DEV Community

Cover image for Jenkins Plugin Update Workaround for Offline or Proxy-Restricted Environments
Nirjas Jakilim
Nirjas Jakilim

Posted on

Jenkins Plugin Update Workaround for Offline or Proxy-Restricted Environments

#jenkins #devops #ci #proxy

When deploying Jenkins in a secure environment - like behind a corporate firewall or proxy, it’s often creates problems in plugin installations or updates. Because Jenkins fetches plugin metadata and files from dynamic CDN URLs, which makes it hard to whitelist exact endpoints on your proxy or firewall.

In this guide, I’ll walk you through how to host your own Jenkins update center mirror using a static URL, making it possible to fetch and install plugins without opening up your network to all of Jenkins' CDNs.

The Problem

Jenkins plugin updates rely on URLs that resolve to CDNs or change frequently. In a restricted environment:

  • Your Jenkins host may have no direct internet access.
  • All outbound traffic must go through a proxy or firewall.
  • Whitelisting all possible cdn endpoints is not feasible.

Solution: Generate your own update-center.json file, sign it with your own certificate, and serve it from a local or approved static host. Then configure Jenkins to use this static URL as the update site.

Step-by-Step Solution

Step 1: Prepare the update-center.json on Any Internet-Connected Machine

  1. Clone the Nirzak/jenkins-update-center repo: (Thanks to lewark) 
 git clone https://github.com/Nirzak/jenkins-update-center.git cd jenkins-update-center
Enter fullscreen mode Exit fullscreen mode
  1. Remove any existing certificates: (Skip this step if you want to use the repo certificate) 
 rm -rf rootCA/update-center.crt rootCA/update-center.key
Enter fullscreen mode Exit fullscreen mode
  1. Edit the mirrors.json file and replace the content with: 
 { "jenkins": "https://archives.jenkins.io/" }
Enter fullscreen mode Exit fullscreen mode

Here, I used archives.jenkins.io as the mirror. you can also use any other mirror url if you want. You need to allow the mirror url from your proxy or firewall.

  1. Generate a new self-signed cert and key: 
 openssl genrsa -out rootCA/update-center.key 2048 openssl req -new -x509 -days 3650 -key rootCA/update-center.key -out rootCA/update-center.crt
Enter fullscreen mode Exit fullscreen mode
  1. Install required Python packages: 
 pip3 install -r requirements.txt
Enter fullscreen mode Exit fullscreen mode
  1. Generate the custom update center: 
 python3 generator.py
Enter fullscreen mode Exit fullscreen mode

Your generated update-center.json will be available in the <current_directory>/updates/jenkins directory.

Step 2: Setup on Jenkins Host

  1. Copy the generated update-center.json and update-center.crt to your Jenkins host.

  2. Create the required directory:

 mkdir -p ${JENKINS_HOME}/update-center-rootCAs
Enter fullscreen mode Exit fullscreen mode
  1. Move the cert file: 
 cp rootCA/update-center.crt ${JENKINS_HOME}/update-center-rootCAs
Enter fullscreen mode Exit fullscreen mode

Step 3: Host the update-center.json

Use Python’s built-in HTTP server (or any simple web server to serve the file):

cd path/to/update-center.json nohup python3 -m http.server 8000 &
Enter fullscreen mode Exit fullscreen mode

This will serve the file at:

http://your-host:8000/update-center.json
Enter fullscreen mode Exit fullscreen mode

Step 4: Configure Jenkins to Use the New Update Site

  1. Open Jenkins UI.
  2. Navigate to: Manage Jenkins → Manage Plugins → Advanced.
  3. In the Update Site URL field, enter: 
 http://your-host:8000/update-center.json
Enter fullscreen mode Exit fullscreen mode
  1. Click Submit to save.

All done!

Now go to the Available or Updates tab under Manage Plugins, and you should be able to install or update any plugin if you allow the mirror from your proxy or firewall. Now you don't need to allow all the other cdn mirror urls from your proxy since it's only using a static url.

Top comments (0)