Zystkmt

I am not a java guy but we use Nexus for our NPM and Nuget packages and want to start using it to host Docker images as well but I cant seem to get SSL working using their guide. I am using version 3.14

I have generated the keystore and verified it works using:

keytool -printcert -sslserver localhost:8444 -v

My nexus.properties file contains

ssl.etc=${karaf.data}/etc/ssl

application-port-ssl=8444

nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-http.xml,${jetty.etc}/jetty-requestlog.xml,${jetty.etc}/jetty-https.xml

I have tried to update the local_policy.jar and US_export_policy.jar, tried updating the JRE and I still just get

ERR_SSL_VERSION_OR_CIPHER_MISMATCH from chrome when I try the browser or TLS Handshake failed with Docker trying to login.

Since you are generating your keystore, make sure you use the following general advice.

• Use AES or RSA (not DSA or DES) for your key algorithm


• Use 2048 bits (or larger. go for 4096)


• Use a strong signature algorithm, such as SHA256 or SHA512 (not SHA, SHA1, MD5)


• Keystore type should be PKCS12 or JKS (for Java KeyStore)

If you use DSA or DES you will not be able to connect.
If you use too low of a bitsize you will not be able to connect.
If you use a poor signature algorithm, you will not be able to connect.

See https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html for examples on generating a keystore using either keytool or openssl.

I found the issue. It was in how I was generating the keystore. I was using a .pfx exported cert from windows and had tried to split it into separate parts before importing to the keystore.

Once I just tried to import the pfx cert containing the private key as well, it worked. It was just appearing to work since the test

keytool -printcert -sslserver localhost:8444 -v

was returning the cert error free.