SonarLint does not respect the certificates added in the IntelliJ's keystore

SonarQube for IDE IntelliJ Platform
, , ,
1

I’m hitting problem while trying to connect to SonarQube server with self-signed certificate. The certificate is imported in the IntelliJ’s server certificates but I’m not able to access the server.

Template for a good bug report, formatted with Markdown:

  • Versions used:
    IntelliJ version 2020.01 (Ultimate Edition)
    Build #UI-201-6668.121, build on April 8, 2020
    Runtime: 11.0.6+8-b765.25 amd64
    SonarLint version: 4.6.0.16682
    SonarQube server - 8.2
    OS: Windows 10

  • Error observed (wrap logs/code around triple quote for proper formatting)Failed to connect to the server. Please check the configuration. Error: Fail to request https://sonar/api/system/status```

  • Steps to reproduce

  1. Install SonarLint in IntelliJ
  2. Add the needed certificate(s) in Settings -> Tools -> Server Certificates
  3. Try to add connection to SonarQube server that needs self-signed certificate via the configuration wizard
  • Current result:
    After the username and password are filled there is a Failed to connect to the server. Please check the configuration. Error: Fail to request https://sonar/api/system/status fail message is returned.
  • Expected result:
    Successful connection.
  • Potential workaround
    Unknown for now.

As workaround I have tried to add the certificates in the JRE’s keystore that IntelliJ is using to start. I found the JRE location via plugin called “Choose Runtime” provided by JetBrains. When I added the certificates I made check if I can connect to the needed SonarQube server via small java application. It worked. But the login via SonarLint plugin is still not working and the same error is there as output.

As another workout I have tried to add a java parameters info idea64.exe.vmoptions. I passed these parameters:
“-Djavax.net.ssl.keyStore=“C:…\JetBrains\IntelliJ IDEA 2019.2.1\jbr\lib\security\cacerts”
-Djavax.net.ssl.trustStore=“C:…\IntelliJ IDEA 2019.2.1\jbr\lib\security\cacerts”
-Djavax.net.ssl.keyStorePassword=”"
"
The values are full and the files exists. This again didn’t work for me.

In addition I have added the certificates in my JDK that is installed for building my projects. This didn’t work as well.

Do you have any suggestions how to make SonarLint plugin to use the provided certificates from the IntelliJ?

2

The problem is solved.
The hostname I was using was the shortcut for the fully qualified domain name. It must be the FQDN to work properly.
Additional logging:

java.lang.IllegalStateException: Fail to request https://sonar/api/system/status
	at org.sonarsource.sonarlint.core.util.ws.HttpConnector.doCall(HttpConnector.java:196)
	at org.sonarsource.sonarlint.core.util.ws.HttpConnector.get(HttpConnector.java:122)
	at org.sonarsource.sonarlint.core.util.ws.HttpConnector.call(HttpConnector.java:109)
	at org.sonarsource.sonarlint.core.container.connected.SonarLintWsClient.rawGet(SonarLintWsClient.java:120)
	at org.sonarsource.sonarlint.core.container.connected.SonarLintWsClient.get(SonarLintWsClient.java:85)
	at org.sonarsource.sonarlint.core.container.connected.validate.ServerVersionAndStatusChecker.lambda$fetchServerInfos$0(ServerVersionAndStatusChecker.java:97)
	at org.sonarsource.sonarlint.core.container.connected.SonarLintWsClient.processTimed(SonarLintWsClient.java:226)
	at org.sonarsource.sonarlint.core.container.connected.validate.ServerVersionAndStatusChecker.fetchServerInfos(ServerVersionAndStatusChecker.java:96)
	at org.sonarsource.sonarlint.core.container.connected.validate.ServerVersionAndStatusChecker.checkVersionAndStatus(ServerVersionAndStatusChecker.java:60)
	at org.sonarsource.sonarlint.core.container.connected.validate.ServerVersionAndStatusChecker.checkVersionAndStatus(ServerVersionAndStatusChecker.java:50)
	at org.sonarsource.sonarlint.core.WsHelperImpl.validateConnection(WsHelperImpl.java:65)
	at org.sonarsource.sonarlint.core.WsHelperImpl.validateConnection(WsHelperImpl.java:58)
	at org.sonarlint.intellij.tasks.ConnectionTestTask.run(ConnectionTestTask.java:53)
	at com.intellij.openapi.progress.impl.CoreProgressManager$TaskRunnable.run(CoreProgressManager.java:930)
	at com.intellij.openapi.progress.impl.CoreProgressManager$4.run(CoreProgressManager.java:480)
	at com.intellij.openapi.progress.impl.ProgressRunner.lambda$new$0(ProgressRunner.java:77)
	at com.intellij.openapi.progress.impl.ProgressRunner.lambda$null$3(ProgressRunner.java:233)
	at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcess$2(CoreProgressManager.java:164)
	at com.intellij.openapi.progress.impl.CoreProgressManager.registerIndicatorAndRun(CoreProgressManager.java:625)
	at com.intellij.openapi.progress.impl.CoreProgressManager.executeProcessUnderProgress(CoreProgressManager.java:570)
	at com.intellij.openapi.progress.impl.ProgressManagerImpl.executeProcessUnderProgress(ProgressManagerImpl.java:61)
	at com.intellij.openapi.progress.impl.CoreProgressManager.runProcess(CoreProgressManager.java:151)
	at com.intellij.openapi.progress.impl.ProgressRunner.lambda$submit$4(ProgressRunner.java:233)
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Hostname sonar not verified:```
1 Like
3

Thanks for the follow up, and glad you managed to fix your issue!

4

Just to add for this — the shortcut probably can work, but would need to be listed in the SubjectAltNames part of the certificate installed! Based on the error (hostname not verified) it probably isn’t.