Configure Nexus 2 for https

Question

We have installed and successfully working instance of Nexus Manager 2 with configured proxy to http://repo1.maven.org/maven2/ but starting from 15/01/2020 Central Maven repo denied access via HTTP protocol. We reconfigured nexus proxy repo to use https://repo1.maven.org/maven2/ but now we get error fetching dependency from repo:

jvm 1    | 2020-02-03 14:58:14 WARN  [pool-1-thread-1] - com.sonatype.nexus.plugins.healthcheck.task.HealthCheckTask - Scheduled task (Health Check: central) failed :: Health Check Management for Repository central (started 2020-02-03T14:58:13+02:00, runtime 0:00:00.438)
jvm 1    | javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
jvm 1    |  at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:421) ~[na:1.7.0_80]
jvm 1    |  at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:628) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.conn.DefaultClientConnectionOperator.updateSecureConnection(DefaultClientConnectionOperator.java:232) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.conn.AbstractPoolEntry.layerProtocol(AbstractPoolEntry.java:279) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.conn.AbstractPooledConnAdapter.layerProtocol(AbstractPooledConnAdapter.java:146) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.client.DefaultRequestDirector.establishRoute(DefaultRequestDirector.java:837) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:644) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:479) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:784) ~[httpclient-4.2.2.jar:4.2.2]
jvm 1    |  at com.sonatype.nexus.plugins.healthcheck.service.impl.InsightServiceImpl.doGet(InsightServiceImpl.java:321) ~[na:na]
jvm 1    |  at com.sonatype.nexus.plugins.healthcheck.service.impl.InsightServiceImpl.getNextRunDeltas(InsightServiceImpl.java:118) ~[na:na]
jvm 1    |  at com.sonatype.nexus.plugins.healthcheck.task.HealthCheckTask.doDeltaCheck(HealthCheckTask.java:411) ~[na:na]
jvm 1    |  at com.sonatype.nexus.plugins.healthcheck.task.HealthCheckTask.doRunSafe(HealthCheckTask.java:177) ~[na:na]
jvm 1    |  at com.sonatype.nexus.plugins.healthcheck.task.HealthCheckTask.doRun(HealthCheckTask.java:132) ~[na:na]
jvm 1    |  at org.sonatype.nexus.scheduling.AbstractNexusTask.call(AbstractNexusTask.java:166) ~[nexus-app-2.3.1-01.jar:2.3.1-01]
jvm 1    |  at org.sonatype.scheduling.DefaultScheduledTask.call(DefaultScheduledTask.java:459) [sisu-task-scheduler-1.7.jar:na]
jvm 1    |  at java.util.concurrent.FutureTask.run(FutureTask.java:262) [na:1.7.0_80]
jvm 1    |  at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:178) [na:1.7.0_80]
jvm 1    |  at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:292) [na:1.7.0_80]
jvm 1    |  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_80]
jvm 1    |  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_80]
jvm 1    |  at java.lang.Thread.run(Thread.java:745) [na:1.7.0_80]
jvm 1    | 2020-02-03 14:58:48 INFO  [.jenkins-ci.org] - org.sonatype.nexus.proxy.registry.DefaultRepositoryRegistry-repo.jenkins-ci.org - Next attempt to auto-unblock the "repo.jenkins-ci.org" (id=repo.jenkins-ci.org) repository by checking its remote peer health will occur in 1 minute 20 seconds.

What could be a reason of this?

Answer 1

While not always needed https://issues.sonatype.org/browse/NEXUS-5524 leads me to believe you may need to trust the certificate in the https version of repo1.maven.org. See https://help.sonatype.com/display/NXRM2/Managing+Outbound+SSL+Certificates for more details. If that doesn't help, you might check if you have a firewall or something of that nature blocking this new URL (e.g. can you go to it in a web browser or make downloads from it not through NXRM).

As an aside, based around your reply to one of the comments if you are using Java 7, it's likely you're on an older version (https://help.sonatype.com/display/NXRM2/System+Requirements#SystemRequirements-Java) and upgrading may help. Sonatype recommends strongly using the latest version to avoid debugging problems with older versions that may be solved, and at minimum running a version less than a year old. In the above link, you'll note all the versions less than a year old won't boot using Java 7.