CBadgotya185209 (Community Member) asked a question.
Using command "mvn com.srcclr:srcclr-maven-plugin:scan" and running SCA scan on my application bundle. I get the below warning and error messages.
[WARNING] Timeout while trying to communicate with SourceClear API ... retry 1 of 1
Jun 09, 2023 2:51:23 PM org.bouncycastle.jsse.provider.ProvTlsClient notifyAlertRaised
WARNING: Client raised fatal(2) internal_error(80) alert: Failed to read record
java.net.SocketException: Connection reset
--------------------------------------------------------
[ERROR] Failed to execute goal com.srcclr:srcclr-maven-plugin:3.1.24:scan (default-cli) on project msip: Execution default-cli of goal com.srcclr:srcclr-maven-plugin:3.1.24:scan failed: Cannot write application data until initial handshake completed. -> [Help 1]
.png){kind=logo}
Hello @CBadgotya185209 (Community Member),
I see that you opened a case with Support and they stated that there was an agent update some time ago that increased the security and TLS 1.2 requirements. By default, the SCA agent uses Bouncy Castle TLS in FIPS mode. Setting the DISABLE_FIPS environment variable to TRUE turns off FIPS mode and allows the agent to use ciphers that may not be FIPS-140-2 compliant.
To expand the allowed ciphers from 8 to 32 for a quick fix, set the environment variable and to work with your IT team to have your client support TLS 1.2 and one of the ciphers from the list in the help document Integrate Veracode SCA Agent-Based Scanning with Your CI Projects.
Jason
Veracode Support Engineer