Push and Pull request to Jenkins gets HTTP status -2 and null response from Jenkins

Question

I'm running Jenkins version 2.369 with Bitbucket Push and Pull Request plugin version 2.8.3. I've got a webhook setup in Bitbucket to trigger a job in Jenkins. When I do a commit to bitbucket, the plugin gets triggered, but the job on Jenkins does not run. When looking at the "View Requests" for webhooks in the Bitbucket UI, I see: Response from https://3.89.195.218:8080/bitbucket-hook/ HTTP status: -2 Headers Body I've not been able to find logs on the Jenkins controller to look at the HTTP traffic there, so I installed tcpdump. If I capture HTTP traffic on the controller I find this data showing a return from Jenkins to Bitbucket. 22:39:09.133202 IP .webcache > 18.246.31.232.25366: Flags [P.], seq 1:206, ack 313, win 219, options [nop,nop,TS val 1282987750 ecr 2120152488], length 205: HTTP: HTTP/1.1 400 Bad Request E...#,@.@.6..#........c.~...r.............. Lx..~^..HTTP/1.1 400 Bad Request Content-Type: text/html;charset=iso-8859-1 Content-Length: 70 Connection: close Server: Jetty(10.0.12) Bad Message 400 reason: Illegal character CNTL=0x16 (with some HTML formatting removed) From this I see two problems: * Jenkins returns a status of 400 but the Bitbucket UI is showing a -2, and * Bitbucket seems to be sending an unescaped character in its request. Has anyone else run into this issue and know a resolution? Thanks in advance, Rick

Patrik S · Answer

Hello @Rick Martin !

The error being returned by the webhooks processor seems to be related to the TLS version being used on your Jenkins server.

It seems that during the TLS handshake, your Jenkins server is offering an old  TLS version (TLSv1) that is not supported. You can refer to the blog post Update to supported cipher suites in Bitbucket Cloud for further details on the deprecated ciphers.

In this case, I would recommend checking if your Jenkins instance is using at least TLSv1.2. Also, since Jenkins is based on java, you might want to verify if your java version supports and is configured to use at least TLSv1.2

All the current supported ciphers are documented at Supported security protocols for Atlassian Cloud Products .

Thank you, @Rick Martin .

Patrik S

Rick Martin_5c33c9 · Answer

Hi Theadora,

Sorry for the late reply.  My daughter (and her 2 month old, Theodore) arrived in town last Friday.

I ran another test with Skip certificate verification checked and get the same result.

Thanks again for your help,

Rick

Theodora Boudale · Answer

Hi Rick,

Thank you for the info. The webhooks logs for this repo indicate an SSL related error.

I would suggest editing the webhook from Repository settings and temporarily checking the option Skip certificate verification for testing purposes, to verify if the webhook works without certificate verification. If it does, please check if there are any issues with the server's certificate.

Kind regards,
Theodora