Addressing SSL trust issues between Maven and Nexus in OpenShift Dev Spaces

3 min readDec 23, 2024

Configuring Maven to connect securely to an SSL-enabled Nexus repository in OpenShift Dev Spaces can present significant challenges, especially when custom Certificate Authorities (CAs) are involved. This guide outlines the steps to configure Maven to trust and communicate with an SSL-enabled Nexus repository that uses a custom CA certificate, resolving common trust issues in an OpenShift Dev Spaces environment.

The challenge

When running Maven in an OpenShift Dev Spaces workspace pod, it must trust the custom SSL certificate of the Nexus repository. However, Java’s truststore requirements can prevent the recognition of these certificates, often leading to the error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. This issue can occur even if the certificates are placed in common locations such as /etc/pki/tls.

The following steps detail how to resolve the issue:

Step 1: Export the Nexus SSL certificate chain

Export the full certificate chain from your Nexus repository, ensuring it contains all the necessary trusted certificates. Save this chain as a .pem file for by leveraging open_ssl and awk commands as given below.

# output the entire chain of certificates presented by Nexus server into cert_chain.pem
openssl s_client -showcerts -connect nexus.custom.domain:443 </dev/null > nexus_cert_chain.pem

# split the chain into root, intermediate and server certificate
awk 'BEGIN {certcount=0} /-----BEGIN CERTIFICATE-----/ {certcount++} {print > "cert" certcount ".pem"} /-----END CERTIFICATE-----/' nexus_cert_chain.pem

# combine all certs into a single pem file
cat cert1.pem cert2.pem cert3.pem > nexus_full_chain.pem

Step 2: Convert the certificate chain to a Java Keystore

Using the keytool utility, convert the .pem file into a Java Keystore (JKS) file. The command below demonstrates the process:

keytool -import -trustcacerts -file nexus_full_chain.pem -keystore nexus.jks -storepass changeit

Replace changeit with a secure password for the keystore.

Step 3: Create Kubernetes ConfigMaps

To make the keystore and configuration files accessible in the OpenShift Dev Spaces workspace, create the following ConfigMaps:

maven-nexus-truststore- This ConfigMap will enable the automatic mounting of the JKS file containing the trusted certificates into each of the workspaces at the location /home/user/nexus.jks.

oc create configmap maven-nexus-truststore -n devspaces \
  --from-file=nexus.jks=nexus.jks

oc label configmap maven-nexus-truststore \
  app.kubernetes.io/component=workspaces-config \
  app.kubernetes.io/part-of=che.eclipse.org -n devspaces

oc annotate configmap maven-nexus-truststore \
  controller.devfile.io/mount-as=subpath \
  controller.devfile.io/mount-path=/home/user -n devspaces

Validate that executing these oc commands results in a ConfigMap as given below.

kind: ConfigMap
apiVersion: v1
metadata:
  name: maven-nexus-truststore
  namespace: devspaces # namespace where Dev Spaces is installed
  labels:
    app.kubernetes.io/component: workspaces-config
    app.kubernetes.io/part-of: che.eclipse.org
  annotations:
    controller.devfile.io/mount-as: subpath
    controller.devfile.io/mount-path: /home/user
binaryData:
  nexus.jks: <base64-encoded-binary-file-data-of-jks>

maven-settings-config- This ConfigMap will provide Maven in each user workspaces with a custom settings.xml file under the location/home/user/.m2 — pre-configured to interact with the Nexus repository.

kind: ConfigMap
apiVersion: v1
metadata:
  name: maven-settings-config
  namespace: devspaces
  labels:
    app.kubernetes.io/component: workspaces-config
    app.kubernetes.io/part-of: che.eclipse.org
  annotations:
    controller.devfile.io/mount-as: subpath
    controller.devfile.io/mount-path: /home/user/.m2
data:
  settings.xml: |
    <settings>
      <mirrors>
        <mirror>
          <id>nexus</id>
          <name>Nexus Mirror</name>
          <url>https://nexus.custom.domain/repository/maven-central/</url>
          <mirrorOf>*</mirrorOf>
        </mirror>
      </mirrors>
      <servers>
        <server>
          <id>nexus</id>
        </server>
      </servers>
    </settings>

maven-nexus-truststore-env- This ConfigMap will set the environment variable needed to direct Maven to use the custom keystore that’s been auto-mounted by the aforementioned ConfigMaps.

kind: ConfigMap
apiVersion: v1
metadata:
  name: maven-nexus-truststore-env
  namespace: devspaces
  labels:
    app.kubernetes.io/component: workspaces-config
    app.kubernetes.io/part-of: che.eclipse.org
  annotations:
    controller.devfile.io/mount-as: env
immutable: false
data:
  MAVEN_OPTS: '-Djavax.net.ssl.trustStore=/home/user/nexus.jks -Djavax.net.ssl.trustStorePassword=changeit'

The MAVEN_OPTS environment variable set in the maven-nexus-truststore-env ConfigMap specifies the following JVM options:

-Djavax.net.ssl.trustStore=/home/user/nexus.jks: Points Maven to the mounted truststore file.
-Djavax.net.ssl.trustStorePassword=changeit: Provides the truststore password. Replace changeit with the password used during keystore creation.

Ensuring success

By implementing these steps, Maven within the workspace pods in OpenShift Dev Spaces will be properly configured to establish secure connections with the defined SSL-enabled Nexus repository — by eliminating connectivity issues and enabling efficient project builds and deployments.