SonarQube Quality Gate behavior with self‑signed certificates in plugin downloads

Goal

Determine how SonarQube handles self‑signed or expired SSL certificates when downloading plugins and how that affects future plugin updates, while still evaluating Quality Gates.

Constraints

SonarQube relies on the JVM’s SSLContext for certificate validation. No documented configuration exists to bypass SSL checks for plugin URLs; users must import certificates into the JVM truststore. The impact of this manual step on subsequent plugin downloads and Quality Gate evaluation remains unclear.

Unresolved Decision

It is not documented whether SonarQube automatically retries plugin downloads after a truststore update, or whether the truststore change persists across analysis runs and affects future updates.

Specific Questions

• After adding a self‑signed certificate to the JVM truststore, does SonarQube automatically retry a failed plugin download on the next analysis without manual intervention?
• Does this truststore modification affect the validation of SSL certificates for all future plugin updates, or is it limited to the current analysis?
• Is there a SonarQube configuration option (currently undocumented) that can instruct the server to ignore SSL validation errors for plugin URLs?