CLI not working on SonarQube Server with a self-signed certificate

[ale-argo]

I'm on windows, the certificate is in the trusted certificates list.
The authentication works fine, but after that a simple sonar list projects command replies with: "❌ unable to verify the first certificate"

[voz]

@ale-argo thanks for the report. Can you provide sonar --version?

[ale-argo]

@voz sonar version is 0.13.0

[nquinquenel]

Hi @ale-argo, thanks for the report!

This is a known limitation of how the CLI binary is built. It uses Bun as its runtime, which ships with its own CA bundle, and unlike native Node.js on Windows, it does not read the Windows certificate store at runtime. So even though your CA is trusted system-wide, Bun never sees it, and every direct HTTPS call to your server fails with unable to verify the first certificate.

Auth appears to work because the browser OAuth flow never makes a direct TLS connection from the CLI process: the browser (which does use the Windows cert store) handles the HTTPS leg and POSTs the token back to a plain http://localhost callback server. All subsequent commands (list projects, etc.) use fetch() directly from the Bun process, which is where the failure occurs.

As a workaround, you should be able to export your CA certificate to a PEM file and set NODE_EXTRA_CA_CERTS, Bun respects this env var and appends the cert to its built-in bundle without replacing it:

$env:NODE_EXTRA_CA_CERTS = "C:\path\to\your-ca.pem"
sonar list projects

Could you confirm that the NODE_EXTRA_CA_CERTS workaround resolves the issue for you? That would help us verify the root cause on your setup.

[ale-argo]

Thank you, the workaround works just fine.
I suggest you add this to the documentation

[voz]

@ale-argo thanks and point taken. We'll do it. We reworked quite a bit our CLI docs recently https://docs.sonarsource.com/sonarqube-cli Check it out.

Yet still need to do few iterations on top including this workaround. Stay tuned.