ARTIFACTORY: How to resolve the “x509 unknown authority” certificate issues while accessing the JFrog SaaS instances

This article will help you resolve the "x509 unknown authority" certificate issues while accessing JFrog SaaS instances.

When you attempt to perform any actions against an Artifactory Cloud instance and receive the error shown below. This is because the client does not trust the certificate of Artifactory instance.  You need to get the certificate for the Artifactory Cloud instance and import it into the appropriate Build server / JFrog CLI.

x509: certificate signed by unknown authority

To obtain the certificate for the Artifactory Cloud instance. Run the below openssl command with the servername and URL.

openssl s_client -showcerts -connect <servername>.jfrog.io:443 -servername <servername>.jfrog.io

For the Build Server:

Import the obtained certificate into the JVM of the build server to which it is pointed.

You can import the certificate to the JVM of the build server by using the keytool import command. 

Please find below for example: 

sudo keytool -importcert -keystore $JDK_HOME/jre/lib/security/cacerts -file root.crt -alias "myartifactory" 

Once the certificate is successfully imported, please verify the same using keytool list command. You may refer to the below command, please make sure to pass a valid alias name.

sudo keytool -list -v -alias myartifactory -keystore $JDK_HOME/jre/lib/security/cacerts

Please ensure that you restart the build server after importing the certificate.

For the JFrog CLI:

Place the obtained certificate for the Artifactory Cloud instance under the JFrog CLI home directory at the following location ( .jfrog/security/certs).