Artifactory Authentication

When used with Artifactory, JFrog CLI supports several authentication methods. You must authenticate before JFrog CLI can access Artifactory.

For a complete overview of all authentication methods — including username/password, access tokens, browser login (jf login), OIDC token exchange, environment variable authentication, and troubleshooting — see Authenticating via the CLI.

This page covers Artifactory-specific authentication methods that require additional setup: RSA key authentication, mutual TLS (mTLS) client certificates, and custom CA certificate configuration.

• Authenticate with RSA keys
• Authenticate using client certificates (mTLS)
• Trust a custom or private CA certificate

Authenticate with RSA Keys

From version 4.4, Artifactory supports SSH authentication using RSA public and private keys.

Prerequisites

1. SSH authentication must be enabled on your Artifactory server. See Manage SSH Keys in the JFrog Platform Administration documentation.

2. Your public key must be added to your Artifactory user profile.

Limitations

Command Options

SSH URL Format

Configure your Artifactory URL to use the SSH format: ssh://[host]:[port]

To authenticate with RSA keys:

1. Complete the prerequisites and confirm RSA is appropriate for your workflow (see Limitations under this section).
2. Use the SSH URL format described under SSH URL Format.
3. Run the commands for Method 1 or Method 2, depending on whether you want a saved server configuration or a per-command connection.

Configuration Methods

Method 1: Using jf config add

jf config add my-server \
  --artifactory-url=ssh://artifactory.mycompany.com:1339 \
  --ssh-key-path=~/.ssh/id_rsa \
  --ssh-passphrase=your-passphrase

Method 2: Per-Command Options

jf rt ping \
  --url=ssh://artifactory.mycompany.com:1339 \
  --ssh-key-path=~/.ssh/id_rsa

Authenticate Using mTLS Client Certificates

From Artifactory release 7.38.4, you can authenticate users using client certificates (mTLS). This requires a reverse proxy (for example, Nginx) with appropriate configuration. See HTTP Settings in the JFrog Artifactory documentation for setup instructions.

Limitations

To authenticate using client certificates (mTLS):

1. Review the limitations above for commands that do not support mTLS.
2. Run jf config add or per-command jf rt ping with --client-cert-path and --client-cert-key-path as shown in the Example section.

Command Options

Example

Using jf config add:

jf config add my-server \
  --url=https://acme.jfrog.io \
  --client-cert-path=/path/to/client-cert.pem \
  --client-cert-key-path=/path/to/client-key.pem

Per-command usage:

jf rt ping \
  --url=https://acme.jfrog.io/artifactory \
  --client-cert-path=/path/to/client-cert.pem \
  --client-cert-key-path=/path/to/client-key.pem

Combined with Other Authentication

mTLS can be combined with username/password or access token authentication:

jf config add my-server \
  --url=https://acme.jfrog.io \
  --client-cert-path=/path/to/client-cert.pem \
  --client-cert-key-path=/path/to/client-key.pem \
  --user=myuser \
  --password=mypassword

Certificate Format Requirements

• Both certificate and key files must be in PEM format
• The private key file should have restricted permissions (chmod 600)

Verify certificate and key match:

# These two commands should output the same MD5 hash
openssl x509 -noout -modulus -in client-cert.pem | openssl md5
openssl rsa -noout -modulus -in client-key.pem | openssl md5

Trust a Custom or Private CA Certificate

This section applies if you're not using a public CA to issue the SSL certificate for your Artifactory domain. This includes:

• Self-signed certificates
• Internal PKI services (for example, Microsoft CA)
• Private Certificate Authorities

Adding Custom CA Certificates

Place your CA certificates in the security/certs directory under JFrog CLI's home directory:

~/.jfrog/security/certs/

If you've customized the home directory using the [JFROG_CLI_HOME_DIR] environment variable, use:

$JFROG_CLI_HOME_DIR/security/certs/

Certificate Requirements

To add custom CA certificates to JFrog CLI:

1. Create the certificates directory:

   Bash

   mkdir -p ~/.jfrog/security/certs

2. Copy your CA certificate:

   Bash

   cp /path/to/your-ca-cert.pem ~/.jfrog/security/certs/

3. If using multiple certificates, run c_rehash:

   Bash

   c_rehash ~/.jfrog/security/certs/

   Note: c_rehash creates hash symlinks for each valid certificate and outputs no message on success. If you see OpenSSL error messages (for example, Could not find certificate from <file>), the certificate file may be malformed or not in PEM format. Verify the file starts with -----BEGIN CERTIFICATE-----.

4. Test the connection:

   Bash

   jf rt ping --url=https://your-server.com/artifactory

   Expected output:

   OK

   Note: Replace https://your-server.com/artifactory with your Artifactory URL. If you have already configured a default server via jf config add, you can also run jf rt ping without any flags to use that server. A 401 response indicates a credentials problem with your configured server, not a CA certificate issue.

Downloading a Certificate from a Server

If you need to extract the certificate from a running server, use your system's openssl tool (not JFrog CLI):

echo | openssl s_client -servername your-server.com -connect your-server.com:443 2>/dev/null | \
  openssl x509 -out ~/.jfrog/security/certs/your-server.pem

Replace your-server.com with your Artifactory hostname. The certificate is saved to ~/.jfrog/security/certs/your-server.pem.

Fallback: Skip TLS Verification

Some commands support the --insecure-tls option, which skips TLS certificate verification:

# Per-command
jf rt ping --url=https://your-server.com/artifactory --insecure-tls

Expected output:

OK

# During configuration — include your credentials alongside --insecure-tls
jf config add my-server \
  --url=https://your-server.com \
  --access-token=your-access-token \
  --insecure-tls

Migration from Versions Before 1.37.0

Before version 1.37.0, JFrog CLI expected certificates to be located directly under the security directory (not in a certs subdirectory).

• Old location: ~/.jfrog/security/
• New location: ~/.jfrog/security/certs/

JFrog CLI automatically migrates certificates to the new directory when upgrading to version 1.37.0 or above. A backup of the old configuration is stored in ~/.jfrog/backup.

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Authenticating via the CLI
• Verify Artifactory Accessibility
• HTTP Settings
• Manage Generic Files in Artifactory with JFrog CLI