Facing error in prepare analysis task while executing the pipeline

Hi,

Facing below error in Prepare Analysis Task in Azure Devops React Pipeline.
Tried below solutions:
New SonarQube endpoint connection.
Tried with new self hosted agent.
Still facing same issue.

##[error][SQ] API GET ‘/api/server/version’ failed, error is request to https://sonar.com/api/server/version failed, reason: unable to verify the first certificate

Hi,

Welcome to the community!

Is that literally the error you’re seeing? Given the domain in the error is https://sonar.com, I suspect your SonarQube server URL has been misconfigured somewhere.

 
HTH,
Ann

Hi,

URL is correct. It is https://sonar.xyz.com.

Hi,

Your SonarQube domain is https://sonar.xyz.com but what shows up in the error is https://sonar.com. Again, I think you’ve misconfigured your SonarQube server URL somewhere.

 
HTH,
Ann

I am also getting this error with Azure Dev Ops.
##[error][SQ] API GET ‘/api/server/version’ failed, error is request to https://sonarqube-sre.apps.ocptest.NAME.com/api/server/version failed, reason: unable to verify the first certificate

Hi @ryto9344,

Welcome to the community!

This may help.

 
Ann

I dont believe that is the issue. I am able to make the curl command in a script without any ssl issues right before the task is triggered without any ssl errors.
- task: SonarQubePrepare@5
What all is this task actually doing? Maybe I can recreate it with a script to find exactly the problem

As a work around I am just using the cli and I noticed it also had cert issues. What I ended up doing is installing the keystore to the jvm that comes with the cli. I then thought maybe that needs to be done with the java on the agent already so I did this but still getting a cert issue. Is there anything else that can be hiding?

  • script: |
    sudo keytool -import -alias sonarqube-sre -keystore /usr/lib/jvm/temurin-11-jdk-amd64/lib/security/cacerts -file .azuredevops/sonarqube_cert.pem -storepass changeit -noprompt

Hi,

All I can recommend is making sure, as the SO answer I linked to describes, that the entire chain is in the keystore. Or you could stop using self-signed certs.

 
Ann