Nexus 2使用新SSL keystore.jks启动失败，抛出密钥无法恢复异常

为Nexus 2服务器创建新SSL证书后，启动服务器时报错：

java.security.UnrecoverableKeyException: Cannot recover key

启动时wrapper日志 #

jvm 1    | 2023-06-13 18:25:02,127+0200 ERROR [WrapperListener_start_runner] *SYSTEM org.sonatype.nexus.bootstrap.jsw.JswLauncher - Failed to start
jvm 1    | java.security.UnrecoverableKeyException: Cannot recover key
jvm 1    |      at sun.security.provider.KeyProtector.recover(KeyProtector.java:328) ~[na:1.8.0_101]
jvm 1    |      at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:146) ~[na:1.8.0_101]
jvm 1    |      at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:56) ~[na:1.8.0_101]
jvm 1    |      at sun.security.provider.KeyStoreDelegator.engineGetKey(KeyStoreDelegator.java:96) ~[na:1.8.0_101]
jvm 1    |      at sun.security.provider.JavaKeyStore$DualFormatJKS.engineGetKey(JavaKeyStore.java:70) ~[na:1.8.0_101]
jvm 1    |      at java.security.KeyStore.getKey(KeyStore.java:1023) ~[na:1.8.0_101]
jvm 1    |      at sun.security.ssl.SunX509KeyManagerImpl.<init>(SunX509KeyManagerImpl.java:133) ~[na:1.8.0_101]
jvm 1    |      at sun.security.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:70) ~[na:1.8.0_101]
jvm 1    |      at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:256) ~[na:1.8.0_101]
jvm 1    |      at org.eclipse.jetty.util.ssl.SslContextFactory.getKeyManagers(SslContextFactory.java:1080) ~[jetty-util-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.eclipse.jetty.util.ssl.SslContextFactory.doStart(SslContextFactory.java:291) ~[jetty-util-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64) ~[jetty-util-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.eclipse.jetty.server.ssl.SslSelectChannelConnector.doStart(SslSelectChannelConnector.java:612) ~[jetty-server-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.sonatype.nexus.bootstrap.jetty.InstrumentedSslSelectChannelConnector.doStart(InstrumentedSslSelectChannelConnector.java:91) ~[nexus-bootstrap-2.14.4-03.jar:2.14.4-03]
jvm 1    |      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64) ~[jetty-util-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.eclipse.jetty.server.Server.doStart(Server.java:293) ~[jetty-server-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64) ~[jetty-util-8.1.16.v20140903.jar:8.1.16.v20140903]
jvm 1    |      at org.sonatype.nexus.bootstrap.jetty.JettyServer$JettyMainThread.run(JettyServer.java:247) ~[nexus-bootstrap-2.14.4-03.jar:2.14.4-03]

已验证信息 #

• 使用旧的keystore.jks.old时服务器可正常启动
• 新旧密钥库使用相同密码执行以下命令均正常：

  keytool -list -v -keystore keystore.jks.old
  keytool -list -v -keystore keystore.jks.new
  

• 两个密钥库的CN一致

• 检查密钥条目与密钥库密码一致性：keytool -list仅验证密钥库密码，不校验密钥本身密码。执行keytool -exportcert -alias <证书别名> -keystore keystore.jks.new，若提示输入额外密码，说明密钥条目密码与密钥库密码不一致，Nexus要求两者必须相同。
• 确认密钥库类型匹配：执行keytool -list -v -keystore keystore.jks.new | grep "Keystore type"，检查新旧密钥库格式是否一致（Nexus 2要求JKS格式），若新密钥库为PKCS12等其他格式，需转换为JKS。
• 验证密钥条目有效性：使用keytool -checkalias -alias <证书别名> -keystore keystore.jks.new确认密钥条目存在且有效，同时核对别名是否与Nexus配置中指定的一致。
• 检查文件权限：确保Nexus运行用户对keystore.jks.new拥有可读权限，权限不足会导致无法读取密钥内容。
• 重新生成密钥库：若上述检查无问题，尝试重新生成密钥库，确保生成过程中密钥库密码与密钥密码设为相同值，且使用与旧密钥库一致的算法（如RSA）和密钥长度。
• 核对Nexus SSL配置：检查nexus.properties中application-port-ssl、ssl.keystore、ssl.keystore.password等配置项，确认路径和密码无拼写错误，正确指向新密钥库。

内容的提问来源于stack exchange，提问作者iclman