# Jenkins HTTPS keystore without displaying a password

**URL:** <https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835>\
**Category:** Using Jenkins\
**Created:** [January 16, 2024, 7:52pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835 "2024-01-16T19:52:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vilius](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/vilius/32/2080_2.png) [@Vilius](https://community.jenkins.io/u/Vilius)\
**Post date:** [January 16, 2024, 7:52pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835/1 "2024-01-16T19:52:46Z")

</div>

Hi,

is there a way to setup HTTPS support in Jenkins without displaying keystore password in the process list?

I’m running Jenkins installed via RPM on Rocky Linux 9. HTTPS support is configured in the unit file which includes:  
`Environment="JENKINS_HTTPS_KEYSTORE_PASSWORD=mypassword"`

As soon as I start Jenkins `--httpsKeyStorePassword=mypassword` is displayed in the `ps auxww` list which looks like an oversite :(.

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [January 16, 2024, 8:09pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835/2 "2024-01-16T20:09:07Z")

</div>

You can start jenkins with the `--config` option. You will need to put all jenkins command line args into this file (java properties format), afaik you can’t mix and have some directly and some in the config file.

```auto
httpsPort=8443
httpsKeyStore=/path/to/keystore
httpsKeyStorePassword=mypassword

```

`java -Dfile.encoding=UTF-8 -jar jenkins.war --config=/path/to/config`

---

<div class="post-metadata">

**Author:** ![Vilius](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/vilius/32/2080_2.png) [@Vilius](https://community.jenkins.io/u/Vilius)\
**Post date:** [January 21, 2024, 5:06pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835/3 "2024-01-21T17:06:13Z")

</div>

Thanks @mawinter69 . I tried and improved on your suggestion.

You can mix command line arguments and config file (works at least on my end). I ended up with the following systemd unit file:

```auto
[Service]
Environment="JENKINS_PORT=-1"
AmbientCapabilities=CAP_NET_BIND_SERVICE
Environment="JENKINS_HTTPS_PORT=443"
Environment="JENKINS_HTTPS_KEYSTORE=/srv/jenkins/keystore.jks"
Environment="JENKINS_OPTS=--config=/srv/jenkins/startup.properties"

```

This hides keystore password from the process list:

```auto
[]# ps aux |grep jenkins
jenkins 72137 14.3 9.6 9407764 1550936 ? Ssl 18:43 3:19 /usr/bin/java -Djava.awt.headless=true -jar /usr/share/java/jenkins.war --webroot=/var/cache/jenkins/war --httpPort=-1 --httpsPort=443 --httpsKeyStore=/srv/jenkins/keystore.jks --config=/srv/jenkins/startup.properties

```

Interesting enough [Initial Settings](https://www.jenkins.io/doc/book/installing/initial-settings/#miscellaneous-parameters) talks about sensitive parameters specifically about `--httpsKeystorePassword` and recommends to use `--paramsFromStdIn` but Jenkins’ own systemd starter doesn’t follow that.

I have created an improvement ticket for that → JENKINS-72585. Please vote!

---

<div class="post-metadata">

**Author:** ![OmShree](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/omshree/32/9027_2.png) [@OmShree](https://community.jenkins.io/u/OmShree)\
**Post date:** [July 9, 2024, 7:35pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835/4 "2024-07-09T19:35:09Z")

</div>

Hello Markus Winter/all. I am running Jenkins 2.452.2 on RHEL-9.4 with openjdk version "21.0.3; trying to hide the keystore password; unfortunately I can’t start the service. Throwing error “Failed to start jenkins.service: Unit jenkins.service has a bad unit file setting.” No issues starting the service without --config=/path/to/startup.properties. What versions (jenkins/java) you are using? how does the startup file looks like? Thank you.

---

<div class="post-metadata">

**Author:** ![Vilius](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/vilius/32/2080_2.png) [@Vilius](https://community.jenkins.io/u/Vilius)\
**Post date:** [July 10, 2024, 4:41pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835/5 "2024-07-10T16:41:44Z")

</div>

@OmShree if you want somebody to help you, you need to provide your full unit file. Most probably you made some kind of syntax error in a file. Also, keep in mind that I have provided only those unit file options which are related to the question. It’s not a full file.

---

<div class="post-metadata">

**Author:** ![OmShree](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/omshree/32/9027_2.png) [@OmShree](https://community.jenkins.io/u/OmShree)\
**Post date:** [July 12, 2024, 5:23pm UTC](https://community.jenkins.io/t/jenkins-https-keystore-without-displaying-a-password/11835/6 "2024-07-12T17:23:52Z")

</div>

Thank you Vilius, the issue is resolved; syntax error in the startup file.