Troubleshooting
This page helps you resolve common issues related to GitHub integration, dependency and Software Bill of Materials (SBOM) generation, and data synchronization in DigiCert® Software Trust Manager.
If you encounter an error, find it in this document to understand what caused it and how to resolve it.
Integration and authorization issues
These errors occur during installation, setup, or authorization of the Software Trust Manager GitHub app.
Error
Request timed out Your request took too long to complete.
Cause
The request to GitHub or Software Trust Manager didn’t finish within the expected time. Common causes:
Temporary network connectivity issues
A slow or interrupted connection to GitHub
A slow or interrupted connection to GitHub
Solution
Refresh the page when your connection is stable.
Retry the GitHub integration flow.
If the issue persists:
Try your unique onboarding link, or
Contact your administrator or DigiCert Support if the problem continues.
Error
Service not supported This integration is limited to GitHub Organization accounts. GitHub Enterprise and personal GitHub accounts are not supported.
Cause
The Software Trust Manager GitHub app is restricted to GitHub Organization accounts. The error appears if you attempt to integrate:
A personal GitHub account, or
A GitHub Enterprise account that isn’t configured as a supported organization
Solution
Confirm that you’re signing in with a GitHub Organization account.
Switch to an organization that owns the repositories you want to integrate.
If you believe your organization should be supported, contact your administrator or DigiCert Support.
Error
Insufficient permissions You do not have permission to install GitHub apps for this organization.
Cause
Your GitHub user account doesn’t have permission to install or authorize GitHub apps for the selected organization. This typically means you aren’t an organization owner or have insufficient admin privileges.
Solution
Contact your GitHub organization administrator.
Ask them to either:
Grant you permission to install GitHub apps, or
Install the DigiCert Software Trust Manager GitHub app on your behalf.
After permissions are updated or the app is installed, restart the integration flow.
Error
404 Page not found
Cause
The page you attempted to access is no longer available or the URL is invalid.
This can occur if:
The integration session expired
A bookmarked or copied URL is outdated
The onboarding flow was interrupted
Solution
Try your unique onboarding link.
If the issue persists, return to a known page in Software Trust Manager.
Restart the GitHub integration from the Release security tab or Get started on the dashboard.
If the issue persists, contact your administrator or DigiCert Support if the issue persists.
Error
GitHub integration could not be completed Error code: 502 Bad gateway
Cause
This error indicates a temporary communication failure between DigiCert Software Trust Manager and GitHub during the integration process.
Common causes include:
A service interruption or network issue
The onboarding session timing out
The browser session being interrupted or refreshed
The integration flow being abandoned and later resumed without the correct link
Sugerencia
During the first step of configuring the Software Trust Manager GitHub app, you’re prompted to copy and save a unique onboarding URL. This URL is required to resume or retry the integration if the session is interrupted.
Solution
Find the Unique onboarding URL you copied during the initial integration step. This link allows you to resume the GitHub integration from where it stopped.
Open the onboarding URL in a new browser tab.
Retry the integration steps and finish the remaining configuration.
If you didn’t save the onboarding URL, you must restart the GitHub integration from the beginning in Software Trust Manager.
If the error persists after retrying, contact DigiCert Support and provide the error code (502 Bad gateway) for assistance.
Dependency and SBOM issues
These issues occur when generating or analyzing dependency and SBOM data.
Problem
Your project doesn’t contain a dependency lockfile, or SBOM results appear incomplete or inconsistent.
Cause
Without a dependency lockfile, dependency versions are resolved dynamically. Transitive dependencies may change between builds, resulting in:
Non-reproducible builds
Inconsistent dependency trees
Inaccurate or non-deterministic SBOM output
Solution
Create and maintain a dependency lockfile for your project.
Using a lockfile:
Locks dependencies to fixed, reproducible versions
Prevents unexpected changes from transitive updates
Stabilizes builds
Enables deterministic SBOM generation
Improves audit accuracy and compliance reporting
Commit the lockfile to version control and review changes before merging updates.
Problem
SBOM generation fails or produces incomplete results for a Gradle-based Java project.
Cause
A Gradle dependency lockfile hasn’t been generated. SBOM tools rely on fully resolved dependency data. Without a lockfile:
Dependency resolution may be incomplete
Transitive dependencies may be missing
Version selection may be non-deterministic
SBOM output may fail or be inaccurate
Solution
Generate a Gradle dependency lockfile before attempting SBOM generation.
Enable dependency locking In
build.gradle:dependencyLocking { lockAllConfigurations() }Enable a single lockfile per project in
settings.gradle:enableFeaturePreview("ONE_LOCKFILE_PER_PROJECT")To generate the lockfile, run:
gradle dependencies --write-locks
Sugerencia
This creates a
gradle.lockfilecontaining all resolved dependencies and their exact versions.To commit the lockfile, add the following file to version control:
gradle.lockfile
Sugerencia
The lockfile must be committed to ensure reproducible builds and consistent SBOM results across environments.
To update dependencies safely:
gradle dependencies --write-locks git diff gradle.lockfile
Sugerencia
Review all changes before merging.
This prevents accidental version upgrades and ensures:
A complete dependency tree
No missing transitive dependencies
Reproducible SBOM output
Data synchronization and visibility delays
These issues occur when data changes aren’t immediately visible due to background processing.
Problem
After connecting an organization, not all data is visible.
Cause
Initial data synchronization is still in progress.
Solution
Wait at least 3 minutes, then refresh the application.
Problem
A repository was added, removed, or updated, but changes aren’t visible.
Cause
Repository updates are processed asynchronously.
Solution
Wait at least 8 minutes, then refresh and check again.
Problem
You performed an action, but progress or results aren’t visible.
Cause
Background processing may still be in progress.
Solution
Wait at least 8 minutes, then check again.
Problem
Code analysis data doesn’t appear or appears outdated.
Cause
Code analysis results refresh on a scheduled interval.
Solution
Check again approximately 10 minutes past the next hour
Examples: 01:10, 02:10, 03:10
If results are still missing after one hour, contact DigiCert Support.
Problem
SBOM information isn’t visible or appears outdated.
Cause
SBOM data refreshes periodically on a scheduled interval.
Solution
Check again approximately 20 minutes past the next hour
Examples: 01:20, 02:20, 03:20
If data hasn’t updated after one hour, contact DigiCert Support.