-
|
Hello, I do have an internal Nexus repository with SSL enabled, but with a self signed certificate. In Maven I could add the certificate using the following commands: "${JAVA_17_HOME}/bin/keytool" -J-Duser.language=en -printcert -rfc -sslserver "privaterepo:8443" > foobar.pem
"${JAVA_17_HOME}/bin/keytool" -J-Duser.language=en -import -trustcacerts -cacerts -file foobar.pem -alias "privaterepo-nexus" -storepass PASSWORDPerforming a But when I am in Eclipse, this fails despite the cacerts. From the trace found in error logs (and below), I can see that m2e-core is using Aether and okhttp3 (https://github.com/takari/aether-connector-okhttp/blob/master/src/main/java/io/takari/aether/okhttp/OkHttpAetherClient.java#L112). The JDK is the same (and point to JAVA_17_HOME). Is there a way to configuring the whole to allow self signed certificate ? The full trace: |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 7 replies
-
|
I don't think this is something you can configure at m2eclipe, you probbaly can configure this on maven, but I more suspect that your assumption
is wrong, has you checked that the JVM running eclipse is pointing to the |
Beta Was this translation helpful? Give feedback.
-
|
I've checked: path is the same ( I'm not sure how to proceed next to verify what trust store it use? And before asking, I did a little bit of search: https://stackoverflow.com/questions/23103174/does-okhttp-support-accepting-self-signed-ssl-certs I don't know if this means that I'd need to roll up a fork of aether which would be kind of complicated, or if somewhere okhttp3 handle that nicely (I would have thought it would). |
Beta Was this translation helpful? Give feedback.
-
This would indeed be complicated as you would need to build a custom m2e as well. And as m2e uses the same "maven" as when you call it from the commandline so why should it work there and not from within eclipse? Have you made sure that the same settings.xml are used on commandline/eclipse and that the same maven version is used? |
Beta Was this translation helpful? Give feedback.
-
|
In the past, I already had divergence between maven and m2e: eclipse/lemminx-maven#221 Beside, in Eclipse, the dependency resolution is made by the embedded runtime (at least, that's what the Preferences > Maven > Installations screens says): that and the issue mentioned above make me think there is another location. |
Beta Was this translation helpful? Give feedback.
-
|
Then please provide a minimal reproducible testcase as a PR to deomonstrate the problem. |
Beta Was this translation helpful? Give feedback.
-
|
Another problem which make me thing the resolution does not even use the settings.xml - or at least, not all its content: I have set in my settings.xml a This one spams warnings. @laeubi I've no problem with a test case, but I don't think it will be "simple": it still requires a Nexus repository as a proxy for central in settings.xml with a self signed certificate. |
Beta Was this translation helpful? Give feedback.
-
|
A testcase should include e.g an embedded jetty server that uses a custom ssl certificate, a full nexus server is not required. |
Beta Was this translation helpful? Give feedback.
-
|
I ran the whole in debug and ran into this error while trying to reproduce my issue: The error is thrown from this method: RealConnection and the implementation of OkHostnameVerifier only reads the subject alternative names (SAN) and my certificate did not have one. I did not dig into maven with debug itself but I think the difference of behaviour lies in the use of wagon-http and httpclient 4.5. Its HostnameVerifier validate the CN if no SAN name are found.. From the last commit/PR of OkHostnameVerifier square/okhttp#3764, it seems that the CN check was removed in 2018 for deprecation. Httpclient5 seems to take notice of the deprecation, but keeps the CN (see DefaultHostnameVerifier) check if no SAN are found. As for a test case, well, given it was a configuration mistake and that I honestly don't know where to begin to create a test case with jetty + ssl + repository provider + repository consumer, I'll skip it. I would however be willing to provide a test case (and issue) for the
The dependency below will produce a marker It does not occur if the property is defined in the pom file... but it should honour the settings. Strangely, if I use another property like |
Beta Was this translation helpful? Give feedback.
-
|
The language server is this one for maven: https://github.com/eclipse/lemminx-maven/ but are you sure it is really a (system)property, that means you have started eclipse with specify that as |
Beta Was this translation helpful? Give feedback.
-
|
You got me wrong:
But yes, it is a Lemminx problem. |
Beta Was this translation helpful? Give feedback.
I ran the whole in debug and ran into this error while trying to reproduce my issue:
The error is thrown from this method: RealConnection and the implementation of OkHostnameVerifier only reads the subject alternative names (SAN) and my certificate did not have one.
I did not dig into maven with debug itself but I think the difference of behaviour lies in the use of wagon-http and httpclient 4.5. Its HostnameVerifier validate the CN if no SAN name are found..
From the last commit/PR of OkHostnameVerif…