Sonatype Nexus upload fails with Certificate for nexus.xyz.corp doesn't match common name of the certificate subject: wiki.xyz.corp - ssl

Question

I get the following error when trying to upload files to Nexus using Gradle:
Certificate for doesn't match common name of the certificate subject: wiki.xyz.corp
Details:
C:\data\Workspaces\httpstest>gradlew uploadArchives
:compileJava UP-TO-DATE
:processResources UP-TO-DATE
:classes UP-TO-DATE
:jar SKIPPED
:uploadArchives
Could not transfer artifact com.xyz:httpstest:jar:1.0.0 from/to remo
te (https://nexus.xyz.corp/nexus/content/repositories/1st-rel/): Cer
tificate for <nexus.xyz.corp> doesn't match common name of the certi
ficate subject: wiki.xyz.corp
Could not transfer artifact com.xyz:httpstest:pom:1.0.0 from/to remo
te (https://nexus.xyz.corp/nexus/content/repositories/1st-rel/): Cer
tificate for <nexus.xyz.corp> doesn't match common name of the certi
ficate subject: wiki.xyz.corp
:uploadArchives FAILED
FAILURE: Build failed with an exception.
* What went wrong:
Execution failed for task ':uploadArchives'.
> Could not publish configuration 'archives'
> Failed to deploy artifacts: Could not transfer artifact com.xyz
:httpstest:jar:1.0.0 from/to remote (https://nexus.xyz.corp/nexus/co
ntent/repositories/1st-rel/): Certificate for <nexus.xyz.corp> doesn
't match common name of the certificate subject: wiki.xyz.corp
* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug
option to get more log output.
BUILD FAILED
Total time: 5.511 secs
Downloading via HTTPS works fine, but uploading does not.
The certificate for nexus.xyz.corp has the correct common name, and NOT wiki.xyz.corp as the error message implies.
However, wiki.xyz.corp is a different site running on the same server.
What's the problem here?

Answer 1

This occurs when the different domains (wiki.xyz.corp and nexus.xyz.corp) are shared using SNI.
It occurs at least in versions Gradle 2.5 - Gradle 2.13. The reason is that Gradle uses the Maven Wagon Library in a version that does not support SNI. In this case, the webserver returns a default certificate. It seems, that wiki.xyz.corp was defined as default certificate.
This is discussed in Gradle Discussion and Gradle Issues.
Possible workarounds:
Define nexus.xyz.corp as default certificate, but beware of problems on the other site
Replace Maven Wagon with Maven Publish, but this is currently in beta. See Maven Publish.
try to configure your system without SNI
start Gradle in a way that host checking is disabled (this is a security leak!):
gradlew -Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true uploadArchives