Docker-sonarqube: Providing a truststore

Created on 19 Oct 2018 · 5Comments · Source: SonarSource/docker-sonarqube

How do I pass a trust store to java?

In order to access both our git repo and ldap over https and ldaps, I need to pass a trust store to the Java execution.

I have tried 2 ways to do this - neither of which seems to work, namely:

sonar.properties
sonar.ce.javaAdditionalOpts=-Djavax.net.ssl.trustStore=/opt/sonarqube/conf/sonarqube.jks -Djavax.net.ssl.trustStorePassword=changeit

compose.yml
command: "-Djavax.net.ssl.trustStore=/opt/sonarqube/conf/sonarqube.jks -Djavax.net.ssl.trustStorePassword=changeit"

The docker logs show:
2018.10.19 18:21:50 INFO app[][o.s.a.p.ProcessLauncherImpl] Launch process[[key='web', ipcIndex=2, logFilenamePrefix=web]] from [/opt/sonarqube]: /usr/lib/jvm/java-1.8-openjdk/jre/bin/java -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/opt/sonarqube/temp -Xmx512m -Xms128m -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/./urandom -cp ./lib/common/*:/opt/sonarqube/lib/jdbc/postgresql/postgresql-42.2.1.jar org.sonar.server.app.WebServer /opt/sonarqube/temp/sq-process5584900536095089146properties

Source

adrianblakey

Most helpful comment

For anyone who's looking how to add a CACert to your keystore, here's a quick multi-stage Dockerfile that does just that:

FROM openjdk:8 AS builder
COPY cacert.pem /tmp/
RUN keytool -import -v -trustcacerts -alias ipa -file /tmp/cacert.pem \
      -keystore ${JAVA_HOME}/jre/lib/security/cacerts -noprompt -storepass changeit

FROM sonarqube:7.4-community
COPY --from=builder ${JAVA_HOME}/jre/lib/security/cacerts ${JAVA_HOME}/jre/lib/security/cacerts

gmr on 13 Dec 2018

👍3

All 5 comments

I believe I have fixed this by also doing this in the Dockerfile for the refined image.

COPY sonarqube.jks /usr/lib/jvm/java-1.8-openjdk/jre/lib/security/cacerts

For some reason now the settings show up in the execution ni the logs too:

2018.10.19 20:47:33 INFO app[][o.s.a.p.ProcessLauncherImpl] Launch process[[key='ce', ipcIndex=3, logFilenamePrefix=ce]] from [/opt/sonarqube]: /usr/lib/jvm/java-1.8-openjdk/jre/bin/java -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/opt/sonarqube/temp -Xmx512m -Xms128m -XX:+HeapDumpOnOutOfMemoryError -Djavax.net.ssl.trustStore=/opt/sonarqube/conf/sonarqube.jks -Djavax.net.ssl.trustStorePassword=changeit -cp ./lib/common/*:/opt/sonarqube/lib/jdbc/postgresql/postgresql-42.2.1.jar org.sonar.ce.app.CeServer /opt/sonarqube/temp/sq-process4950547903790867495properties

adrianblakey on 19 Oct 2018

Glad you found a solution!

janos-ss on 30 Nov 2018

For anyone who's looking how to add a CACert to your keystore, here's a quick multi-stage Dockerfile that does just that:

FROM openjdk:8 AS builder
COPY cacert.pem /tmp/
RUN keytool -import -v -trustcacerts -alias ipa -file /tmp/cacert.pem \
      -keystore ${JAVA_HOME}/jre/lib/security/cacerts -noprompt -storepass changeit

FROM sonarqube:7.4-community
COPY --from=builder ${JAVA_HOME}/jre/lib/security/cacerts ${JAVA_HOME}/jre/lib/security/cacerts

gmr on 13 Dec 2018

👍3

@adrianblakey hi, sorry to bring this up after a while, as i am encountering the same issue as you.

May i know which option did you proceed with ?

Option 1

sonar.properties
sonar.ce.javaAdditionalOpts=-Djavax.net.ssl.trustStore=/opt/sonarqube/conf/sonarqube.jks -Djavax.net.ssl.trustStorePassword=changeit

Option 2

compose.yml
command: "-Djavax.net.ssl.trustStore=/opt/sonarqube/conf/sonarqube.jks -Djavax.net.ssl.trustStorePassword=changeit"

Additionally, do you do a docker volume mount for /opt/sonarqube/conf/sonarqube.jks to the container?

robincher on 25 Jun 2019

Hello,

I have issue to accessing back end java jar from front end angular. As i m deploy front end with https using ssl certificate but when i login then its not done because of Https -> Http request showing error content block or insecure connection error i got.

I m using Aws instance for front end and back end.

Can any one please suggest me the procedure to run or apply SSL to my java jar.