I am getting errors while connecting windows agent with the controller

Using Jenkins Ask a question
1

Our Jenkins Server has been recently moved and due to it my earlier working windows jenkins agent is no longer working.

Earlier working command I was using was this:
java --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.base/java.text=ALL-UNNAMED --add-opens java.desktop/java.awt.font=ALL-UNNAMED -jar agent.jar -jnlpUrl http:///dsw/web/devops/jenkins/computer/VMLondonTosca/slave-agent.jnlp -secret -workDir “C:\jenkins”

Now when I give same command I am getting errors:
Oct 11, 2022 4:25:26 PM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using C:\jenkins\remoting as a remoting work directory
Oct 11, 2022 4:25:26 PM org.jenkinsci.remoting.engine.WorkDirManager setupLogging
INFO: Both error and output logs will be printed to C:\jenkins\remoting
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by hudson.remoting.jnlp.Main
WARNING: Please consider reporting this to the maintainers of hudson.remoting.jnlp.Main
WARNING: System::setSecurityManager will be removed in a future release
Oct 11, 2022 4:25:26 PM hudson.remoting.jnlp.Main createEngine
INFO: Setting up agent: VMLondonTosca
Oct 11, 2022 4:25:26 PM hudson.remoting.jnlp.Main$CuiListener
INFO: Jenkins agent is running in headless mode.
Oct 11, 2022 4:25:27 PM hudson.remoting.Engine startEngine
INFO: Using Remoting version: 4.13
Oct 11, 2022 4:25:27 PM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using C:\jenkins\remoting as a remoting work directory
Oct 11, 2022 4:25:28 PM hudson.remoting.jnlp.Main$CuiListener error
SEVERE: Connection failed.
io.jenkins.remoting.shaded.javax.websocket.DeploymentException: Connection failed.
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.JdkClientContainer$1.call(JdkClientContainer.java:187)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.JdkClientContainer$1.call(JdkClientContainer.java:107)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.JdkClientContainer.openClientSocket(JdkClientContainer.java:192)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager$3$1.run(ClientManager.java:647)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager$3.run(ClientManager.java:696)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager$SameThreadExecutorService.execute(ClientManager.java:849)
at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager.connectToServer(ClientManager.java:493)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager.connectToServer(ClientManager.java:337)
at hudson.remoting.Engine.runWebSocket(Engine.java:656)
at hudson.remoting.Engine.run(Engine.java:495)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:371)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.SslFilter.doHandshakeStep(SslFilter.java:522)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.SslFilter.processRead(SslFilter.java:342)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.Filter.onRead(Filter.java:111)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.Filter.onRead(Filter.java:113)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.TransportFilter$4.completed(TransportFilter.java:294)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.TransportFilter$4.completed(TransportFilter.java:278)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:129)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:284)
at java.base/sun.nio.ch.WindowsAsynchronousSocketChannelImpl$ReadTask.completed(WindowsAsynchronousSocketChannelImpl.java:586)
at java.base/sun.nio.ch.Iocp$EventHandlerTask.run(Iocp.java:387)
at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:113)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at java.base/sun.security.validator.Validator.validate(Validator.java:264)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:285)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
… 22 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
… 27 more

2

When I try to give this command as below, I get:

C:\jenkins>java -jar agent.jar -jnlpUrl http://:8080/dsw/web/devops/jenkins/computer/VMLondonTosca/jenkins-agent.jnlp -secret @secret-file -workDir “C:\jenkins” -noCertificateCheck

Skipping HTTPS certificate checks altogether. Note that this is not secure at all.

Oct 11, 2022 4:18:52 PM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir

INFO: Using C:\jenkins\remoting as a remoting work directory

Oct 11, 2022 4:18:52 PM org.jenkinsci.remoting.engine.WorkDirManager setupLogging

INFO: Both error and output logs will be printed to C:\jenkins\remoting

WARNING: A terminally deprecated method in java.lang.System has been called

WARNING: System::setSecurityManager has been called by hudson.remoting.jnlp.Main (file:/C:/jenkins/agent.jar)

WARNING: Please consider reporting this to the maintainers of hudson.remoting.jnlp.Main

WARNING: System::setSecurityManager will be removed in a future release

Oct 11, 2022 4:18:53 PM hudson.remoting.jnlp.Main createEngine

INFO: Setting up agent: VMLondonTosca

Oct 11, 2022 4:18:53 PM hudson.remoting.jnlp.Main$CuiListener

INFO: Jenkins agent is running in headless mode.

Oct 11, 2022 4:18:53 PM hudson.remoting.jnlp.Main createEngine

WARNING: Certificate validation for HTTPs endpoints is disabled

Oct 11, 2022 4:18:53 PM hudson.remoting.Engine startEngine

INFO: Using Remoting version: 4.13

Oct 11, 2022 4:18:53 PM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir

INFO: Using C:\jenkins\remoting as a remoting work directory

Oct 11, 2022 4:18:53 PM hudson.remoting.jnlp.Main$CuiListener status

INFO: Locating server among [https://139.w3cloud.ibm.com/dsw/web/devops/jenkins/]

Oct 11, 2022 4:18:53 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver openURLConnection

WARNING: HTTPs certificate check is disabled for the endpoint.

Oct 11, 2022 4:18:54 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver resolve

INFO: Remoting server accepts the following protocols: [JNLP4-connect, Ping]

Oct 11, 2022 4:18:59 PM org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver isPortVisible

WARNING: Connect timed out

Oct 11, 2022 4:18:59 PM hudson.remoting.jnlp.Main$CuiListener error

SEVERE: https://139.w3cloud.ibm.com/dsw/web/devops/jenkins/ provided port:50000 is not reachable

java.io.IOException: provided port:50000 is not reachable

at org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver.resolve(JnlpAgentEndpointResolver.java:311)

at hudson.remoting.Engine.innerRun(Engine.java:733)

at hudson.remoting.Engine.run(Engine.java:539)

50000 port is already enabled

Not sure what is the issue. can someone please help.

3

Screenshot 2022-10-11 at 16.38.07
Screenshot 2022-10-11 at 16.38.07696×350 44.2 KB

Not sure what is the issue. can someone please help.

I even tried to enable websocket and use same command and got below error then:

C:\jenkins>java -jar agent.jar -jnlpUrl http://9.208.57.149:8080/dsw/web/devops/jenkins/computer/VMLondonTosca/jenkins-agent.jnlp -secret @secret-file -workDir “C:\jenkins” -noCertificateCheck

Skipping HTTPS certificate checks altogether. Note that this is not secure at all.

Oct 11, 2022 4:24:22 PM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir

INFO: Using C:\jenkins\remoting as a remoting work directory

Oct 11, 2022 4:24:22 PM org.jenkinsci.remoting.engine.WorkDirManager setupLogging

INFO: Both error and output logs will be printed to C:\jenkins\remoting

WARNING: A terminally deprecated method in java.lang.System has been called

WARNING: System::setSecurityManager has been called by hudson.remoting.jnlp.Main (file:/C:/jenkins/agent.jar)

WARNING: Please consider reporting this to the maintainers of hudson.remoting.jnlp.Main

WARNING: System::setSecurityManager will be removed in a future release

JNLP file /dsw/web/devops/jenkins/computer/VMLondonTosca/jenkins-agent.jnlp?encrypt=true has invalid arguments: [ffcec4efbbe5621d54ca8ac0007e3427a49b7bd78415bced937b1608375e0285, VMLondonTosca, -webSocket, -workDir, C:\jenkins, -internalDir, remoting, -url, -headless, -workDir, C:\jenkins, -internalDir, remoting, -disableHttpsCertValidation]

Most likely a configuration error in the controller

option “-webSocket” cannot be used with the option(s) [-direct, -tunnel, -credentials, -proxyCredentials, -cert, -disableHttpsCertValidation, -noKeepAlive]

4

Hello @priyanka.gupta06 and welcome to this community :wave:

What version of Jenkins are you running? Did you upgrade your Jenkins version while moving your controller?
Is your client jar up to date?
Thanks.

5

Hi Bruno, Thanks for replying.
We are running [Jenkins 2.332.3] and yes, when moving from the old Jenkins Server to the new Jenkins Server it was updated in May 2022.
Yes I have taken latest agent.jar which shows up in the job alongwith new secret value as well. Also I see that My earlier job settings were below:
‘Launch agent by connecting it to the master’ which
seems to have changed to '‘Launch agent by connecting it to the controller’ instead of master now (might be renamed at Jenkins end)

6

Hi there,

As a reminder, the term “slave” to refer to an agent has been deprecated since 2016. Please refer to On Jenkins Terminology Updates for more details. We request you update your post.

Master has recently been switched over to controller.

1 Like
7

:point_up: that seems to be the error. Don’t skip http verification if using websocket

:point_up: also seems to be the problem, looks like 139.w3cloud.ibm.com doesn’t have port 50000 exposed to your agent.

8

Hi Gavin,

a) Sorry I don’t seem to be using any of these

-direct, -tunnel, -credentials, -proxyCredentials, -cert, -disableHttpsCertValidation, -noKeepAlive

Not sure why it gives this error when I enable websocket. Can you please point out exactly what i shud remove from command for it to work if I use websocket?

b)
For security certificate i am not sure how to generate that. Can you please guide on that? Thats y I am bypassing it using
-nocertificate

c) Port 5000 is reachable as per our team member as he checked using nc on mac. Not sure then whats the issue.

Thanks

9

I would guess noCertificateCheck and disableHttpsCertValidation are just aliases since they mean the same thing.
You are using http:// so i’m not sure why you even need to disable certificate checking, which would be an https thing.

I’m not sure how checking a port on a mac (different server/network) answers the question about if the port is available to a specific windows server. I would recommend talking to your IT team.

10

Hi Gavin,

When I enable web socket and remove -noCertificateCheck then I am getting certificate related errors, even though I am using http only and not https

C:\jenkins>java --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.base/java.text=ALL-UNNAMED --add-opens java.desktop/java.awt.font=ALL-UNNAMED -jar agent.jar -jnlpUrl http://9.208.57.149:8080/dsw/web/devops/jenkins/computer/VMLondonTosca/jenkins-agent.jnlp -secret ffcec4efbbe5621d54ca8ac0007e3427a49b7bd78415bced937b1608375e0285 -workDir “C:\jenkins”
Oct 13, 2022 11:54:10 AM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using C:\jenkins\remoting as a remoting work directory
Oct 13, 2022 11:54:10 AM org.jenkinsci.remoting.engine.WorkDirManager setupLogging
INFO: Both error and output logs will be printed to C:\jenkins\remoting
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by hudson.remoting.jnlp.Main (file:/C:/jenkins/agent.jar)
WARNING: Please consider reporting this to the maintainers of hudson.remoting.jnlp.Main
WARNING: System::setSecurityManager will be removed in a future release
Oct 13, 2022 11:54:11 AM hudson.remoting.jnlp.Main createEngine
INFO: Setting up agent: VMLondonTosca
Oct 13, 2022 11:54:11 AM hudson.remoting.jnlp.Main$CuiListener
INFO: Jenkins agent is running in headless mode.
Oct 13, 2022 11:54:11 AM hudson.remoting.Engine startEngine
INFO: Using Remoting version: 4.13
Oct 13, 2022 11:54:11 AM org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using C:\jenkins\remoting as a remoting work directory
Oct 13, 2022 11:54:13 AM hudson.remoting.jnlp.Main$CuiListener error
SEVERE: Connection failed.
io.jenkins.remoting.shaded.javax.websocket.DeploymentException: Connection failed.
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.JdkClientContainer$1.call(JdkClientContainer.java:187)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.JdkClientContainer$1.call(JdkClientContainer.java:107)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.JdkClientContainer.openClientSocket(JdkClientContainer.java:192)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager$3$1.run(ClientManager.java:647)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager$3.run(ClientManager.java:696)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager$SameThreadExecutorService.execute(ClientManager.java:849)
at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager.connectToServer(ClientManager.java:493)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.client.ClientManager.connectToServer(ClientManager.java:337)
at hudson.remoting.Engine.runWebSocket(Engine.java:656)
at hudson.remoting.Engine.run(Engine.java:495)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:371)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.SslFilter.doHandshakeStep(SslFilter.java:522)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.SslFilter.processRead(SslFilter.java:342)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.Filter.onRead(Filter.java:111)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.Filter.onRead(Filter.java:113)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.TransportFilter$4.completed(TransportFilter.java:294)
at io.jenkins.remoting.shaded.org.glassfish.tyrus.container.jdk.client.TransportFilter$4.completed(TransportFilter.java:278)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:129)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:284)
at java.base/sun.nio.ch.WindowsAsynchronousSocketChannelImpl$ReadTask.completed(WindowsAsynchronousSocketChannelImpl.java:586)
at java.base/sun.nio.ch.Iocp$EventHandlerTask.run(Iocp.java:387)
at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:113)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at java.base/sun.security.validator.Validator.validate(Validator.java:264)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:285)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
… 22 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
… 27 more

11

Also I am not able to remove slave from title as I don’t see any edit option.