Jenkins 无法使用 https 和 SSL 连接 SonarQube

Question

环境详细信息

SonarQube – Version - 6.7.6(LTS)
OS – CentOS – 7.6
Protocol- Https
Certificate: SSL – Self Signed.
Jenkins: 2.164.1
Sonar Scanner Version - 3.3.0.1492
Nginx configured for reverse proxy.

在我的 Sonarqube 服务器上，我使用以下命令创建了自签名证书。

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /root/ssl-key/ sonarqube.key -out /root/ssl-key/sonarqube.crt

Jenkins 在分析代码时出现以下错误

11:30:33.957 ERROR: SonarQube server [https://sonarqube/sonar] can not be reached
11:30:33.958 INFO: ------------------------------------------------------------------------
11:30:33.958 INFO: EXECUTION FAILURE
11:30:33.958 INFO: ------------------------------------------------------------------------
11:30:33.959 INFO: Total time: 0.487s
11:30:33.987 INFO: Final Memory: 4M/121M
11:30:33.987 INFO: ------------------------------------------------------------------------
11:30:33.988 ERROR: Error during SonarQube Scanner execution
org.sonarsource.scanner.api.internal.ScannerException: Unable to execute SonarQube
        at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.run(IsolatedLauncherFactory.java:84)
        at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.run(IsolatedLauncherFactory.java:71)
        at java.security.AccessController.doPrivileged(Native Method)
        at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.createLauncher(IsolatedLauncherFactory.java:71)
        at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.createLauncher(IsolatedLauncherFactory.java:67)
        at org.sonarsource.scanner.api.EmbeddedScanner.doStart(EmbeddedScanner.java:218)
        at org.sonarsource.scanner.api.EmbeddedScanner.start(EmbeddedScanner.java:156)
        at org.sonarsource.scanner.cli.Main.execute(Main.java:74)
        at org.sonarsource.scanner.cli.Main.main(Main.java:61)
Caused by: java.lang.IllegalStateException: Fail to get bootstrap index from server
        at org.sonarsource.scanner.api.internal.Jars.getBootstrapIndex(Jars.java:100)
        at org.sonarsource.scanner.api.internal.Jars.getScannerEngineFiles(Jars.java:76)
        at org.sonarsource.scanner.api.internal.Jars.download(Jars.java:70)
        at org.sonarsource.scanner.api.internal.JarDownloader.download(JarDownloader.java:39)
        at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.run(IsolatedLauncherFactory.java:75)
        ... 8 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

我的sonarqube服务器（sonarqube.key and sonarqube.crt）中有以下两个文件，后来我将这两个文件复制到我的Jenkins服务器并执行仍然出现相同的错误。

Answer 1

由于 Jenkins 在 Java 上运行，您需要获取 Java 来信任您的自签名证书。您可以使用 Java 的 keytool 命令将证书（不是密钥）从您的 Sonarqube 服务器导入到 Java 的 cacerts 信任库：

keytool -import -trustcacerts -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -alias SonarQube -import -file sonarqube.crt

或者，如果您对 Jenkins 主机具有基于 GUI 的访问权限，则您可以使用 Portecle 等工具来执行导入。

Jenkins 无法使用 https 和 SSL 连接 SonarQube

Jenkins unable to connect SonarQube using https & SSL

jenkins

openssl

sonarqube

sonarscanner