Prior to Aug 3, 2014, secure access to the Central Repository was limited to Nexus Repository Pro licensees using the Nexus Repository Pro Secure Central plugin, and those who obtained a special Auth Token from Sonatype after making a Apache Software Foundation donation. Going forward, Sonatype offers SSL access to Central for everyone free of charge.
If you want to switch to using the now free secure central, see our guide to doing this.
Nexus Repository Pro versions earlier than 2.9.x include a now legacy Secure Central Plugin which supported an HTTPS Maven 2 Proxy Repository connection to Maven Central. The remote URL was configured by default as https://secure.central.sonatype.com/maven2.
This article describes how to completely disable or replace this secure connection and optionally replace it with the standard Maven Central remote URL.
Completely Deleting Secure Central Proxy Repository
You can completely delete the legacy Nexus Repository Pro Secure Central repository. Choose this option if:
- you plan to replace it and start a new Central repository
- its local storage contains very little or is empty or you don't care if Nexus will need to re-download indexes or already cached artifacts from somewhere else
- you prefer not to use a secure connection to Central
Steps:
- Delete any dependent repositories on Central. By default, Nexus Repository ships with a Central M1 Shadow repository that needs to be removed before deleting Central. Open Repositories tab. Select the "Central M1 Shadow" repository. Click the Delete button in the toolbar and confirm the deletion.
- Delete Central. Open Repositories tab. Select the "Central" Repository. Click the Delete button in the toolbar and confirm the deletion.
- Disable the secure central capability. Open Administration -> Capabilities tab. Select Secure Central capability. View its Settings. Make sure the Enabled checkbox is not checked. Save the capability.
Blocking Secure Central Proxy Repository
You can choose to keep the existing secure central proxy and it's already cached artifacts in local storage, but prevent it from trying to fetch new artifacts remotely. Choose this option if:
- you want the option to enable it again later
- you've already cached artifacts locally and do not want to incur the time to fetch these artifacts again
Steps:
- Block Central from going remote for new artifacts. Open Repositories tab. Right-click the secure "Central" Repository. Choose the Block Proxy option.
- Disable the secure central capability. Open Administration -> Capabilities tab. Select Secure Central capability. View its Settings. Make sure the Enabled checkbox is not checked. Save the capability.
Replacing Secure Central with Standard Central
Simply changing the remote URL of the secure Central proxy repository may seem appealing, however changing the remote URL of existing repository may have ill effects and is generally not recommended. It is usually better to simply add a new repo and delete or block the old one.
You may still want to fetch artifacts from central, but using the standard http/https free URLs.
Steps:
- Follow the steps for Blocking or Deleting Secure Central Proxy Repository
- Add a new Maven 2 Proxy repository with the remote url of
https://repo1.maven.org/maven2/ - Add the new Maven 2 Proxy Repository to any groups that contained the legacy secure central Proxy repository.