Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Learn more about Collectives

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

Recently Maven build jobs running in Jenkins are failing with the below exception saying that they couldn't pull dependencies from Maven Central and should use HTTPS . I'm not sure how to change the requests from HTTP to HTTPS . Could someone guide me on this matter?

[ERROR] Unresolveable build extension:
Plugin org.apache.maven.wagon:wagon-ssh:2.1 or one of its dependencies could not be resolved:
Failed to collect dependencies for org.apache.maven.wagon:wagon-ssh:jar:2.1 () :
Failed to read artifact descriptor for org.apache.maven.wagon:wagon-ssh:jar:2.1 :
Could not transfer artifact org.apache.maven.wagon:wagon-ssh:pom:2.1 from/to central ( http://repo.maven.apache.org/maven2 ):
Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/wagon/wagon-ssh/2.1/wagon-ssh-2.1.pom .
Return code is: 501, ReasonPhrase:HTTPS Required. -> [Help 2]

Waiting for Jenkins to finish collecting data[ERROR]
Plugin org.apache.maven.plugins:maven-clean-plugin:2.4.1 or one of its dependencies could not be resolved:
Failed to read artifact descriptor for org.apache.maven.plugins:maven-clean-plugin:jar:2.4.1 :
Could not transfer artifact org.apache.maven.plugins:maven-clean-plugin:pom:2.4.1 from/to central ( http://repo.maven.apache.org/maven2 ):
Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-clean-plugin/2.4.1/maven-clean-plugin-2.4.1.pom .
Return code is: 501 , ReasonPhrase:HTTPS Required. -> [Help 1]

You are using the repo.maven.apache.org/maven2 url to connect to the maven central, instead use repo.maven.apache.org/maven2 i.e use https connection – Manjunath H M Jan 16, 2020 at 5:35 Hi Manjunath, I have the same problem. Do you know how to force maven to use HTTPS instead of HTTP – Lahiru Madushanka Jan 16, 2020 at 5:41 @Lahiru Madushanka go through the links, so you get a answer for your question stackoverflow.com/questions/25393298/… – Manjunath H M Jan 16, 2020 at 5:50

Effective January 15, 2020, The Central Repository no longer supports insecure communication over plain HTTP and requires that all requests to the repository are encrypted over HTTPS.

It looks like latest versions of Maven (tried with 3.6.0, 3.6.1) are already using the HTTPS URL by default.

Here are the dates when the major repositories will switch:

Your Java builds might break starting January 13th (if you haven't yet switched repo access to HTTPS)

Update: Seems like from maven 3.2.3 maven central is accessed via HTTPS See https://stackoverflow.com/a/25411658/5820670

Maven Change log ( http://maven.apache.org/docs/3.2.3/release-notes.html )

Hi! I'm the original researcher that kicked off this industry wide initiative. You can find my blog post about the important dates here as well: medium.com/@jonathan.leitschuh/… – Jonathan Leitschuh Jan 16, 2020 at 16:39 @Ashutosh: same thing there with Maven 3.6.1 on Ubuntu 19.10. I'm not sure why this is the case, it could be an Ubuntu patch, but why would they do that?). To solve this, use any of the answers below that update the settings.xml file (and upvote them, please, as this is the correct solution, other than using a patched Maven). – Guss Jan 23, 2020 at 10:41 So, I explicitly have configured settings.xml to use HTTPS repositories.. which it can, with wget , but for some very strange reason, mvn archetype:generate -X (to just test whether dependencies can be downloaded) it still prints it is accessing to Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-clean-plugin/2.5/maven-clean-plugin-2.5.pom Any help, please.. ? – Giorgi Tsiklauri Feb 6, 2020 at 9:53

I am facing the same problem. There are two solutions that I tried, and both works fine for me.

Update the Maven version repository (Maven version >= 3.2.3)

Restrict the current Maven version to use HTTPS links.

Update the Maven version repository:

Download the Apache Maven binary that includes the default https addresses ( Apache Maven 3.6.3 binary ). And open the Options dialog window in tools of NetBeans menu bar ( Java Maven Dialog View ). And select browse option in Maven Home List Box ( Maven Home List Box View ). After adding the Apache Maven newly downloaded version ( Updated Maven Home List Box View ), the project builds and runs successfully.

Restrict the current Maven version to use HTTPS links:

Include the following code in pom.xml of your project.

<project>
    <pluginRepositories>
        <pluginRepository>
            <id>central</id>
            <name>Central Repository</name>
            <url>https://repo.maven.apache.org/maven2</url>
            <layout>default</layout>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
            <releases>
                <updatePolicy>never</updatePolicy>
            </releases>
        </pluginRepository>
    </pluginRepositories>
    <repositories>
        <repository>
            <id>central</id>
            <name>Central Repository</name>
            <url>https://repo.maven.apache.org/maven2</url>
            <layout>default</layout>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
</project>
                I had the central repository but not the central plugin repository. That fixed it for me.
– ponder275
                Jan 31, 2020 at 16:09
                In my case I missed the <pluginRepository> part and I was getting errors when using archetypes cause it was defaulting to http for the plugins.
– user1708042
                Feb 12, 2020 at 12:31
                This also fixed it for me but I received another error "Received fatal alert: protocol_version" and had to switch to java 8 to fix it, in case that anybody stumbles across the same issue.
– Kim Tang
                Feb 19, 2020 at 12:29
  
Effective January 15, 2020, The Central Repository no longer supports
  insecure communication over plain HTTP and requires that all requests
  to the repository are encrypted over HTTPS.
  
If you're receiving this error, then you need to replace all URL
  references to Maven Central with their canonical HTTPS counterparts.
(source)
We have made the following changes in my project's build.gradle:
repositories {
   maven { url "http://repo.maven.apache.org/maven2" }
repositories {
   maven { url "https://repo.maven.apache.org/maven2" }
                Yes i have replace in setting.xml file but unfortunately it still not working. Am i doing right or there is any other file need to change?
– Sumeet Vishwas
                Jan 16, 2020 at 6:29
                @ArunanSugunakumar i didn't change in settings.xml. All you need to change in POM. update central repository of maven. I put the sample of central repository in answer thread. please find below
– Sumeet Vishwas
                Jan 16, 2020 at 10:04
                The OP's question says, "I am not sure how to change the requests from HTTP to HTTPS." This answer does not address the question.
– wchargin
                Jan 16, 2020 at 16:14
Try to hit the below URL in any browser. It will return 501
http://repo.maven.apache.org/maven2/org/apache/maven/wagon/wagon-ssh/2.1/wagon-ssh-2.1.pom
Please try with https. It will download a pom.xml file:
https://repo.maven.apache.org/maven2/org/apache/maven/wagon/wagon-ssh/2.1/wagon-ssh-2.1.pom
Please add it (https://repo.maven.apache.org/maven2) in the setting.xml file:
<repositories>
   <repository>
      <id>Central Maven repository</id>
      <name>Central Maven repository https</name>
      <url>https://repo.maven.apache.org/maven2</url>
   </repository>
</repositories>
                Can you please provide an example of a full setting.xml as I have unsuccessfully tried to add the above into the file?
– jhertz
                Feb 18, 2020 at 15:16
                Found this answer that made the location in the file clearer, now it works: stackoverflow.com/a/59784045/3120576
– jhertz
                Feb 18, 2020 at 15:33
I was using a clean install of Maven/Java on a Docker container.
For me, I had to cd $M2_HOME/conf and edit the settings.xml file there. Add the following block inside <mirrors>...</mirrors>
<mirror>
  <id>central-secure</id>
  <url>https://repo.maven.apache.org/maven2</url>
  <mirrorOf>central</mirrorOf>
</mirror>
                Could you please share your Dockerfile? I got the same issue but i don't know how to fix that!
– Han Van Pham
                Jan 22, 2020 at 16:51
                For me also the adaption of the central-secure block in the local settings.xml ($HOME/.m2/settings.xml) file did work perfectly.
– t3az0r
                Apr 14, 2020 at 15:13
        <name>Central Repository</name>
        <url>https://repo.maven.apache.org/maven2</url>
        <layout>default</layout>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
    </repository>
</repositories>
                I tried this in Pom and it worked well:    <repositories>         <repository>             <id>central repo https</id>             <name>Central Repository Https</name>             <url>repo.maven.apache.org/maven2</url>         </repository>     </repositories>.
– lam
                Jan 16, 2020 at 12:59
                Thanks. This is working in ubuntu 18.10, using Netbeans. Had to set Maven home to the latest Maven version in Netbeans. Where did you find this solution?
– Sanal S
                Jan 27, 2020 at 4:10




    

                You might have to update the plugin repository as well. At least it had to be done for me as well, in order to be fixed.
– Kim Tang
                Feb 19, 2020 at 12:30
        <name>Central Repository</name>
        <url>https://repo.maven.apache.org/maven2</url>
        <layout>default</layout>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
        <releases>
            <updatePolicy>never</updatePolicy>
        </releases>
    </pluginRepository>
</pluginRepositories>
<repositories>
    <repository>
        <id>central</id>
        <name>Central Repository</name>
        <url>https://repo.maven.apache.org/maven2</url>
        <layout>default</layout>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
    </repository>
</repositories>
                This is what saved me too. Feel like this comment should be closer to the top! Thank you :)
– Eitel Dagnin
                Dec 18, 2020 at 15:39
Maven is moving to HTTPS and disabling HTTP access
Short story, from January 15, 2020, Maven Central repository is not longer supporting HTTP connections (other repositories are doing the same). Therefore, you will indicate your Maven/Gradle settings to use an HTTPS URL.
Solution:
You can choose one of the following three approaches. 
Add a repository in your project´s pom.xml file
<project>
  <repositories>
    <repository>
      <id>central maven repo</id>
      <name>central maven repo https</name>
      <url>https://repo.maven.apache.org/maven2</url>
    </repository>
  </repositories>
</project>
Add the repository into a profile in the settings.xml file.
<profile>
  <id>my profile</id>
  <repositories>
    <repository>
      <id>central maven repo</id>
      <name>central maven repo https</name>
      <url>https://repo.maven.apache.org/maven2</url>
      </repository>
  </repositories>
</profile>
Update you maven version to a new one that uses https values as default. The lastest one at this moment 3.6.3 Download here
For Gradle:
Only replace the URL for the HTTPS version.
repositories {
   maven { url "https://repo.maven.apache.org/maven2" }
                To upgrade (3.3.9 to 3.6.3) do you need to completely uninstall the older version first?  Or just install the latest version?
– BigRedEO
                Feb 11, 2020 at 17:03
                @BigRedEO You can have more than one maven version in your environment. However, your $M2_HOME or your $PATH  env variables will point only to one of them, which will be your default maven version.    I would prefer to uninstall the older one before installing a newer one. But, that depends on your needs.
– Adam M. Gamboa G.
                Feb 11, 2020 at 22:33
        <name>Maven Mirror</name>
        <url>https://repo.maven.apache.org/maven2</url>
        <mirrorOf>central</mirrorOf>
    </mirror>
</mirrors>
                From maven 3.2.3, Central is accessing via HTTPS by default  maven.apache.org/docs/3.2.3/release-notes.html
– farasath
                Jan 20, 2020 at 8:04
As stated in other answers, https is now required to make requests to Maven Central, while older versions of Maven use http.
If you don't want to/cannot upgrade to Maven 3.2.3+, you can do a workaround by adding the following code into your MAVEN_HOME\conf\settings.xml into the <profiles> section:
<profile>
    <id>maven-https</id>
    <activation>
        <activeByDefault>true</activeByDefault>
    </activation>
    <repositories>
        <repository>
            <id>central</id>
            <url>https://repo1.maven.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
    <pluginRepositories>
        <pluginRepository>
            <id>central</id>
            <url>https://repo1.maven.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories> 
</profile>
This will be always an active setting unless you disable/override it in your POM when needed.
I have the same issue, but I use GitLab instead of Jenkins. The steps I had to do to get over the issue:
My project is in GitLab so it uses the .yml file which points to a Docker image I have to do continuous integration, and the image it uses has the http://maven URLs. So I changed that to https://maven.
That same Dockerfile image had an older version of Maven 3.0.1 that gave me issues just overnight. I updated the Dockerfile to get the latest version 3.6.3
I then deployed that image to my online repository, and updated my Maven project ymlfile to use that new image.
And lastly, I updated my main projects POM file to reference https://maven... instead of http://maven
I realize that is more specific to my setup. But without doing all of the steps above I would still continue to get this error message
Return code is: 501 , ReasonPhrase:HTTPS Required
For me (corporate coder) also adding a mirror repository in the settings.xml fixed the issue. I am also using Maven inside a docker container.
<mirrors>
    <mirror>
        <id>https-mirror</id>
        <name>Https Mirror Repository</name>
        <url>https://repo1.maven.org/maven2</url>
        <mirrorOf>central</mirrorOf>
    </mirror>
</mirrors>
                Sure! In our Dockerfile, we first put it in a temp folder like this: echo "<settings><mirrors>....</mirrors></settings>" > /tmp/maven-settings.xml. Then, we run maven with the "-s" option and pass the path to the settings file like this "mvn -s /tmp/maven-settings.xml clean". Hope it helps!
– Oscar Drai
                Jan 23, 2020 at 10:28
For all the corporate coders, ideally,
if you get this error, it means that your code base is still being built from open-source community. You need to over ride the "central" repository with your in house company Maven repository manager.
You can go to your settings.xml and override your central repository URL from http://  to https://
<M2_HOME>/conf/settings.xml
Find the mirrors sections and add the following entry:
    <mirror>
     <id>other-mirror</id>
     <name>Other Mirror Repository</name>
     <url>https://other-mirror.repo.other-company.com/maven2</url>
     <mirrorOf>central</mirrorOf>
    </mirror>
In the URL section, if you were using either http://repo1.maven.org/maven2/ or http://repo.maven.apache.org/maven2/ then
Replace http://repo1.maven.org/maven2/ with https://repo1.maven.org/maven2/
Replace http://repo.maven.apache.org/maven2/ with https://repo.maven.apache.org/maven2/
You need to ideally use your company source control management/repository URL over here. As this will block any contact with open source Maven repository community.
As mentioned in other answers, effective from 15 January 2020, the central Maven repository doesn't support insecure communication over plain HTTP.
                After adding the mirror in mirrors section I've got an error, that peer not authenticated. What should I do now? Thanks!
– dimson
                Jan 23, 2020 at 9:35
                @dimson This means that you tried to connect with https but you were missing certificate for authentication, probably because of Java not having it. Import certificate from repository into java keystore, or upgrade java.
– tibortru
                Jan 23, 2020 at 11:09
                @tibortru Thanx Man, already solve the problem. I've added these properties to maven in IDE: maven.wagon.http.ssl.insecure=true maven.wagon.http.ssl.allowall=true maven.wagon.http.ssl.ignore.validity.dates=true https.protocols=TLSv1,TLSv1.1,TLSv1.2. After that all works fine.
– dimson
                Jan 23, 2020 at 11:35
If you are using Netbeans older version, you have to make changes in maven to use https over http
Open C:\Program Files\NetBeans8.0.2\java\maven\conf\settings.xml
and paste below code in between mirrors tag
<mirror>
<id>maven-mirror</id>
<name>Maven Mirror</name>
<url>https://repo.maven.apache.org/maven2</url>
<mirrorOf>central</mirrorOf>
</mirror>
It will force maven to use https://repo.maven.apache.org/maven2 url.
                IMO this solution doesn't depend on the IDE. It worked for me on adding this entry to $MVN_HOME/conf/settings.xml file. Thanks!
– Debojit Saikia
                May 3, 2022 at 15:16
I un-installed old maven and installed Maven 3.6.3,
still got this error that Maven dependencies are failing with a 501 error.
Realized it could be a truststore/keystore issue associated with requiring https.
Found that you can now configure -Djavax options using a jvm.config file, see: https://maven.apache.org/configure.html.
As I am also using Tomcat I copied the keystore & truststore config from Tomcat (setenv.sh) to my jvm.config and then it worked! 
There is also an option to pass the this config in 'export MAVEN_OPTS' (when using mvn generate) but although this stopped the 501 error it created another: it expected a pom file. 
Creating a separate jvm.config file works perfectly, just put it in the root of your project.
Hopefully this helps someone, took me all day to figure it out!
Projects getting their dependencies using the same will start facing issues. For quick fixes do the following in your build.gradle 
instead of 
repositories {
jcenter ()
//others
use this: 
repositories {
jcenter { url "http://jcenter.bintray.com/"}
//others
The error: 
Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/wagon/wagon-ssh/2.1/wagon-ssh-2.1.pom. 
Return code is: 501 , ReasonPhrase:HTTPS Required. 
Root cause analysis:
Maven central is expecting that the clients use https, but the client is making plain HTTP request only.
Therefore, the request for downloading the package named 'wagon-ssh-2.1.pom' had failed.
How to fix the problem?
Replace the URL "http://repo.maven.apache.org/maven2"
with  "https://repo.maven.apache.org/maven2" 
in pom.xml file or build.gradle file of the project.
My current environment does not support HTTPS, so adding the insecure version of the repo solved my problem: http://insecure.repo1.maven.org as per Sonatype
    <repositories>
       <repository>
          <id>Central Maven repository</id>
          <name>Central Maven repository insecure</name>
          <url>http://insecure.repo1.maven.org</url>
       </repository>
    </repositories>
The following link got me out of the trouble,
https://support.sonatype.com/hc/en-us/articles/360041287334-Central-501-HTTPS-Required
You could make the changes either in your maven, apache-maven/conf/settings.xml.
Or, if you are specifying in your pom.xml, make the change there.
Before,
<repository>
            <id>maven_central_repo</id>
            <url>http://repo.maven.apache.org/maven2</url>
</repository>
<repository>
            <id>maven_central_repo</id>
            <url>https://repo.maven.apache.org/maven2</url>
</repository>
Note the change from http to https
Sharing this in case anyone needs it:
Old Gradle config( without Gitlab , Docker deployments , for simple projects)
repositories {
google()
jcenter()
maven { url "http://dl.bintray.com/davideas/maven" }
maven { url 'https://plugins.gradle.org/m2/' }
maven { url 'http://repo1.maven.org/maven2' }
maven { url 'http://jcenter.bintray.com' }
New config :
repositories {
google()
jcenter()
maven { url "https://dl.bintray.com/davideas/maven" }
maven { url 'https://plugins.gradle.org/m2/' }
maven { url 'https://repo1.maven.org/maven2' }
maven { url 'https://jcenter.bintray.com' }
Notice the https. Happy coding :)
Originally from https://stackoverflow.com/a/59796324/32453 though this might be useful:
Beware that your parent pom can (re) define repositories as well, and if it has overridden central and specified http for whatever reason, you'll need to fix that (so places to fix: ~/.m2/settings.xml 
AND also parent poms).
If you can't fix it in parent pom, you can override parent pom's repo's, like this, in your child pom (extracted from the 3.6.3 default super pom, seems they changed the name from repo1 as well):
  <repositories>
    <repository>
      <id>central</id>
      <name>Central Repository</name>
      <url>https://repo.maven.apache.org/maven2</url> <!-- the https you've been looking for -->
      <layout>default</layout>
      <snapshots>
        <enabled>false</enabled> <!-- or set to true if desired, default is false -->
      </snapshots>
    </repository>
  </repositories>
This error occured to me too. I did what Muhammad umer said above. But, it only solved error for spring-boot-dependencies and spring-boot-dependencies has child dependencies. Now, there were 21 errors. Previously, it was 2 errors. Like this:
Non-resolvable import POM: Could not transfer artifact org.springframework.cloud:spring-cloud-dependencies:pom:Hoxton.SR3 from/to central
and also https required in the error message.
I updated the maven version from 3.2.2 to 3.6.3 and java version from 8 to 11. Now, all errors of https required are gone.
To update maven version
Download latest maven from here: download maven
Unzip and move it to /opt/maven/
Set the path export PATH=$PATH:/opt/maven/bin
And, also remove old maven from PATH
On an old grails environment the only thing that works without upgrading is:
settings.xml
   <settings>
    <mirrors>
        <mirror>
          <id>centralhttps</id>
          <mirrorOf>central</mirrorOf>
          <name>Maven central https</name>
          <url>http://insecure.repo1.maven.org/maven2/</url>
        </mirror>
      </mirrors>
  </settings>
I hit this problem with the latest version (August 2020) (after not using Maven on this machine for ages) and was scratching my head as to why it could still be an issue after reading these answers.
Turns out I had an old settings.xml sitting in the .m2/ folder in my home directory with some customisations from years ago.
However, even deleting that file didn't fix it for me.  I ended up deleting the entire .m2 folder.

I don't think there was anything else in it except for downloaded resources.  Maybe just deleting folders like repository/org/apache/maven/archetype would have been sufficient.
            <name>Maven Plugin Repository</name>
            <url>https://repo1.maven.org/maven2</url>
            <layout>default</layout>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
</project>
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.