong>Jenkinsfile</strong></p>
  
  <p>The job is able to perform a checkout, it recognizes two branches, and in each branch finds the corresponding Jenkinsfile. It also automatically created a new job for each branch using the Jenkinsfile config.</p>
  
  <p>The jenkinsfile currently looks like this:</p>
  
  <pre><code>#!/usr/bin/env groovy
  
  pipeline {
    agent any
    stages {
      stage('Scan for new jobs') {
        steps {
          echo 'Scanning...'
        }
      }
      stage('Build') {
        steps {
          echo 'Build'
        }
      }
    }
  }
  </code></pre>
  
  <p>Now the first step in the pipeline is an implicit scm checkout. This fails and the output looks like this:</p>
  
  <pre><code>14:01:27 Connecting to https://github.*********.com/api/v3 using &lt;userId&gt;/******
  Obtained Jenkinsfile from &lt;commitHash&gt;
  [Pipeline] node
  Running on Jenkins in D:\****\Jenkins\****\workspace\****
  [Pipeline] {
  [Pipeline] stage
  [Pipeline] { (Declarative: Checkout SCM)
  [Pipeline] checkout
   &gt; C:\Program Files\Git\bin\git.exe rev-parse --is-inside-work-tree # timeout=10
  Fetching changes from the remote Git repository
   &gt; C:\Program Files\Git\bin\git.exe config remote.origin.url https://github.****.com/***/***.git # timeout=10
  Fetching without tags
  Fetching upstream changes from https://github.****.com/***/***.git
   &gt; C:\Program Files\Git\bin\git.exe --version # timeout=10
  using GIT_ASKPASS to set credentials 
   &gt; C:\Program Files\Git\bin\git.exe fetch --no-tags --progress https://github.****.com/***/***.git +refs/heads/develop:refs/remotes/origin/develop
  ERROR: Error fetching remote repo 'origin'
  hudson.plugins.git.GitException: Failed to fetch from https://github.****.com/***/***.git
      at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:825)
      at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1092)
      at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1123)
      at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:113)
      at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:85)
      at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:75)
      at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
      at hudson.security.ACL.impersonate(ACL.java:260)
      at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
      at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
      at java.util.concurrent.FutureTask.run(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
      at java.lang.Thread.run(Unknown Source)
  Caused by: hudson.plugins.git.GitException: Command "C:\Program Files\Git\bin\git.exe fetch --no-tags --progress https://github.****.com/***/***.git +refs/heads/develop:refs/remotes/origin/develop" returned status code 128:
  stdout: 
  stderr: fatal: unable to access 'https://github.****.com/***/***.git/': SSL certificate problem: self signed certificate in certificate chain
  
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1970)
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1689)
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$300(CliGitAPIImpl.java:71)
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:380)
      at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:823)
      ... 13 more
  [Pipeline] }
  [Pipeline] // stage
  [Pipeline] }
  [Pipeline] // node
  [Pipeline] End of Pipeline
  </code></pre>
  
  <p>So the error is again:</p>
  
  <pre><code>stderr: fatal: unable to access 'https://github.****.com/***/***.git/': SSL certificate problem: self signed certificate in certificate chain
  </code></pre>
  
  <p>Now it seems, that the git-client plugin (or the git plugin?) seem to look somewhere else than to the keystore at <strong>lib\security\cacerts</strong> and also don't seem to care about the <strong>.gitconfig</strong> file.</p>
  
  <p>Now my question is, where will this plugin look for valid certificates? or is there anything else I didn't get?</p>
  
  <p>All research for this, or similar issues, all leads to adding the certificate to the java keystore, which I already did. I didn't find any other information pointing to the right direction. And mostly I'm wondering, why the <em>GitHub Organizations</em> job can handle the repository well, detect all branches, checkout and handle the <em>Jenkinsfile</em> and the other jobs (I've also manually created a freestyle job to check if it can checkout the repo - with the same negative outcome) can still not access the repo due to the <em>self-signed certificate</em> issue...</p>
  
  <p><strong>Environment:</strong> (Jenkins is running on)<br>
  Windows 7 x64<br>
  git version 1.9.4.msysgit.0<br>
  Jenkins Version: 2.73.2<br>
  Java JRE: 1.8.0_144-b01<br>
  <em>Plugins:</em><br>
  git 3.6.3<br>
  git-client 2.6.0<br>
  git-server 1.7<br>
  github 1.28.1<br>
  github-api 1.90  </p>