All of the dependency-check clients (CLI, Maven, Gradle, Ant, Jenkins) can be configured to use a proxy to connect to the Internet. See the configuration settings for each:
Note, it may also be possible to use the core Java proxy system properties instead of the configuration above.
In some cases if you setup a proxy the connection may still fail due to certificate errors (see the log file from dependency-check). If you know which cert it’s failing on (either your proxy or NVD/CVE) you can either add the certificate itself or the signing chain to your trust store. If you don’t have access to modify the system trust store (in $JAVA_HOME/lib/security/cacerts) you can copy it elsewhere and import it using keytool, then specify that trust store on the command line (mvn -Djavax.net.ssl.trustStore=/path/to/cacerts) or if you need to always have that set, you can set the environment variable JAVA_TOOL_OPTIONS to have -Djavax.net.ssl.trustStore=/path/to/cacerts.
In some cases the proxy is configured to block HEAD requests. While an attempt is made by dependency-check to identify this situation it does not appear to be 100% successful. As such, the last thing to try is to add the property mvn -Ddownloader.quick.query.timestamp=false.
If trying the above and it still fails please open a ticket in the github repo.
