SonarQube integration with Azure DevOps Pipeline via Self-hosted Azure VM

[SakthiSushmitha]

Trying to run SonarQube scan from Azure DevOps pipeline integrated to a SonarQube server (SonarQube running in a different server and different network where firewall been enabled) via Self hosted agent.

1. Created Agent pool in Azure DevOps where the Agent pool is Self-hosted Azure Virtual machine(windows).
2. Installed SonarQube extension from Azure DevOps Market Place.
3. Created Service connection for SonarQube in the Azure DevOps.
4. Established communication from Azure DevOps to VM, from VM to SonarQube .
5. Created sample pipeline in Azure DevOps to run SonarQube scan.
6. Also added required certificates in the Virtual Machine.

Getting this error:
##[error][SQ] API GET ‘/api/server/version’ failed, error was: {“code”:“UNABLE_TO_GET_ISSUER_CERT_LOCALLY”}

Need help to resolve this issue as soon as possible.

Thanks,
Sakthi

[Colin]

Hey there.

Your SonarQube server is probably using a self-signed certificate, which NodeJS (executing this web request) doesn’t automatically trust.

Take a look at this similar thread:

VSTS - Publish Quality Gate Result: unable to get local issuer certificate

Hi, We are using SonarQube Community Edition - Version 7.9.1 (build 27448) and the SonarQube extensions 4.8.0 for TFS 2018. The tasks “Prepare analysis on SonarQube” and “Run Code Analysis” work normal, but the task “Publish Quality Gate Result” fails with “unable to get local issuer certificate” as seen here: [2019-09-17_11h48_48] I googled and found the following posting with a proposed solution, which describes my problem (we are also using a self signed certificate for our sonar server) …

[SakthiSushmitha]

Thank you Colin for sharing the thread link.

I have added the
NODE_EXTRA_CA_CERTS= C:\sonarqube.crt in the Self hosted VM environment variable and also in the Azure DevOps pipeline variable.

Still getting the same error. Need support to fix this issue.

[SakthiSushmitha]

Colon we have the SonarQube Enterprise version and we didn’t find sonar account to create a ticket on the mentioned issue.

And through Community we seek support. If possible support us raising the ticket.

[Colin]

Hey there.

Unless you have access to Commercial Support (an add-on to certain commercial subscriptions)… this Community is where you can seek help.

I would really suggest going the route of this poster:

VSTS - Publish Quality Gate Result: unable to get local issuer certificate

In order to try the content of the environment variable, I created a very small node script, as seen below: var request = require("request"); request( { uri: "https://sonar.oe.wknet/about" }, function(error, response, body) { console.log(body); console.log(error); } ); I could see that as soon I removed the certificates from the pem file, the request fails: { Error: unable to get local issuer certificate at TLSSocket.onConnectSecure (_tls_wrap.js:1058:34) at TLS…

And creating a small node script to test that the NODE_EXTRA_CA_CERTS value is behaving as expected. This takes the scanner itself out of the equation for now.

[SakthiSushmitha]

Thanks.
But still the same error in the pipeline. Kindly share us solution.

error: ][SQ] API GET ‘/api/server/version’ failed, error was: {“code”:“UNABLE_TO_GET_ISSUER_CERT_LOCALLY”}

[Shikhar_Daniel]

Hi
I am also facing exact same problem.

If you were able to get past this, could you please share your solution.