Troubleshooting the Fortify ScanCentral SAST task

Unable to open the FPR file in the email notification from Fortify ScanCentral SAST

You can use Postman or cURL (available on Windows 10) to download the FPR or log file mentioned in the email notification from Fortify ScanCentral SAST.

To use Postman to download the FPR or log file:

  1. Copy the URL for the FPR or the log file from the notification email.

  2. Paste the URL in the Postman URL text field and then add fortify-client in the HTTP header.

  3. Click Send and Download.

  4. Save the file.

Unsupported class version error

If Fortify ScanCentral SAST client is run with an unsupported Java version (see Requirements for the Fortify ScanCentral SAST Task), the following message appears in the log file:

java.lang.UnsupportedClassVersionError: com/fortify/scancentral/launcher/Launcher has been compiled by 
a more recent version of the Java Runtime...

If you are using Fortify ScanCentral SAST client version 22.2.0 and later, set the SCANCENTRAL_JAVA_HOME environment variable to point to the supported Java version. Alternatively, make sure that the correct Java version is installed on the agent. If multiple Java versions are available on the agent, make sure the pipeline that runs the Fortify ScanCentral SAST task has PATH or JAVA_HOME environment variables that point to the supported Java version.

Failure with a self-signed certificate error

You are connecting to Fortify ScanCentral SAST Controller or Fortify Software Security Center using SSL with a self-signed or untrusted certificate. Add the certificate to to both the agent certificate store and the Java keystore (see Requirements for the Fortify ScanCentral SAST Task).