Not able to download Jenkins plugin

Community
1

Hi Team,
While trying to download Jenkins plugin we encountered issue with multiple plugin Sample error logs

Plugins tries to download plugins from update center which then internally redirects to ftp-chi.osuosl.org , which later fails with below error

2025-06-04 17:11:40,656+0000 DEBUG [qtp1006297128-1000194] org.apache.http.conn.ssl.SSLConnectionSocketFactory - Connecting socket to ftp-chi.osuosl.org/64.50.236.52:443 with timeout 20000

2025-06-04 17:11:40,726+0000 DEBUG [qtp1006297128-1000194] org.apache.http.impl.conn.DefaultManagedHttpClientConnection - http-outgoing-2836676: Shutdown connection
2025-06-04 17:11:40,726+0000 DEBUG [qtp1006297128-1000194] org.apache.http.impl.execchain.MainClientExec - Connection discarded
2025-06-04 17:11:40,726+0000 WARN [qtp1006297128-1000194] org.sonatype.nexus.content.raw.internal.recipe.RawProxyFacet - Exception javax.net.ssl.SSLHandshakeException: Certificates do not conform to algorithm constraints checking remote for update, proxy repo jenkins-updates-raw-proxy failed to fetch download/plugins/workflow-multibranch/ 806.vb_b_688f609ee9/ workflow-multibranch.hpi, content not in cache.

The remote service ftp-chi.osuosl.org uses sha1WithRSAEncryption in the certificate chain.
SHA1 is deprecated in Redhat:
Enhancing RHEL Security: Understanding SHA-1 deprecation on RHEL 9

Is it possible to update cert from SHA1 to latest algorithm

2

It is most likely that there is a configuration error in your environment, either from some proxy that is in the way between your Jenkins controller and the mirror. Fix that problem.

The certificate information from my web browser shows:

Screenshot 2025-06-12 090923
Screenshot 2025-06-12 090923642×707 20.3 KB

3

@MarkEWaite Yes that’s correct we are using Nexus proxy repo. We caching plugins in proxy repo in nexus, and while pulling packages from update center to proxy we see above error.