CXFLW-1236 added code for custom keystore feature (#1376)

Co-authored-by: Satyam Chaurasia <[email protected]>
checkmarx-ltd · Jul 26, 2024 · b7fb0aa · b7fb0aa
1 parent bcbc60a
commit b7fb0aa
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 1 deletion.
diff --git a/build.gradle b/build.gradle
@@ -2,7 +2,7 @@ import org.gradle.api.tasks.testing.Test
 
 buildscript {
     ext {
-        CxSBSDK = "0.6.9"
+        CxSBSDK = "0.6.10"
         ConfigProviderVersion = '1.0.14'
         //cxVersion = "8.90.5"
         springBootVersion = '3.2.5'

diff --git a/docs/Configuration.md b/docs/Configuration.md
@@ -611,6 +611,9 @@ For more details on break build, please refer to [Thresholds and policies](https
 | `cxflow.enabledVulnerabilityScanners`  | false                 | No                                  | Yes     | Yes               | User can define which checkmarx tool they want to use like SAST, SCA or both.                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `checkmarx.considerScanningStatus`     | false                 | No                                  | Yes     | Yes               | By default, Checkmarx only includes completed scans (finished status) in incremental scans. This means it ignores scans that are currently running (scanning) or waiting to be processed (new queue). Enabling a feature this variable "cxflow" expands what incremental scans consider. With cxflow, scans in progress and those queued up are also taken into account, providing a more comprehensive view of your code's security posture.                                           |
 | `enabled-zip-scan`                     | false                 | No                                  | Yes     | Yes               | When `enabled-zip-scan` is set to `true` then cx-flow will first clone the repository locally, and then it will zip the repository and send it for scanning.                                                                                                                                                                                                                                                                                                                            |
+| `truststorepath`                     | false                 | No                                  | Yes     | Yes               | User need to provide path of custom keystore along with file name.                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `truststorepassword`                     | false                 | No                                  | Yes     | Yes               | User need to provide custom keystore password.                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `customkeystore`                     | false                 | No                                  | Yes     | Yes               | When `customkeystore` is set to `true` then cx-flow will consider custom keystore.                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `trustcerts`                     | false                 | No                                  | Yes     | Yes               | If this option is true Cx-flow will bypass SSL. Default value is false so it will not bypass SSL.                                                                                                                                                                                                                                                                                                                                                                                       |
 No* = Default is applied
 

diff --git a/docs/Proxy-and-HTTPS-Configuration.md b/docs/Proxy-and-HTTPS-Configuration.md
@@ -99,4 +99,24 @@ Insert the following into the application.yml file
     - TLSv1.3
     - TLSv1.2
 ```
+# Using Custom KeyStore
 
+To allow CXFlow to accept custom enterprise certificates without altering the default cacert, you can configure it to trust additional certificates by adding them to a custom trust store.<br>See documentation on importing certificates here:
+
+## Step 1 : Create Custom KeyStore
+```
+keytool -importcert -file <path-to-your-certificate> -keystore custom-truststore.jks -alias <your-alias>
+
+```
+
+## Step 2 : Define Key store file path,Key Store password and enable custom keystore
+
+```
+checkmarx:
+  version: 9.4
+  username: admin@cx
+  truststorepath: C:\\Users\\abc\\OneDrive - Checkmarx\\Desktop\\certificate\\custom-truststore1.jks
+  truststorepassword: satyam
+  customkeystore: true
+
+```