Problems using Maven and SSL behind proxy

Question

The answer above is a good working solution, but here's how to do it if you want to use the SSL repo:

• Use a browser (I used IE) to go to https://repo.maven.apache.org/
  • Click on lock icon and choose "View Certificate"
  • Go to the "Details" tab and choose "Save to File"
  • Choose type "Base 64 X.509 (.CER)" and save it somewhere

• Now open a command prompt and type (use your own paths):

  keytool -import -file C:\temp\mavenCert.cer -keystore C:\temp\mavenKeystore

• Now you can run the command again with the parameter

  -Djavax.net.ssl.trustStore=C:\temp\mavenKeystore

• Under linux use absolute path

  -Djavax.net.ssl.trustStore=/tmp/mavenKeystore

  otherwise this will happen

• Like this:

  mvn archetype:generate -DgroupId=com.mycompany.app -DartifactId=my-app -DarchetypeArtifactId=maven-archetype-quickstart -DinteractiveMode=false -Djavax.net.ssl.trustStore=C:\temp\mavenKeystore

Optional:

You can use the MAVEN_OPTS environment variable so you don't have to worry about it again. See more info on the MAVEN_OPTS variable here:

The fact is that your maven plugin try to connect to an https remote repository
(e.g https://repo.maven.apache.org/maven2/)

This is a new SSL connectivity for Maven Central was made available in august, 2014 !

So please, can you verify that your settings.xml has the correct configuration.

    <settings>
  <activeProfiles>
    <!--make the profile active all the time -->
    <activeProfile>securecentral</activeProfile>
  </activeProfiles>
  <profiles>
    <profile>
      <id>securecentral</id>
      <!--Override the repository (and pluginRepository) "central" from the
         Maven Super POM -->
      <repositories>
        <repository>
          <id>central</id>
          <url>http://repo1.maven.org/maven2</url>
          <releases>
            <enabled>true</enabled>
          </releases>
        </repository>
      </repositories>
      <pluginRepositories>
        <pluginRepository>
          <id>central</id>
          <url>http://repo1.maven.org/maven2</url>
          <releases>
            <enabled>true</enabled>
          </releases>
        </pluginRepository>
      </pluginRepositories>
    </profile>
  </profiles>
</settings>

You can alternatively use the simple http maven repository like this

 <pluginRepositories>
    <pluginRepository>
      <id>central</id>
      <name>Maven Plugin Repository</name>
      <url>http://repo1.maven.org/maven2</url>
      <layout>default</layout>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
      <releases>
        <updatePolicy>never</updatePolicy>
      </releases>
    </pluginRepository>
  </pluginRepositories>

Please let me know if my solution works ;)

J.

You can use the -Dmaven.wagon.http.ssl.insecure=true option

Update

I just stumbled on this bug report:

https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/1396760

It appears to be the cause of our problems here. Something with ca-certificates-java encountering an error and not fully populating cacerts. For me, this started happening after I upgraded to 15.10 and this bug probably occurred during that process.

The workaround is to execute the following command:

sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure

If you check the contents of the keystore (as in my original answer), you'll now see a whole bunch more, including the needed DigiCert Global Root CA.

If you went through the process in my original answer, you can clean up the key we added by running this command (assuming you did not specify a different alias):

sudo keytool -delete -alias mykey -keystore /etc/ssl/certs/java/cacerts

Maven will now work fine.

---

Original Answer

I'd just like to expand on Andy's answer about adding the certificate and specifying a keystore. That got me started, and combined with information elsewhere I was able to understand the problem and find another (better?) solution.

Andy's answer specifies a new keystore with the Maven cert specifically. Here, I'm going a bit more broad and adding the root certificate to the default java truststore. This allows me to use mvn (and other java stuff) without specifying a keystore.

For reference my OS is Ubuntu 15.10 with Maven 3.3.3.

Basically, the default java truststore in this setup does not trust the root certificate of the Maven repo (DigiCert Global Root CA), so it needs to be added.

I found it here and downloaded:

https://www.digicert.com/digicert-root-certificates.htm

Then I found the default truststore location, which resides here:

/etc/ssl/certs/java/cacerts

You can see what certs are currently in there by running this command:

keytool -list -keystore /etc/ssl/certs/java/cacerts

When prompted, the default keystore password is "changeit" (but nobody ever does).

In my setup, the fingerprint of "DigiCert Global Root CA" did not exist (DigiCert calls it "thumbprint" in the link above). So here's how to add it:

sudo keytool -import -file DigiCertGlobalRootCA.crt -keystore /etc/ssl/certs/java/cacerts

This should prompt if you trust the cert, say yes.

Use keytool -list again to verify that the key exists. I didn't bother to specify an alias (-alias), so it ended up like this:

mykey, Dec 2, 2015, trustedCertEntry, Certificate fingerprint (SHA1): A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36

Then I was able to run mvn commands as normal, no need to specify keystore.

You can import the SSL cert manually and just add it to the keystore.

For linux users,

Syntax:

keytool -trustcacerts -keystore /jre/lib/security/cacerts -storepass changeit -importcert -alias nexus -file

Example :

keytool -trustcacerts -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_144.jdk/Contents/Home/jre/lib/security/cacerts -storepass changeit -importcert -alias nexus -file ~/Downloads/abc.com-ssl.crt

I actually had the same problem.

when I run

mvn clean package

on my maven project, I get this certificate error by the maven tool.

I followed @Andy 's Answer till the point where I downloaded the .cer file

after that the rest of the answer didn't work for me but I did the following(I am running on Linux Debian machine)

first of all, run:

keytool -list -keystore "Java path+"/jre/lib/security/cacerts""

for example in my case it is:

keytool -list -keystore /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/security/cacerts

if it asks about the password, just hit enter.

this command is supposed to list all the ssl certificates accepted by the java. when I ran this command, in my case I got 93 certificates for example.

Now add the downloaded file .cer to the cacerts file by running the following command:

sudo keytool -importcert -file /home/hal/Public/certificate_file_downloaded.cer -keystore /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/security/cacerts

write your sudo password then it will ask you about the keystore password

the default one is changeit

then say y that you trust this certificate.

if you run the command

keytool -list -keystore /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/security/cacerts

once again, in my case, I got 94 contents of the cacerts file

it means, it was added successfully.