# Unable to add SSL cert with latest image

**URL:** <https://community.sonarsource.com/t/unable-to-add-ssl-cert-with-latest-image/137721>\
**Category:** SonarQube Server / Community Build\
**Tags:** scanner\
**Created:** [March 25, 2025, 8:48am UTC](https://community.sonarsource.com/t/unable-to-add-ssl-cert-with-latest-image/137721 "2025-03-25T08:48:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shayan](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@shayan](https://community.sonarsource.com/u/shayan)\
**Post date:** [March 25, 2025, 8:48am UTC](https://community.sonarsource.com/t/unable-to-add-ssl-cert-with-latest-image/137721/1 "2025-03-25T08:48:37Z")

</div>

Hi support,

We have a SonarQube Developer Edition which we self host via an internal DNS. As such, we use the **keytool** CLI to add the SSL cert in order for the **sonar-scanner-cli** stage to work.

We are using Gitlab CI and I can confirm this is indeed an issue with the latest **sonar-scanner-cli** image. I cannot replicate this issue with the image tag 5.0.1.

This is very similar to the issue linked [here](https://community.sonarsource.com/t/cant-add-cert-to-latest-scanner-cli-docker-image/115953).

I have replicated this in a forked repo in Gitlab CI which I will paste below:

```auto
stages:
  - triggers

sonarqube-check-full:
  before_script:
    - mkdir -p $SONAR_USER_HOME/ssl
    - keytool -noprompt -importcert -storetype PKCS12 -alias sonarqube -keystore $SONAR_USER_HOME/ssl/truststore.p12 -storepass changeit -file /srv/shared/sonarqube-cert.pem
  stage: triggers
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: ['']
  variables:
    SONAR_USER_HOME: '${CI_PROJECT_DIR}/.sonar'
    GIT_DEPTH: '0'
  cache:
    key: '${CI_JOB_NAME}'
    paths:
      - .sonar/cache
  script:
    - sonar-scanner -Dsonar.qualitygate.wait=true
  allow_failure: true

```

The error I am getting in our Gitlab pipeline is this:

```auto
$ mkdir -p $SONAR_USER_HOME/ssl
$ keytool -import -noprompt -storetype PKCS12 -alias sonar -keystore truststore.p12 -file /srv/shared/sonarqube-cert.pem -storepass changeit
Certificate was added to keystore
$ sonar-scanner -Dsonar.qualitygate.wait=true -Dsonar.scanner.truststorePassword=changeit
07:34:25.652 INFO Scanner configuration file: /opt/sonar-scanner/conf/sonar-scanner.properties
07:34:25.657 INFO Project root configuration file: /builds/xxxxxxxx/xxxxxxxxx/sonar-project.properties
07:34:25.672 INFO SonarScanner CLI 7.1.0.4889
07:34:25.674 INFO Java 17.0.14 Amazon.com Inc. (64-bit)
07:34:25.674 INFO Linux 5.15.0-1077-aws amd64
07:34:25.709 INFO User cache: /builds/xxxxxxxx/xxxxxxxxx/.sonar/cache
07:34:29.037 ERROR Failed to query server version: Call to URL [https://sonarqubeSomeDomain.internal/api/v2/analysis/version] failed: None of the TrustManagers trust this certificate chain
07:34:29.037 INFO EXECUTION FAILURE
07:34:29.039 INFO Total time: 3.391s

```

PS: I have masked some bits in the logs for obvious reasons.

Will be great to get some help as we have just renewed our license and cannot proceed.

Thanks

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [March 26, 2025, 1:22pm UTC](https://community.sonarsource.com/t/unable-to-add-ssl-cert-with-latest-image/137721/2 "2025-03-26T13:22:53Z")

</div>

Hi,

Thanks for sharing your pipeline commands & output.

It’s not clear to me from this, however that the pkcs12 truststore is located in

> [@Can't add cert to latest Scanner CLI Docker image](https://community.sonarsource.com/t/cant-add-cert-to-latest-scanner-cli-docker-image/115953/31):
>
> the `$SONAR_USER_HOME/ssl/truststore.p12` location.

I see you make the `$SONAR_USER_HOME/ssl` directory, but I don’t see you `cd` into it before creating the keystore.

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![shayan](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@shayan](https://community.sonarsource.com/u/shayan)\
**Post date:** [March 26, 2025, 5:16pm UTC](https://community.sonarsource.com/t/unable-to-add-ssl-cert-with-latest-image/137721/3 "2025-03-26T17:16:23Z")

</div>

That was it indeed! Sorry I missed that.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\
**Post date:** [April 2, 2025, 5:16pm UTC](https://community.sonarsource.com/t/unable-to-add-ssl-cert-with-latest-image/137721/4 "2025-04-02T17:16:32Z")

</div>

Closed on April 2, 2025, 5:16pm UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.