Introduction

This plugin connects to your Jenkins server through the Jenkins Script Console (Groovy) and discovers credential metadata stored withinJenkins, including TLS certificates, SSH keys, secret tokens, passwords, and secret files.

For PKCS#12 keystore credentials and PEM-encoded secret file credentials, the plugin extracts the public certificate PEM and reportsit as a certificate asset. All other supported credential types, including those provided by more than 80 third-party Jenkins plugins, arereported as metadata-only assets. In these cases, the plugin records the credential's existence, type, and location without inspecting orexposing its contents. Any unrecognized credential types are reported as secret metadata assets.

Note: The plugin accesses decrypted credential content within the Jenkins controller process for classification purposes, such as opening keystores or reading file contents to identify PEM-encoded certificates. However, it never exports private keys,passwords, secret values, or other sensitive data. Only public certificate information and non-sensitive metadata are includedin the scan results.

Which Jenkins Discovery Plugin Is This?

The platform provides two Jenkins discovery plugins:

Jenkins Script Plugin (jenkins-script-plugin)

This plugin executes a Groovy script on the Jenkins controller through the Jenkins Script Console. It can inspect supported credential types, including PKCS#12 keystores and PEM-encoded secret files, to extract and report public certificate PEM data as certificate assets. Othercredential types are discovered and reported as metadata-only assets. Because it runs directly on the Jenkins controller, it requires theOverall/Administer permission.

Jenkins REST Plugin (jenkins-rest-plugin)

This plugin connects to Jenkins remotely using a username and API token over HTTP or HTTPS. It retrieves credential metadata onlyand classifies credentials based on their Jenkins credential type without inspecting their underlying content. For example:

  • Credentials of the Certificate type are reported as key assets.
  • Certificates uploaded as Secret File credentials are reported as secret assets.
  • Certificate content and PEM data are not accessible through the Jenkins REST API and therefore cannot be extracted.