Remotly update Jenkins X.509 credential

Using Jenkins
1

Hello there,
I want to remotely (programatically) update Jenkins X.509 client certificate credentials.
My use case : I have a job to update Docker API certificates and want to update the credentials in Jenkins at the same time.
I tried with Jenkins Rest API. I can create or update a X.509 client certificate credential providing an xml file I create, but the certificates are jumbled once created. Basically I’m not able to send the return lines for ca and cert and the key content is not right neither (should it be encoded ?).
Any hint welcome. Since it’s a work in progress, I can even use another method. Only limitation, I have only access remotely to Jenkins. I can’t touch the filesystem.
Regards,

2

I have a working solution to create or update an X.509 credential by a Jenkins job.
Here is a snipet :

    stage('Create credential') {
      steps {
        script {
          SECRET_NAME = 'docker-host-client-' + DOCKER_SERVER.toLowerCase()
          SECRET_DESCRIPTION = 'X.509 client certificate to securely connect Docker API on ' + DOCKER_SERVER
          SECRET_CA_CERTIFICATE = readFile "certs/ca.pem"
          SECRET_CLIENT_CERTIFICATE = readFile "certs/cert.pem"
          SECRET_CLIENT_KEY = readFile "certs/key.pem"

          def instance = Jenkins.instance
          def domain = Domain.global()
          def store = instance.getExtensionList(
            "com.cloudbees.plugins.credentials.SystemCredentialsProvider")[0].getStore()

          def dockerServerCredential = new DockerServerCredentials(
            CredentialsScope.GLOBAL,
            SECRET_NAME,
            SECRET_DESCRIPTION,
            SECRET_CLIENT_KEY,
            SECRET_CLIENT_CERTIFICATE,
            SECRET_CA_CERTIFICATE)

          store.addCredentials(domain, dockerServerCredential)
          // If credential already exists, it won't be updated
          // So we force an update, either for new or existing certificate
          store.updateCredentials(domain, dockerServerCredential, dockerServerCredential)
          echo "Credential ${SECRET_NAME} created or updated with success"
        }
      }
    }

You have to fetch the cert, key and ca from Docker server.
So one can only update credential on the Jenkins server, not remotely, but it’s simpler as to update manually.