I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-step. I'm not TLS expert, so please bear with me.
I'm using ketyool on a Nexus3:3.30.0 container to generate .jks and .pem file. Container is hosted on a RHEL8 workstation.
The .jks and .pem files are generated under /ops/sonatype/nexus/etc/ssl and I use the following commands:
keytool -genkeypair -alias <alias-goes-here> -keyalg RSA -keysize 2048 -validity 365 -keystore <name of file here>.jks
I answer the following questions:
first and last name - name of internal CA here
org unit - name of org unit here
org - name of company here
city - name of city here
state - name of state here
country code - name of country here
I validate the .jks file with the following command: keytool -list -v -keystore <name of jks file here.jks
I generate the .pem file with the following command:
keytool -certreq -alias <alias here> -file <name of pem here>.pem -keystore <name of jks file here>.jks ext 'SAN=DNS entries here'
The .pem file is then sent to an internal Microsoft Active Directory Certificate Services, to submit a certificate request. I paste the output into the Save Request Field, From Certificate Template, from the drop down Web Server and click submit.
I get a .p7b file, from there I go thru a process of extracting the root, intermediate and server certificate, along with giving them a meaningful names, for example root-server.cer, so it makes it easier to keep track of what cert is what.
I move these .cer files back to to the container and import them in the following order: root, intermediate and then server. Using the following commands:
keytool -importcert -file root-cert.cer -keystore <name of jks file>.jks -alias root-cert
keytool -importcert -file intermediate-cert.cer -keystore <name of jks file>.jks -alias intermediate-cert
keytool -importcert -file server-cert.cer -keystore <name of jks file>.jks -alias server-cert
I confirm that all certs have been imported into the keystore with the following command: keytool -list -v -keystore <name of jks file>.jks
I go thru a few configuration of the Nexus container itself to prepare it for HTTPS. Once done, I restart the container and refresh the browser and the UI comes back up as HTTPS. However the Icon Lock in the browser shows Connection is Not Secure.
Upon further investigation with command line tools like curl and openssl, I've determine that something has gone wrong.
This is the output of the curl command I use against the container:
[user_a@host_a tmp]$ curl -l -v https://10.88.0.214:8082
* Rebuilt URL to: https://10.88.0.214:8082/
* Trying 10.88.0.214...
* TCP_NODELAY set
* Connected to 10.88.0.214 (10.88.0.214) port 8082 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Any of the openssl commands that I used, for example:
openssl s_client --connect <ip address here:port number here> --showcerts
Any of the output shows
Verification error: self signed certificate
Why is this showing this? The certificate is not self-signed as it went to an internal CA, which lives on a Windows server. Or should this even matter?
Are there are other commands that I can run to help troubleshoot, to get more info?
Is there something that I need to do since I'm moving from a Linux based container to an internal Windows CA?
Am I missing any steps in this process?
thanks in advance
openssl version -a
. curl depends based on the TLS backend it uses (it supports a lot) ... You can check on Linux withstrace -e stat openssl ..
where it looks for files including where it looks for CA certificates.