mwong761451 (Community Member) asked a question.
We are using the the Veracode Jenkins plugin 18.3.5.6 on Jenkins
The pipeline script step is generated using the "Pipeline Syntax"'s "veracode: Upload and Scan with Veracode Pipeline" step.
The Jenkins agent (slave node) is running behind proxy, so we provides the proxy setting details (-phost, -pport, -puser and -ppassword)
we can see in the jenkins job logs that it invokes VeracodeJavaAPI.jar with the parameters.
the error displayed is "sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCCertPathBuilderException: unable to find valid certification path to requested target
Error- Returned code from wrapper:2"
We follow the "Configuring a Jenkins Pipeline Job for Veracode Scans" steps to configure our Jenkins pipeline job. Is there any extra steps required to install certificate at Jenkins agent (slave node) machine? If yes, can share the steps?
.png){kind=logo}
I've not experienced this issue with the Jenkins plugin but with other Java based SW. As you're probably aware that generic Java error usually indicates that the configured java keystore/truststore doesn't contain the CA root certificate required to validate the certificate chain. In terms of api.veracode.com IIRC this is Go Daddy Root Certificate Authority - G2
I'd try running InstallCert to update the keystore.
https://github.com/jeremylong/InstallCert
or you could use Portecle http://portecle.sourceforge.net/ to examine the TLS connection and also update the keystore.
Hope that's of some use
Thanks for the information.
Yes, we resolve the issue by locating and install the certificate in the certificate chain.
Perhaps veracode should update the document on the jenkins plugin stated the need of install certificate if running behind proxy
The above reference to the Go Daddy web hosting is deprecated. Veracode CA is now based on Amazon as described with the attached screenshot.
The related Help Center page https://help.veracode.com/reader/UdnGRO3X3Ih0kYj30wuZbg/40nzYdiluIrJ9uZXwfwEpA
is undergoing update as well.