title: How to install CA certificate on Nexus 3?
body: <p>I have installed Nexus Repository Manager OSS 3.0.2-02 on my CentOS Linux release 7.4.1708.</p>
  
  <p>Also I have CA certificate:</p>
  
  <pre><code>Issued to: \*.mycompany.com  
  Issued by: Go Daddy Secure Certificate Authority - G2  
  Valid from 2016-11-12 to 2018-01-11
  </code></pre>
  
  <p>The RSA private key match with my CA certificate, which was checked with <a href="https://www.sslshopper.com/certificate-key-matcher.html" rel="nofollow noreferrer">Certificate Key Matcher</a> and reported: </p>
  
  <blockquote>
    <p>The certificate and private key match!</p>
  </blockquote>
  
  <p>In Nexus3 directory I made the following changes:</p>
  
  <p>Added to the file <code>org.sonatype.nexus.cfg</code> the lines:</p>
  
  <pre><code>nexus-args=${karaf.etc}/jetty.xml,${karaf.etc}/jetty-http.xml,${karaf.etc}/jetty-requestlog.xml,${karaf.etc}/jetty-https.xml     
  application-port-ssl=8443
  </code></pre>
  
  <p>Added to <code>jetty-https.xml</code> file next lines:</p>
  
  <pre><code>KeyStorePath /ssl/test.jks  
  KeyStorePassword 123456  
  KeyManagerPassword 123456  
  TrustStorePath ssl/test.jks  
  TrustStorePassword 123456
  </code></pre>
  
  <p>Created SSL directory in <code>$NEXUS_HOME/etc/</code> and created inside the SSL directory a Java keystore file <code>test.jks</code> with command:</p>
  
  <pre><code>openssl pkcs12 -export -in mycompany.com.pem -inkey key.pem -name xxx.mycompany.com -out test.pks
  keytool -importkeystore -deststorepass 123456 -destkeystore test.jks -srckeystore test.pks -srcstoretype PKCS12
  keytool -import -alias bundle -trustcacerts -file gd_bundle.crt -keystore test.jks
  </code></pre>
  
  <p>After Nexus restart I can't not reach it by URL <code>//xxx.mycompany.com:8443</code>. Firefox says: </p>
  
  <blockquote>
    <p>The page you are trying to view cannot be shown because the
    authenticity of the received data could not be verified</p>
  </blockquote>
  
  <p>Also trying to do: <code>docker login xxx.mycompany.com:8443</code> and providing default <code>admin:admin:123</code> credentials cause: </p>
  
  <blockquote>
    <p>Error response from daemon: Get xxx.mycompany.com:8443/v1/users/:
    x509: certificate signed by unknown authority</p>
  </blockquote>
  
  <p>I also try to chain certificates by various scenarions from Google, including <a href="https://stackoverflow.com/questions/16062072/how-to-add-certificate-chain-to-keystore">How to add certificate chain to keystore?</a>, but got error on Docker:</p>
  
  <blockquote>
    <p>Error response from daemon: Get //xxx.mycompany.com:8443/v1/users/: EOF</p>
  </blockquote>
  
  <p>on Firefox, the same as first time and on Chrome:</p>
  
  <blockquote>
    <p>//xxx.mycompany.com unexpectedly closed the connection</p>
  </blockquote>
  
  <p><strong>Question:</strong> Where is my mistake, or how to correctly install CA certificate on Nexus3?</p>