TLS certificates on client side
If your SonarQube Server instance is secured, add the self-signed certificate to the CI/CD host. If mutual TLS is used, an additional setup is required.
If your SonarQube Server instance is Securing SonarQube Server behind a proxy and a self-signed certificate then you must add the self-signed certificate to the trusted CA certificates of the SonarScanner.
In addition, if mutual TLS is used then you must define the access to the client certificate at the SonarScanner level.
Managing the self-signed server certificate
Introduction to server authentication
During the TLS authentication of the server, the client requests the server certificate from the server and verifies that this certificate is signed by a CA it trusts by checking its TrustStore. In case a self-signed server certificate is used, it must be added to the TrustStore of the client. The figure below shows the certificates involved in the authentication of SonarQube Server by the SonarScanner.

Adding the self-signed server certificate to the trusted CA certificates
Managing the client certificates
Introduction to client authentication
If mutual TLS is used then both the client and the server authenticate the other party. During the TLS authentication of the client, the client must provide its certificate with the corresponding CA certificate chain (intermediate and root CA certificates) to the server. The client manages its certificates in its own keystore. The figure below shows the certificates involved in SonarQube Server’s TLS authentication of the SonarScanner.

Defining the access to the client certificates
Last updated
Was this helpful?