Nexus repository SSL certificate expired

PKIX path building failed in Maven or x509: certificate has expired pulling from docker login usually traces to Nexus Repository Manager HTTPS—not your laptop clock.

Artifact pipelines fail searches for nexus ssl certificate expired when CI jobs cannot download dependencies from https://nexus.example.com or when Docker clients reject the registry connector certificate. Nexus embeds Jetty; TLS may terminate on Nexus itself or on nginx/HAProxy in front.

Release managers notice failures first in mvn deploy, gradle publish, npm install against private registries, and crane push to hosted Docker repositories. Browsers hitting the Nexus UI show the same notAfter if they share the listener.

Repository replication between Nexus nodes does not copy TLS keystores when each data center terminates locally—geo teams must renew per site or consolidate behind one global ingress. Signed-artifact policies mean expiry blocks downloads and promotion of cached artifacts, widening blast radius beyond the first failing pipeline.

Dependency confusion controls and firewall allowlists often assume “internal registry = trusted” without checking live notAfter—security architecture should pair network trust with certificate monitoring on repository DNS names.

When incident volume spikes, prioritize the hostname Gradle or Docker prints in the first failing line of CI output—that string is the TLS name clients validate, even if it differs from the friendly Nexus UI bookmark your team uses daily.

First response

Record failing coordinates (groupId/artifact, npm scope, Docker image path), the exact registry URL, and TLS error strings from CI logs. Identify whether users hit direct Jetty HTTPS or a reverse proxy path. Capture Jenkins/GitLab runner egress IP requirements for allowlists.

From outside the corporate network (or a CI-like environment), run OpenSSL against the hostname in .m2/settings.xml or .npmrc. Screenshot Nexus Administration → SSL certificate only after matching wire proof.

See Harbor registry SSL certificate expired when Harbor replaced part of the stack but old Nexus URLs remain in build files.

Gather identifiers from CI: failing job URL, artifact coordinates, and whether builds use repository manager anonymous access or service accounts. Nexus audit logs (log/nexus.log) may record Jetty handshake failures at DEBUG—enable briefly if openssl already proved expiry. Note firewall paths for air-gapped workers that cannot use desktop browser checks.

What this error means

Nexus presents one certificate per HTTPS connector unless a proxy terminates TLS first. Java tooling validates PKIX by default; expired leaves fail before repository authentication. Docker registry v2 and npm proxy repositories share the same Jetty connector certificate for a given port.

Self-signed internal CAs require importing trust into JVM cacerts or using custom truststore in Maven—expiry still applies to those CAs’ issued leaves. Let’s Encrypt renewals must update the keystore Nexus reads, not only files on an edge nginx host.

Raw repositories, Git LFS proxies, and PyPI mirrors hosted on the same Nexus instance inherit the connector certificate presented on their TCP ports—security scans that whitelist only 443 miss 5000 until Gradle fails on CI agents without browser extensions.

Build farms in multiple countries may resolve geo-balanced registry DNS to different certs if any regional node lags renewal—openssl from each CI region before closing the ticket. Anonymous read versus authenticated publish URLs sometimes differ; both need valid TLS for typical pipelines.

Stored Docker layer caches may hide registry TLS errors until a --no-cache pull runs—include one in post-fix validation. Tag the incident with which package ecosystems failed first—npm, Maven, or Docker—so communications stay accurate.

Common causes

Operators renewed PEM on nginx while Nexus Jetty still serves an old Java keystore (.jks / .p12). nexus.properties application-port-ssl keystore path points to an unmounted path inside the container image built last year.

Corporate wildcard cert expired while per-service SAN certs were refreshed only on the UI hostname. Automation updated ssl_cert in Kubernetes ingress but internal builds still resolve nexus.corp to a legacy VM. Java truststore still trusts the issuer while the server leaf expired—confusing for teams who only watch CA expiry.

Docker pull traffic may traverse port 5000 connector with a different keystore than HTTPS browsing on 443. npm proxy repositories and NuGet feeds hosted under path prefixes still share Jetty context in default installs—one expired connector breaks multiple ecosystems simultaneously. Air-gapped Nexus deployments mirror external dependencies; the first TLS hop inside the DMZ is still yours to renew even when outbound internet trust is static.

Confirm from the outside

Run checks from CI subnets, not developer VPNs with split tunneling. JVM trust stores on build agents may differ from your laptop—reproduce with the same container image the pipeline uses. When both ingress and Jetty terminate traffic, openssl the exact URL from .m2/settings.xml, .npmrc, and Docker config.json without assuming one covers all formats.

openssl s_client -connect nexus.example.com:443 -servername nexus.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Maven-style reproduction:

mvn -Djavax.net.ssl.debug=ssl dependency:resolve -Dartifact=com.example:probe:1.0.0 2>&1 | tail -n 30

Docker registry probe:

curl -vI https://nexus.example.com/v2/ 2>&1 | grep -Ei 'expire|SSL|issuer'

Inside Nexus (support bundle), note etc/jetty SSL context files and keystore paths from Support → Download report.

Gradle 8+ and recent Maven Resolver use stricter PKIX; capture gradlew --info TLS failures once for your ticket. crane and skopeo users see x509: certificate has expired or is not yet valid on crane digest—reproduce that single command before rolling back unrelated chart changes.

How to read the output

notAfter in OpenSSL is authoritative for external clients. Compare with keystore keytool -list -v -keystore nexus.jks dates if you manage Jetty directly. Subject/SAN must match the hostname configured in build tools and Docker registry-mirrors.

Fix checklist

1. Map user-facing hostnames for Maven, npm, Docker, and raw repositories.
2. Prove expiry externally with OpenSSL per hostname/port.
3. Renew certificate (public CA or internal PKI) with all repository hostnames in SAN.
4. Import into Java keystore or update reverse-proxy fullchain.
5. Restart Nexus or reload proxy; avoid long UI downtime windows without comms.
6. Clear CI caches that pin old TLS sessions only if needed—usually unnecessary.
7. Re-run failing pipeline with strict TLS (no MAVEN_OPTS insecure flags).
8. Document whether Jetty or ingress owns renewal going forward.

Communicate maintenance to every team consuming private coordinates—expired TLS blocks deploys harder than brief UI downtime. After renewal, run a canary pipeline that resolves a non-production artifact before removing temporary insecure JVM flags. Store keystore export passwords in your vault with rotation notes tied to serial numbers archived from openssl.

For air-gapped sites, courier refreshed keystores with checksum validation before install—latency there often exceeds public CA renewal SLAs, so start earlier than cloud-native teams. When npm and Maven share one connector, verify both ecosystems after renewal; npm clients sometimes cache registry metadata differently from Docker clients even on the same host.

Print keystore alias names in the incident channel after import—keytool -list output prevents wrong-alias reload debates during prolonged outages. Re-run one docker pull and one mvn dependency:get from CI before closing the bridge. Post the renewed certificate serial in the incident summary for audit.

When to use automation

Build systems fail silently until release day. Monitor live TLS on every hostname developers type into settings.xml, .npmrc, and Docker config.json—not only the marketing site. /check works for public registry hosts.

Schedule 30, 14, 7, and 1 day alerts and track RDAP on domains used in DNS-01 validation for ingress certs. Pair with repository uptime checks that do not disable certificate verification.

Registry monitoring should hit /v2/ and Maven repository metadata paths, not only the Nexus login page. /check suits public-facing registries; air-gapped teams run internal synthetics with the same hostname CI uses. Align calendars with SonarQube SSL certificate expired renewals when one DevOps cluster fronts both tools behind the same ingress controller.

Artifact promotion freezes during TLS incidents—track time-to-recover separately from generic uptime SLIs so leadership funds automation before the next release train collision.

Sonatype lifecycle policies continue evaluating components while TLS is broken—do not misread policy dashboards as healthy transport. For HA Nexus pairs, renew on both nodes before VIP failover tests; split-brain during cert swap has caused divergent keystore files that took days to reconcile.

IaC modules that template ingress TLS separately from Jetty must declare an owner per layer in architecture decision records. Capture docker pull and mvn dependency:get transcripts in the incident channel so developers see the same PKIX string operations sees.

Recovery communication should name which repository formats broke (Maven central proxy vs Docker hosted) because teams prioritize differently. After fix, ask release managers to republish a known-good snapshot through the full pipeline including signing and SBOM export—those steps often reveal secondary hostnames still expired.

Quarterly game days should include a tabletop where registry TLS fails during peak release—participants practice openssl proofs and JVM truststore updates without inventing runbooks under stress.

DevEx teams should monitor Docker registry paths (/v2/) separately from the Nexus UI login page because Jetty may bind different connectors. If your registry DNS is internal-only, schedule VPC synthetics that mirror CI egress rather than relying on desk VPN tests that use split tunnel exceptions.