# Nexus SSL configuration help

**URL:** <https://community.sonatype.com/t/nexus-ssl-configuration-help/14840>\
**Category:** Sonatype Nexus Repository\
**Tags:** ssl, nexus-repository, linux\
**Created:** [April 24, 2025, 1:05pm UTC](https://community.sonatype.com/t/nexus-ssl-configuration-help/14840 "2025-04-24T13:05:24Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Meyer](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Andrew\_Meyer](https://community.sonatype.com/u/Andrew_Meyer)\
**Post date:** [April 24, 2025, 1:05pm UTC](https://community.sonatype.com/t/nexus-ssl-configuration-help/14840/1 "2025-04-24T13:05:24Z")

</div>

Hello,  
I’m trying to apply my SSL certificate to SonaType Nexus Repo Manager 3.

I’m using the following commands to generate the keystore:

```auto
keytool -genkey -alias myalias -keyalg RSA -keystore /opt/sonatype/nexus/sonatype-work/nexus3/etc/ssl/keystore.p12 -storetype pkcs12 -validity 3650 -dname "CN=*.mydomain.us, OU=IT, O=MyOrg, L=My City, S=State, C=US"

```

It prompts me to give it a password and I enter one. I then go to import my certs using:

```auto
keytool -keystore /opt/sonatype/nexus/sonatype-work/nexus3/etc/ssl/keystore.p12 -alias mycert_alias -import -file /path/to/my/cert/certificate_full_chain.pem

```

I then add the following lines to:  
/opt/sonatype/nexus/current/etc/nexus.properties

```auto
nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-http.xml,${jetty.etc}/jetty-https.xml,${jetty.etc}/jetty-requestlog.xml
application-port-ssl=8443
ssl.etc=${karaf.data}/etc/ssl

```

I then go to edit /opt/sonatype/nexus/current/etc/jetty/jetty-https.xml

I add this line per the documentation:

```auto
<Set name="certAlias">jetty</Set> 

```

And Configure the properties below it:

```auto
  <New id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory$Server">
    <Set name="certAlias">mycert_alias</Set>
    <Set name="KeyStorePath"><Property name="ssl.etc"/>/keystore.p12</Set>
    <Set name="KeyStorePassword">password</Set>
    <Set name="KeyManagerPassword">password</Set>
    <Set name="TrustStorePath"><Property name="ssl.etc"/>/keystore.p12</Set>
    <Set name="TrustStorePassword">password</Set>
    <Set name="EndpointIdentificationAlgorithm"></Set>
    <Set name="NeedClientAuth"><Property name="jetty.ssl.needClientAuth" default="false"/></Set>
    <Set name="WantClientAuth"><Property name="jetty.ssl.wantClientAuth" default="false"/></Set>
    <Set name="IncludeProtocols">
      <Array type="java.lang.String">
        <Item>TLSv1.2</Item>
      </Array>

```

After this I start nexus using systemd and I NEVER see it launch on port 8443.

Earlier yesterday if I put the application-port-ssl=8443 into the nexus-default.properties and restart the application it seemed to work but didn’t like the SSL certificate.

What am I doing wrong?

---

_[View the full topic](https://community.sonatype.com/t/nexus-ssl-configuration-help/14840)._