1. Identify the Endpoint

Determine if your script calls:

https://<core-server-host>/codeinsight/restApi/...

2. Export the SSL Certificate Chain

1. Open the Code Insight URL in a browser (such as Chrome).
2. Click the lock icon → Certificate → Details → Export.
   
   

   

   

   

3. Export Base-64 encoded X.509 (.CER or .PEM) file.

NOTE: In the screenshots above, we only had the server certificate.

In case you have a chain of certificates, export all certificates, including any server, intermediate, and root certificates.

3. Create a PEM Bundle

1. Combine all certificates into one file in this order:

   -----BEGIN CERTIFICATE-----  (Server/leaf cert)
   ...
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----  (Intermediate CA #1)
   ...
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----  (Intermediate CA #2)
   ...
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----  (Root CA)
   ...
   -----END CERTIFICATE-----

2. Save the file as fnci_chain.pem.

4. Configure Scripting Language (Like Python) to Trust the Certificate

Choose one method:

Option A: Environment Variable (Recommended)

Set REQUESTS_CA_BUNDLE:

1. Windows:
   1. Press Win + R → type sysdm.cpl → Enter.
   2. Advanced tab → Environment Variables → New.
      1. Name: REQUESTS_CA_BUNDLE
      2. Value: C:\path\to\fnci_chain.pem
   3. Restart terminal/IDE.

Option B: Per-Script

import requests
url = "https://<fnci-endpoint>/codeinsight/api/health"
r = requests.get(url, verify="C:/path/to/fnci_chain.pem")
print(r.status_code, r.text[:200])

Solution for Report Resgistration SSL Error

A. Install pip-system-certs

This package makes Python use the system certificate store automatically:

pip install pip-system-certs

B. Import Certificates into certifi

1. Ensure certifi is installed
   

   pip install certifi

2. Locate cacert.pem:
   

   C:\Python38\Lib\site-packages\certifi\cacert.pem

3. Export Code Insight certificate chain from browser using steps listed above.
4. Open cacert.pem and append the certificate contents at the end.
5. Save and retry report registration.

Important Notes

• You can also use verify=False (disables SSL verification, insecure).
• If certificate changes (renewal/replacement), repeat steps.

FAQ

Q: Do I need scan server certificates?
A: No, unless your script connects to them directly.

Q: What if hostname mismatch occurs?
A: Use the URL matching the certificate SAN or reissue cert with correct SANs.

Q: What about corporate SSL inspection?
A: Trust the proxy’s root CA in Python.

Q: Does this work for mTLS?
A: Yes, but you must also provide client cert/key in requests.

Run:

import requests
r = requests.get("https://<fnci-endpoint>/codeinsight/api/health", timeout=10,
                 verify="C:/path/to/fnci_chain.pem")
print(r.status_code)

Expected: 200 OK

Sample Code Snippet

import requests

url = "https://<fnci-endpoint>/codeinsight/api/projects"
headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers, verify="C:/path/to/fnci_chain.pem")
print(response.status_code)
print(response.json())

Other languages may show different error messages like javax.net.ssl.SSLHandshakeException (Java) or certificate verify failed (curl).