[JENKINS-35389] Gerrit-Trigger cannot connect to gerrit Rest API though https (certificate error)

I have a nginx reverse proxy in front of many website to handle SSL certificates. So it using virtual host (by name), and one certificate for each virtual host. My gerrit running behind this reverse proxy.

Gerrit has events-log plugin installed, and https certificate is signed by public CA root.

Now when I config gerrit-trigger-plugin to talk to gerrit, it keep complaining SSLHandShake error because cannot recognize certificate.

After many debug, I found that gerrit-trigger-plugin using deprecated HttpClient APIs, which cause gerrit-trigger-plugin connect to the IP instead of hostname to do handshake, so it getting wrong certificate.

---
Originally reported by weigao, imported from: Gerrit-Trigger cannot connect to gerrit Rest API though https (certificate error)

• assignee: rsandell
  
• status: Open
  
• priority: Critical
  
• component(s): gerrit-trigger-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 2025-12-06
  

Raw content of original issue

I have a nginx reverse proxy in front of many website to handle SSL certificates. So it using virtual host (by name), and one certificate for each virtual host. My gerrit running behind this reverse proxy.

Gerrit has events-log plugin installed, and https certificate is signed by public CA root.


Now when I config gerrit-trigger-plugin to talk to gerrit, it keep complaining SSLHandShake error because cannot recognize certificate.


After many debug, I found that gerrit-trigger-plugin using deprecated HttpClient APIs, which cause gerrit-trigger-plugin connect to the IP instead of hostname to do handshake, so it getting wrong certificate.

environment

```
Jenkins: 1.651.2

gerrit-trigger-plugin: 2.21.0
```

1 attachment

- [JENKINS-35389.patch](https://issues.jenkins.io/secure/attachment/32917/JENKINS-35389.patch)

Start with the issue description and the attached JENKINS-35389.patch, focusing on the gerrit-trigger-plugin's deprecated HTTP client usage. Verify the HTTPS REST API connection against a Gerrit instance behind an nginx virtual host; done means the plugin performs certificate negotiation for the hostname instead of the proxy IP.

Written by the indexing model from the issue text.