SSL issue when connecting Gitlab (on-premise) and Sonarqube

anon78674739 · September 9, 2025, 10:32am

Dear community,

Must-share information (formatted with Markdown):

Version : SonarQube Server / Community Build (25.9.0.112764-community)
deployed with docker compose
what are you trying to achieve : I would like to use the function “Import from gitlab”

I created a configuration with the next information :

GitLab API URL : https://gitlab.mydomain.com/api/v4
Personal Access Token : a token with the role “Reporter”

I already create the certificate and import it in the truestore with the commands below :

openssl s_client -connect gitlab.mydomain.com:443 -servername gitlab.mydomain.com -showcerts </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > certchain.pem
keytool -import -file certchain.pem -alias customalias -keystore custom.truststore -storepass changeit

Below, the error I always have in the logs :

Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

The docker-compose.yml file :

services:
  sonarqube:
    image: sonarqube:25.9.0.112764-community
    hostname: sonarqube
    container_name: sonarqube
    restart: always
    read_only: true
    depends_on:
      sonarqube-db:
        condition: service_healthy
    environment:
      SONAR_JDBC_URL: jdbc:postgresql://sonarqube-db:5432/sonar
      SONAR_JDBC_USERNAME: sonar
      SONAR_JDBC_PASSWORD: sonar
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions
      - sonarqube_logs:/opt/sonarqube/logs
      - sonarqube_temp:/opt/sonarqube/temp
      - ./cacerts.truststore:/opt/java/openjdk/lib/security/cacerts:ro
    ports:
      - "9000:9000"
  sonarqube-db:
    image: postgres:17.6
    container_name: sonarqube-db
    restart: always
    hostname: sonarqube-db
    environment:
      POSTGRES_USER: sonar
      POSTGRES_PASSWORD: sonar
      POSTGRES_DB: sonar
    volumes:
      - ./postgresql:/var/lib/postgresql
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  sonarqube_data:
  sonarqube_extensions:
  sonarqube_logs:
  sonarqube_temp:

Thanks for your help.

Good day,

Reoccur

Colin · September 10, 2025, 6:38am

Hey there.

First thing I would suggest is that you test your truststore using a tool like SSLPoke to make sure you’ve actually imported the certs correctly.

anon78674739 · September 10, 2025, 7:42am

Hello Colin,

Thanks for your answer.

It’s working with the tool :

java -Djavax.net.ssl.trustStore=cacerts -Djavax.net.ssl.trustStorePassword=changeit -jar /tmp/SSLPoke.jar gitlab.mydomain.com 443
Successfully connected

Good day,

Reoccur

Colin · September 10, 2025, 2:00pm

In the working command you’ve mentioned cacerts but in your Docker compose file it’s cacerts.truststore. Could that be it?

anon78674739 · September 10, 2025, 2:13pm

It’s cacerts on my container. I did the command SSLPoke from the container.

Colin · September 18, 2025, 1:23pm

Thanks @anon78674739. To be honest everything looks in order, so I’m rather puzzled.

Which logfile are you seeing this in? Any details before that message that could be relevant? I’m wondering if this is really happening when connecting to Gitlab, or maybe when SonarQube is calling out somewhere else (Update Center, for example).

anon78674739 · September 30, 2025, 8:33am

Hello Colin,

The logs come from docker logs and it’s only happening when connecting to my selfhost Gitlab.
Below, you can see the full log.

2025.09.30 08:29:28 INFO  web[][o.s.a.c.g.GitlabApplicationClient] Gitlab API call to [https://gitlab.mydomain.com/api/v4/projects] failed with error message : [Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]
javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.kt:379)
        at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.kt:337)
        at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:209)
        at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226)
        at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106)
        at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74)
        at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255)
        at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.logging.HttpLoggingInterceptor.intercept(HttpLoggingInterceptor.kt:221)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201)
        at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154)
        at org.sonar.alm.client.gitlab.GitlabApplicationClient.checkProjectAccess(GitlabApplicationClient.java:105)
        at org.sonar.alm.client.gitlab.GitlabApplicationClient.checkUrl(GitlabApplicationClient.java:88)
        at org.sonar.alm.client.gitlab.GitlabGlobalSettingsValidator.validate(GitlabGlobalSettingsValidator.java:55)
        at org.sonar.alm.client.gitlab.GitlabGlobalSettingsValidator.validate(GitlabGlobalSettingsValidator.java:48)
        at org.sonar.server.monitoring.devops.GitlabMetricsTask.validateGitlab(GitlabMetricsTask.java:58)
        at org.sonar.server.monitoring.devops.GitlabMetricsTask.run(GitlabMetricsTask.java:51)
        at org.sonar.server.monitoring.MainCollector.lambda$start$0(MainCollector.java:54)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
        at java.base/java.util.concurrent.FutureTask.runAndReset(Unknown Source)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
        at java.base/java.lang.Thread.run(Unknown Source)
Caused by: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/sun.security.validator.PKIXValidator.<init>(Unknown Source)
        at java.base/sun.security.validator.Validator.getInstance(Unknown Source)
        at java.base/sun.security.ssl.X509TrustManagerImpl.getValidator(Unknown Source)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(Unknown Source)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(Unknown Source)
        at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
        ... 34 common frames omitted
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/java.security.cert.PKIXParameters.setTrustAnchors(Unknown Source)
        at java.base/java.security.cert.PKIXParameters.<init>(Unknown Source)
        at java.base/java.security.cert.PKIXBuilderParameters.<init>(Unknown Source)
        ... 50 common frames omitted

Good day,

Reoccur

Topic		Replies	Views
Connecting Sonarqube to Gitlab SonarQube Server / Community Build gitlab	2	124	December 20, 2024
Delegation of authentication with Gitlab fails SonarQube Server / Community Build gitlab , ssl , authentication	2	1698	August 19, 2021
Pull Request Decoration on self managed gitlab fails due to java error SonarQube Server / Community Build gitlab , ssl	1	838	January 25, 2021
Connecting Sonarqube and Gitlab on premise (certificate issue) SonarQube Server / Community Build	2	773	November 18, 2024
SonarQube Github Integration Failing SonarQube Server / Community Build sonarqube	1	215	August 14, 2024

SSL issue when connecting Gitlab (on-premise) and Sonarqube

Related topics