You’re encountering a common Jenkins issue when SSL certificates aren’t trusted inside the Jenkins runtime, even though they work fine in your shell. Here’s a focused step-by-step approach to fix it:
1. Identify the Java runtime used by Jenkins
Jenkins runs under its own Java installation, which might differ from your local one.
- Navigate to:
Manage Jenkins → System Information
- Look for the value of
java.home
- Example:
/usr/lib/jvm/java-17-openjdk
You must import the SSL certificate into this Java runtime’s trust store.
2. Import your certificate into the correct Java keystore
Suppose your certificate file is gitlab.yourdomain.com.crt. Run:
sudo keytool -importcert -trustcacerts -alias gitlab-cert \
-file gitlab.yourdomain.com.crt \
-keystore /usr/lib/jvm/java-17-openjdk/lib/security/cacerts \
-storepass changeit
Replace the -keystore path with the actual java.home path from Jenkins, plus /lib/security/cacerts.
3. Restart Jenkins
After importing the cert, restart Jenkins to pick up the updated trust store:
sudo systemctl restart jenkins
4. If your pipeline runs on agents (that’s the way to go) or Docker containers
You must repeat step 2 on every agent that runs jobs:
- For physical/VM agents: check their Java install and keystore
- For Docker agents: bake the cert into the Docker image or mount it at runtime and import it during startup
Tip: In Docker-based builds, you can add trusted certs under /usr/local/share/ca-certificates/ and run update-ca-certificates.
5. For debugging only: temporarily disable SSL verification
You can bypass SSL verification using:
environment {
GIT_SSL_NO_VERIFY = 'true'
}
Or:
withEnv(["GIT_SSL_NO_VERIFY=true"]) {
git url: 'https://your-git-server', credentialsId: 'creds-id'
}
This is not secure, and should only be used for diagnosis, not in production.
6. Validate in Jenkins logs
If the error persists, check:
- Jenkins logs:
Manage Jenkins → System Log
- Console output of the failed build
- Agent logs (if applicable)
Summary
| Step |
Action |
 1 |
Identify java.home from Jenkins system info |
 2 |
Import cert into that Java keystore (cacerts) |
 3 |
Restart Jenkins |
 4 |
Repeat on agents or update Docker image |
| 5 |
Use GIT_SSL_NO_VERIFY=true only for testing |
