Troubleshooting

Last updated: Oct 27, 2026

If your problem is not on this page, contact the Fluid Attacks support team at [email protected].

SSL Handshake failure — Plugin cannot connect to the platform

Symptoms

The plugin cannot validate the API token and shows a connection error. The plugin does not load vulnerabilities. This error appears in the IDE logs (Help > Show Log in Explorer/Finder):

ApolloNetworkException: Failed to execute GraphQL http network request
Caused by: javax.net.ssl.SSLHandshakeException: (certificate_unknown)
PKIX path building failed: unable to find valid certification path to requested target

What this error is NOT

This is not a problem with the API token, the plugin logic, or the Fluid Attacks platform. The error occurs at the network layer, before the plugin sends data.

Cause

A corporate HTTPS proxy with SSL inspection (for example, Zscaler, Netskope, or Forcepoint) causes the error. The proxy intercepts the connection between IntelliJ and app.fluidattacks.com.

When SSL inspection is active, the proxy replaces the original certificate of the server. The new certificate has the signature of the Certificate Authority (CA) of the organization. IntelliJ uses a JVM (Java Virtual Machine) with its own certificate trust store (cacerts). This store is different from the certificate store of the operating system. If the cacerts of the JVM does not have the root CA certificate of the corporate proxy, the JVM rejects the connection.

# Current behavior (connection rejected)
IntelliJ (JVM) → Proxy (intercepts and re-signs certificate) → app.fluidattacks.com
                    ↑
    JVM does not recognize the proxy's CA → connection blocked

# Expected behavior
IntelliJ (JVM) → Proxy (passthrough, no interception) → app.fluidattacks.com
                    ↑
    JVM receives the original certificate from a public CA → connection accepted

Solution — Add an SSL inspection bypass for the Fluid Attacks domain

The network administrator must add an SSL inspection bypass (exclusion) for this domain in the corporate proxy:

app.fluidattacks.com

With this bypass, the proxy sends the HTTPS traffic to this domain with no interception and no new signature. Then, the JVM receives the original certificate from a trusted public CA, and the connection works for all users automatically.

This type of bypass is a standard practice for trusted SaaS and security vendors. All the important proxy solutions (Zscaler, Netskope, Forcepoint, and others) support it. The administrator applies it one time from the central console, and no changes on the individual machines are necessary.

Another option is manual certificate import

As an alternative, you can import the certificate of the corporate proxy manually into the cacerts of the JVM. But this alternative breaks easily and does not scale:

• IntelliJ includes its own JBR (JetBrains Runtime). The cacerts path of the JBR is different from the system JVM and can change with IDE updates.
• You must have administrator access. Also, you must do the import again on each user machine and after each IntelliJ update.
• If the corporate proxy changes its CA certificate, you must do all the imports again.

Fluid Attacks recommends the SSL bypass, because it is centralized and permanent, and no changes on individual machines are necessary.

User-side workaround

If the network administrator cannot configure the SSL bypass immediately, users can apply these options in this order.

Quick option — Use the operating system truststore

You can configure IntelliJ to trust the certificates of the operating system, and not import certificates manually:

1. Go to Help → Edit Custom VM Options.

2. Add this line for your operating system:

   macOS:

   -Djavax.net.ssl.trustStoreType=KeychainStore

   Windows:

   -Djavax.net.ssl.trustStoreType=Windows-ROOT

3. Restart IntelliJ.

If the error continues, do the manual import below.

Manual import option — Obtain the corporate CA certificate

Your IT team can give you the root certificate of the corporate CA (a .crt, .cer, or .pem file). Usually, this certificate is installed in the operating system.

Option A — Export from the operating system

Windows:

1. Open certmgr.msc (Certificate Manager).
2. Go to Trusted Root Certification Authorities → Certificates.
3. Find the corporate certificate (it usually has the company name).
4. Right-click → All Tasks → Export → select Base-64 encoded X.509 (.CER).
5. Save the file as corporate-ca.crt.

macOS:

# Export corporate CAs from the system keychain
security find-certificate -a -p /Library/Keychains/System.keychain > corporate-ca.pem

As an alternative, follow these steps:

1. Open Keychain Access.
2. Find the corporate certificate.
3. Export it as .pem.

Option B — Export from the browser

1. In a browser, go to app.fluidattacks.com.
2. Click the padlock in the address bar → Certificate → Details.
3. Select the root certificate (the top entry in the chain).
4. Export as Base-64 encoded X.509.

Step 1 — Locate the JRE used by IntelliJ

IntelliJ includes its own JBR (JetBrains Runtime). The truststore path is different for each operating system:

To find the active JRE, go to Help → Find Action → "Choose Boot Java Runtime".

Step 2 — Import the certificate into the JRE truststore

The JRE includes keytool. Thus, no installation is necessary.

macOS / Linux:

# sudo required if the directory is read-only
sudo keytool -import \
  -alias corporate-ca \
  -keystore "/Applications/IntelliJ IDEA.app/Contents/jbr/lib/security/cacerts" \
  -file /path/to/corporate-ca.crt \
  -storepass changeit \
  -noprompt

Windows (cmd run as Administrator):

keytool -import ^
  -alias corporate-ca ^
  -keystore "C:\Program Files\JetBrains\IntelliJ IDEA <version>\jbr\lib\security\cacerts" ^
  -file C:\path\to\corporate-ca.crt ^
  -storepass changeit ^
  -noprompt

The default truststore password is changeit.

To make sure that the import is correct, use this command:

keytool -list -keystore <cacerts_path> -storepass changeit | grep corporate-ca

Step 3 — Restart IntelliJ

Close IntelliJ fully and open it again to apply the changes.