Sonarqube maven plugin and truststores

[Arun_Kumar]

Must-share information (formatted with Markdown):

• which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
  sonarqube 9.4 maven scanner v 3.9.1.2184
• what are you trying to achieve
  Scan my maven project with sonarqube
• what have you tried so far to achieve this
  used the maven command:
  mvn org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184:sonar -Dsonar.host.url=<my_sonar-url> -Djavax.net.ssl.trustStore= -Djavax.net.ssl.trustStorePassword= -Dsonar.projectKey= -Dsonar.projectName= -Dsonar.login=

However, i keep getting this error: Hostname not verified (no certificates)
I have created a trust store and given that location in the command yet it seems like the trust store is ignored. How can i know which trust store the scanner uses?

[ganncamp (G Ann Campbell)]

Hi,

Welcome to the community!

Does this seem relevant?

SSLPeerUnverifiedException: Hostname XXXXXXX not verified (no certificates)

Hello @darrenlewis, It is indeed quite standard, no third-party plugins here. Again, as it’s intermittent, you have to focus of what could change in the SSL handshake process. Here are few ideas gathered from what we know about the topic: Do you know what version of the TLS protocol is used in your config? Could that change and sometimes be TLS 1.2, some other times 1.3? It will be good to force it so you could potentially narrowdown the issue Does your certificate defines a SubjectAlternati…

What’s your JDK?

 
Ann

[Arun_Kumar]

Hi Ann. Thanks yes. It was openjdk. When i shifted to Oracle jdk, it worked fine.