Skip to main content

Security updates: eMudhra certificate incident and PHP2Shell: Sonatype is aware of the eMudhra certificate incident and the PHP2Shell vulnerabilities. We are updating our products to address the eMudhra issue and have confirmed that Sonatype products are not impacted by PHP2Shell. Read Sonatype's assessment and guidance

How to configure HSTS in Nexus Repository 2

Updated

Nexus Repository 2 officially sunsetted June 30, 2025. Visit my.sonatype.com for archived documentation. Migrate to Sonatype Nexus Repository 3 as soon as possible.

What is HTTP Strict Transport Security (HSTS)?

HSTS is a standard intended to encourage web browsers to only transmit requests securely using https to a given host name. This feature can prevent accidental transmission of sensitive data to a plain http endpoint at the same host name by web browsers which support it.

Build tools do not typically support HSTS, however they will not break either if the server sends indication that the server supports it.

Enabling HSTS in Nexus Repository 2.15.0 or Newer

When TLS connections are terminated by Nexus Repository directly through Eclipse Jetty configuration, HSTS is already enabled by default.

If you are terminating HTTPS connections to Nexus Repository using a reverse proxy, you must configure your reverse proxy to enable or disable HSTS. Instructions for doing that are beyond the scope of this article. 

How to Disable HSTS in Nexus Repository 2.15.0 or Newer

  1. Edit /conf/nexus.properties
  2. Add a line containing 
    jetty.https.stsMaxAge=-1
  3. Save the file and restart Repository 2.

How To Enable HSTS in Nexus Repository 2.14.21 or Older

Older versions of Nexus Repository 2 using Eclipse Jetty 8. In those versions, HSTS is not available through Jetty.

Use a reverse proxy server in the front Nexus Repository if you require HSTS.

 

 

Related articles