# Invalid X-Instance-Identity

**URL:** <https://community.jenkins.io/t/invalid-x-instance-identity/4038>\
**Category:** Ask a question\
**Created:** [September 30, 2022, 10:45am UTC](https://community.jenkins.io/t/invalid-x-instance-identity/4038 "2022-09-30T10:45:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Splint](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@Splint](https://community.jenkins.io/u/Splint)\
**Post date:** [September 30, 2022, 10:45am UTC](https://community.jenkins.io/t/invalid-x-instance-identity/4038/1 "2022-09-30T10:45:14Z")

</div>

I have a Jenkins 2.371 instance. In order to be secure, I have requested SSL certificates and implemented it. Jenkins UI is now running fine use [servername.domain.com](http://servername.domain.com) with https.

The problem comes with the agents. I have imported my `jks` certificate chain into the jdk using keytool, so not a problem with the certificates at all. When I startup the agent, I get an error:

> SEVERE: serverdetail /tcpSlaveAgentListener/ appears to be publishing an invalid X-Instance-Identity.  
> java.io.IOException: serverdetail /tcpSlaveAgentListener/ appears to be publishing an invalid X-Instance-Identity.  
> at org.jenkinsci.remoting.engine.JnlpAgentEndpointResolver.resolve(JnlpAgentEndpointResolver.java:28

So, it seems that the url advertised by the server is not what is expected by the agent.

For reference purpose (not relevant however), the keytool command to add the jks to the cacerts store used:

```auto
keytool -import -alias /tmp/jenkins.jks -cacerts -keypass 'Password' -file servername_domain_com.cer -storepass 'changeit'

```

As for agent startup. I have downloaded the `agent.jar` again, since the move to `https` then the usual:

```auto
java -jar agent.jar -jnlpUrl servername.domain.com/computer/agenthostname/jenkins-agent.jnlp -secret @secret-file -workDir "/opt/jenkins"

```

The agent startup includes the `jnlp`. I say this because, the only articles I’ve found on a similar error, states that the `jnlp` path should be excluded, but sadly, that makes little sense, yet I did try it, however the agent now just retries connectivity as it does not get the expected response.

---

<div class="post-metadata">

**Author:** ![Splint](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@Splint](https://community.jenkins.io/u/Splint)\
**Post date:** [October 3, 2022, 11:36am UTC](https://community.jenkins.io/t/invalid-x-instance-identity/4038/2 "2022-10-03T11:36:36Z")

</div>

ok, problem solved. You have to maintain an RSA key pair. To do this programmatically, I installed a module in Jenkins [Instance Identity](https://plugins.jenkins.io/instance-identity/)

---

<div class="post-metadata">

**Author:** ![poddingue](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/poddingue/32/985_2.png) [@poddingue](https://community.jenkins.io/u/poddingue)\
**Post date:** [October 12, 2022, 7:53am UTC](https://community.jenkins.io/t/invalid-x-instance-identity/4038/3 "2022-10-12T07:53:18Z")

</div>

Thanks a lot for your feedback @Splint and welcome to this community 👋 .

---

<div class="post-metadata">

**Author:** ![daniilyar-fnddev](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/daniilyar-fnddev/32/11592_2.png) [@daniilyar-fnddev](https://community.jenkins.io/u/daniilyar-fnddev)\
**Post date:** [November 16, 2024, 6:08pm UTC](https://community.jenkins.io/t/invalid-x-instance-identity/4038/4 "2024-11-16T18:08:13Z")

</div>

Installing this plugin also resolves the same error encountered when a Jenkins agent, launched via the [AWS ECS Jenkins plugin](https://plugins.jenkins.io/amazon-ecs/), attempts to connect to the Jenkins controller. It is surprising that the AWS ECS Jenkins plugin does not include the [Instance Identity](https://plugins.jenkins.io/instance-identity/) plugin as a required dependency. As a result, users often have to troubleshoot extensively before discovering that simply installing this plugin separately resolves the issue.