# How to connect agent jnlp over https? **URL:** \ **Category:** Ask a question\ **Tags:** question\ **Created:** [May 10, 2023, 6:24pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294 "2023-05-10T18:24:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![fiddler](https://avatars.discourse-cdn.com/v4/letter/f/e8c25b/32.png) [@fiddler](https://community.jenkins.io/u/fiddler)\ **Post date:** [May 10, 2023, 6:24pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/1 "2023-05-10T18:24:33Z")
I have four build agents that connect to our Jenkins server using JNLP. This is the call to connect to the server: java --illegal-access=warn ^ –add-opens java.base/java.lang=ALL-UNNAMED ^ –add-opens java.base/java.lang.reflect=ALL-UNNAMED ^ –add-opens java.base/java.text=ALL-UNNAMED ^ –add-opens java.base/java.util=ALL-UNNAMED ^ –add-opens java.desktop/java.awt.font=ALL-UNNAMED ^ -cp agent.jar;deps/\* hudson.remoting.Launcher ^ -jnlpUrl %JenkinsHost%/manage/computer/%BuildExecutorName%/jenkins-agent.jnlp ^ -secret %SecretKey% ^ -workDir “C:\Jenkins” This all works fine and connects, but apparently it’s connecting over http instead of https. The %JenkinsHost% is set to the https URL of the site. I have the Jenkins server using a fixed port and I have the Agent Protocols checked for Inbound TCP Agent Protocol/4 (TLS encryption) I have HSTS Filter Configuration checked. I’m not sure if I’ve missed something or just don’t know the proper options to use. Any assistance is greatly appreciated. ---
**Author:** ![poddingue](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/poddingue/32/985_2.png) [@poddingue](https://community.jenkins.io/u/poddingue)\ **Post date:** [May 10, 2023, 7:37pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/2 "2023-05-10T19:37:04Z")
Hi @fiddler and welcome to this community 👋, Whenever I try to set up a new agent, Jenkins gives me an `http` URL to connect to, as I have not configured Jenkins to run on `https`. All I’ll write after this sentence will just be wild guesses. Can you access your Jenkins controller via `https` with your browser? You need to ensure that the Jenkins server is [properly configured](https://www.jenkins.io/doc/book/installing/initial-settings/#https-with-an-existing-certificate) for `https`. This includes obtaining and installing a valid SSL/TLS certificate, configuring the Jenkins URL to use `https`, and configuring the Jenkins server to only allow `https` connections. You could also try adding the [`-noCertificateCheck`](https://stackoverflow.com/questions/55184989/how-to-disable-certificate-verify-on-jenkinss-workspace-slave) option to the command line call to disable certificate verification. However, I suppose this is not recommended for production environments as it could potentially expose your system to security vulnerabilities. Another possibility would be to [check the controller logs](https://www.jenkins.io/doc/book/managing/cli/#troubleshooting-logs) for any errors or warnings related to agent connections. ---
**Author:** ![fiddler](https://avatars.discourse-cdn.com/v4/letter/f/e8c25b/32.png) [@fiddler](https://community.jenkins.io/u/fiddler)\ **Post date:** [May 10, 2023, 7:53pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/3 "2023-05-10T19:53:35Z")
Jenkins is only available through https using apache with a reverse proxy. There is a trusted certificate for the server and is also in the java keystore on the build agents, so the -noCertificateCheck is not warranted. ---
**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\ **Post date:** [May 10, 2023, 9:08pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/4 "2023-05-10T21:08:21Z")
> [@fiddler](#): > > Jenkins is only available through https using apache with a reverse proxy. thats blatently untrue. jenkins supports http through jetty, while its not generally recommended, its totally doable. And it can be reverse proxied through any http server, amazon elb, nginx, traefik, caddy, apache, anything. > [@fiddler](#): > > I have the Jenkins server using a fixed port and I have the Agent Protocols checked for Inbound TCP Agent Protocol/4 (TLS encryption) https is the tls version of http, you are using the tls version of agent protocol. If you want to use https, you should use the http port and tell both sides to speak websocket (I believe its in manage computers / agent cnofiguration on controller side, and -websocket on cli side). ---
**Author:** ![fiddler](https://avatars.discourse-cdn.com/v4/letter/f/e8c25b/32.png) [@fiddler](https://community.jenkins.io/u/fiddler)\ **Post date:** [May 11, 2023, 11:53am UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/5 "2023-05-11T11:53:54Z")
Halkeye, Let me clarify the statement you claim is untrue. In my set up, http is disabled and ‘my’ site is only accessible through https. I wasn’t making a blanket statement, I was describing my set up. I’ll look into websocket to see if I can make it work. One reason I’m trying to get the traffic going over https is the new gov’t “Zero Trust” policy that flags anything going over http. I read somewhere that jnlp (even though it goes over an encrypted TLS session) makes an http metadata request before using the port with the requested protocol. Of course this initial request flags as an open http port with the scans. ---
**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\ **Post date:** [May 11, 2023, 3:29pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/6 "2023-05-11T15:29:07Z")
> [@fiddler](#): > > Halkeye, Let me clarify the statement you claim is untrue. In my set up, http is disabled and ‘my’ site is only accessible through https. I wasn’t making a blanket statement, I was describing my set up. omg I’m so sorry. I thought the post was someone telling you that the only option was apache. I misread and I’m so sorry. That being said. I’m not sure apache supports http upgrade required for websockets, i’ve never tried. [Reverse proxy - Apache](https://www.jenkins.io/doc/book/system-administration/reverse-proxy-configuration-with-jenkins/reverse-proxy-configuration-apache/) doesn’t mention it, but mod\_proxy might just magically do it. ---
**Author:** ![fiddler](https://avatars.discourse-cdn.com/v4/letter/f/e8c25b/32.png) [@fiddler](https://community.jenkins.io/u/fiddler)\ **Post date:** [May 11, 2023, 4:15pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/7 "2023-05-11T16:15:13Z")
Thanks. I’ll look into this as a possible solution as well. ---
**Author:** ![fiddler](https://avatars.discourse-cdn.com/v4/letter/f/e8c25b/32.png) [@fiddler](https://community.jenkins.io/u/fiddler)\ **Post date:** [May 17, 2023, 8:00pm UTC](https://community.jenkins.io/t/how-to-connect-agent-jnlp-over-https/7294/8 "2023-05-17T20:00:28Z")
I’m trying to use the websocket settings within Jenkins, but getting a Handshake error. I’ve made a modifications to the apache configs using the rewritecond and rewriterule commands: RewriteCond ${HTTP:Upgrade} websocket [NC] RewriteCond ${HTTP:Connection} upgrade [NC] RewriteRule ^/ws/(.\*) wss://localhost:8081/ws/$1 [P,L] but am wondering if I don’t have the proper information for these settings. I also tried https in place of the wss but this also made no difference. Does anyone know of any example configs to allow Jenkins agents to connect to the Jenkins server that is behind the apache reverse proxy? The Jenkins server is on the same machine as the reverse proxy if that matters.