Trust repository with small dh key in maven build - maven

Question

When building my project using maven inside my newly setup CentOS 8 VM I get the following error when maven tries to download a dependecy from our internal nexus:
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 6.120 s
[INFO] Finished at: 2020-03-25T17:43:34+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project myproject: Could not resolve dependencies for project our.domain:myproject:jar:1.5.0: Failed to collect dependencies at our.domain.internal:internal-commons:jar:0.12.3: Failed to read artifact descriptor for our.domain.internal:internal-commons:jar:0.12.3: Could not transfer artifact our.domain.internal:internal-commons:pom:0.12.3 from/to nexus-proxy (https://nexus.our.domain/repository/maven-public/): DH ServerKeyExchange does not comply to algorithm constraints -> [Help 1]
The problem also occurs when I try to read any webpage on that nexus:
[root#localhost Daisy]# curl https://nexus.our.domain
curl: (35) error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small
I tried to manually add the key to my known_hosts file using:
ssh-keyscan -p 443 nexus.our.domain >> ~/.ssh/known_hosts
But I returns without any console-output and no change to the file. Running
ssh-keyscan -p 443 nexus.our.domain
also produces no output at all.
I already reported the issue to the internal team that manages our nexus.
I would still appreciate any solution that forces my VM to accept the key of our nexus so I don't have to wait until the key is exchanged. I'm free to handle this in any level of my client (VM)-side (Maven, https, ssl or any lower level).
Versions used:
CentOS: CentOS Linux release 8.1.1911 (Core)
Maven:
[root#localhost Daisy]# mvn --version
Apache Maven 3.5.4 (Red Hat 3.5.4-5)
Maven home: /usr/share/maven
Java version: 11.0.5, vendor: Oracle Corporation, runtime: /usr/lib/jvm/java-11-openjdk-11.0.5.10-2.el8_1.x86_64
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "4.18.0-147.5.1.el8_1.x86_64", arch: "amd64", family: "unix"
SSH: OpenSSH_8.0p1, OpenSSL 1.1.1c FIPS 28 May 2019

Answer 1

Changing the first line in /etc/crypto-policies/back-ends/opensslcnf.config :
- CipherString = #SECLEVEL=2:kEECDH:kRSA:kEDH:kPSK:kDHEPSK:kECDHEPSK:-aDSS:-3DES:!DES:!RC4:!RC2:!IDEA:-SEED:!eNULL:!aNULL:!MD5:-SHA384:-CAMELLIA:-ARIA:-AESCCM8
+ CipherString = #SECLEVEL=1:kEECDH:kRSA:kEDH:kPSK:kDHEPSK:kECDHEPSK:-aDSS:-3DES:!DES:!RC4:!RC2:!IDEA:-SEED:!eNULL:!aNULL:!MD5:-SHA384:-CAMELLIA:-ARIA:-AESCCM8
(changing SECLEVEL=2 to SECLEVEL=1)
For the maven build to run I had to change the jvm-setting as well:
What does "Reason: DHPublicKey does not comply to algorithm constraints" mean?
Remember, this is only a workaround. The setting is a security-setting and should normally not be changed.