我按照此页面 导入服务器证书。
当我使用keytool -list时，我可以看到证书实际上位于密钥库中。如果我尝试导入 .crt 文件，keytool 会警告我密钥库已包含证书。
然后我使用两个 ssl 选项更新了 wrapper.conf。重启后我可以在 Nexus 进程的命令行上看到它们。
但是，当我尝试为远程服务器添加代理存储库时，我总是收到 sun.security.validator.ValidatorException: PKIX path build failed: sun.security.provider.certpath.SunCertPathBuilderException:无法找到有效的证书路径请求的目标
我错过了什么？
I followed the instructions given on this page to import the server certificate.
When I use keytool -list, I can see that the certificate is actually in the keystore. If I try to import the .crt file, keytool warns me that the keystore already contains the certificate.
Then I updated wrapper.conf with the two ssl options. I can see them on the command line of the Nexus process after a restart.
But when I try to add a proxy repo for the remote server, I always get sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
What did I miss?
发布评论
评论（2）
您必须将自定义 CA 证书导入“trustStore”而不是“keyStore”。
创建“trustStore”的过程与“keyStore”的过程相同。
获得 *.jks 文件后，请使用以下系统属性链接它：
You have to import the custom CA certificate into the 'trustStore' and not into the 'keyStore'.
The procedure for creating a 'trustStore' is the same as the one for the 'keyStore'.
Once you have your *.jks file then link it using the following system properties:
错误消息意味着 JVM 无法正确验证远程服务器的 SSL 证书。如果远程服务器使用自签名证书而不是由官方证书颁发机构（如 verisign）签名的证书，则非常常见。
你的消息令人困惑。您已在 Nexus 实例上启用了 SSL，但是您谈论的代理存储库暗示问题 SSL 证书可能位于另一台服务器上。
Error message means the JVM cannot properly authenticate the remote server's SSL cert. Very common if the remote server is using a self-signed cert instead of one signed by an official certificate authority (like verisign).
Your message is confusing. You've enabled SSL on your Nexus instance, however you talk about a proxy repo implying the problem SSL cert might be on another server.