Public key of the first certificate in chain is not in the list of trusted keys

Using Jenkins Ask a question
1

Agent node: Windows Server 2016
We are using Jenkins 2.486, it seems that Windows agent can not connect with the jenkins host.

Agent configuration：

image
image1679×344 9.23 KB

2

Error log：
javax.net.ssl.SSLHandshakeException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=ed30a5418f67aa4dfb0e9291a8092e33) is not in the list of trusted keys
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)

3

Node configuration：

image
image1880×819 29.7 KB

5

The image doesn’t show the agent configuration but the configuration of the TCP for inbound agents that don’t use websockets.
The error indicates that you Jenkins controller is not properly sending the intermediate certificate that was used in the certificate signing request.
A website must send it’s own certificate and all intermediate certificates on the way to a root certificate that is known by Java. You should not add intermediate certificates to java’s truststore.

6

Hi mawinter69,
Thanks for your reply.
The following image shows the agent configuration:

image
image1885×825 30.2 KB

I tried using the command ‘keytool - import’ to import the root certificate, but still encountered this error.
(Caused by: java.security.cert.CertificateException: Public key of the first certificate in chain (subject: C=US, OU=jenkins.io, O=instances, CN=ed30a5418f67aa4dfb0e9291a8092e33) is not in the list of trusted keys)
The agent is always searching for the root certificate related to jenkins.io.

7

This is just the OU, this is not important when it comes to validating a certificate. When a certificate is checked you need to look at the subject alt names (when this is not set then the CN of the certificate)
The usual setup with certificates is that you have a root CA, which is in the trust list of java and the OS. Then you have an intermediate CA that has a certificate which is signed by the root CA. And when you now setup a website you will sign it’s certificate with the intermediate CA. So when a tool (your agent java process) wants to connect to a website (your Jenkins) you must ensure that it finds a path from the certificate to the root CA. This is achieved by having the website return not only it’s own certificate but also the certificate of the intermediate CA.
Browser are smart and might find that path on their own (maybe due to caching or due to e.g. windows having a list of known intermediate CAs)