Can't make maven use HTTPS despite the settings.xml configuration where I have repositories with HTTPS

Giorgi Tsiklauri :

I have researched almost entire StackOverflow, Apache websites and all I could do in one day, but couldn't manage to get this working.

I have Maven 3.0.5 with Jdk8 setup (that's for particular stack, and versions won't be revised) inside a Vagrant environment. I'm aware of Apache's decision to force all the Maven repositories to only use HTTPS, otherwise Maven clients won't be speaking to repository servers.

Seems like I have configured all necessary settings in my ~/.m2/settings.xml and for some very strange reason, when I run any command (any build phase, say mvn clean), Maven defaults to HTTP and doesn't care about settings.xml - it still attempts to download references/dependencies with HTTP protocol.

Example of my settings.xml (For simplicity, I removed project specific things and left only this, it doesn't work even with this)

<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                    https://maven.apache.org/xsd/settings-1.0.0.xsd">
<repositories>
  <repository>
    <id>central</id>
    <url>https://repo1.maven.org/maven2/</url>
  </repository>

  <repository>
    <id>central</id>
    <url>https://repo.maven.apache.org/maven2/</url>
  </repository>
</repositories>

and here is what I'm getting for test command mvn archetype:generate (the problem is persistent for any other build phase commands)

[INFO] Scanning for projects... Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-clean-plugin/2.5/maven-clean-plugin-2.5.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-clean-plugin:2.5: Plugin org.apache.maven.plugins:maven-clean-plugin:2.5 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-clean-plugin:jar:2.5 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-install-plugin/2.3/maven-install-plugin-2.3.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-install-plugin:2.3: Plugin org.apache.maven.plugins:maven-install-plugin:2.3 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-install-plugin:jar:2.3 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/2.7/maven-deploy-plugin-2.7.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-deploy-plugin:2.7: Plugin org.apache.maven.plugins:maven-deploy-plugin:2.7 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-deploy-plugin:jar:2.7 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-site-plugin/3.0/maven-site-plugin-3.0.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-site-plugin:3.0: Plugin org.apache.maven.plugins:maven-site-plugin:3.0 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-site-plugin:jar:3.0 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-antrun-plugin/1.3/maven-antrun-plugin-1.3.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-antrun-plugin:1.3: Plugin org.apache.maven.plugins:maven-antrun-plugin:1.3 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-antrun-plugin:jar:1.3 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-assembly-plugin/2.2-beta-5/maven-assembly-plugin-2.2-beta-5.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5: Plugin org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-assembly-plugin:jar:2.2-beta-5 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-dependency-plugin/2.1/maven-dependency-plugin-2.1.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-dependency-plugin:2.1: Plugin org.apache.maven.plugins:maven-dependency-plugin:2.1 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-dependency-plugin:jar:2.1 Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-release-plugin/2.0/maven-release-plugin-2.0.pom [WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-release-plugin:2.0: Plugin org.apache.maven.plugins:maven-release-plugin:2.0 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-release-plugin:jar:2.0 Downloading: http://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml [WARNING] Could not transfer metadata org.apache.maven.plugins/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required. [WARNING] Could not transfer metadata org.codehaus.mojo/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required. [WARNING] Failure to transfer org.apache.maven.plugins/maven-metadata.xml from http://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced. Original error: Could not transfer metadata org.apache.maven.plugins/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required. [WARNING] Failure to transfer org.codehaus.mojo/maven-metadata.xml from http://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced. Original error: Could not transfer metadata org.codehaus.mojo/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required.

What shall I do? as you see, upon using HTTP, I get correspondingly HTTP 501.

Giorgi Tsiklauri :

As I've spent all day with this, I think it's worth to share the experience, results of debugging and the way of resolving this problem.

There were two problems:

1) [WARNING] Failed to retrieve plugin descriptor for .. (whatever plugin name) warnings during almost any build phase (clean, package or etc.), which says that (important>>) the retrieval of plugin descriptors or its dependencies (which means plugins, and not the project dependencies!) is not going successful.

Reason of this (in this case) is that maven attempts to communicate with an end-point machine (repository) via HTTP (as you see in the question's quote), despite the fact(!), that I have customized my configuration .m2\settings.xml file and all the repository definition entries are defined with HTTPS, respectively, seems like maven should be trying everything via HTTPS..but no, it uses HTTP for plugins, and any HTTP communication with maven repositories is forbidden since the 15th of January, 2020.

The way I resolved this is to define and configure <profiles/> and <pluginRepositories/> as @carlspring suggested, but I had to elaborate and expand that answer a bit. So, here is my ready settings.xml example: (note, that just to be safe, I provided alternative repositories in both - profiles and repositories)

<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"                                                                                                                                     $    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                        https://maven.apache.org/xsd/settings-1.0.0.xsd">

<profiles>
<profile>
   <id>ssl-profile</id>
   <activation>
        <activeByDefault>true</activeByDefault>
    </activation>
    <repositories>
        <repository>
            <id>central-1</id>
            <url>https://repo1.maven.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
    <pluginRepositories>
        <pluginRepository>
            <id>central-2</id>
            <url>https://repo1.maven.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>
</profile>
  <repositories>
    <repository>
      <id>central1</id>
      <url>https://repo1.maven.org/maven2/</url>
    </repository>
    <repository>
      <id>central2</id>
      <url>https://repo.maven.apache.org/maven2/</url>
    </repository>
  </repositories>
  </profiles>
</settings>

After this was resolved, and finally maven took this configuration and started to attempt to connect to all the repositories via HTTPS, I had another - 2nd problem.

2) peer not authenticated followed by Return code is: 501 , ReasonPhrase:HTTPS Required.

This was a bit tricky, but the way of solving this is to play with truststore cacerts file. First, check whether you have truststore file cacerts and whether it's empty or not! it must NOT be empty and this is very important. Seems like in OpenJDK11 and some other builds in some Windows/Linux distributions, cacerts file is either missing or empty; however, according to my observation, it was present in OracleJDK builds.

On Windows builds, it should be under %JAVA_HOME%\lib\security\;
On Linux builds, it may vary (depending on Linux distribution and your setup), but in my case, it was under /etc/ssl/certs (and I think that's Linux's certificates folder, not particularly Java's one).

If you see (and you see most likely, if you have this peer not authenticated problem) that you either don't have cacerts file or it's empty (simply check the file size, it should be larger than few bits), you can either:

Simply copy-paste existing cacerts file from some other Jdk/Jre build;
Generate a cacerts truststore file and add certificate(s) to it (in this case, you will need to add as many certificates as you need, so, maybe it's easier to go with just a copy-paste)

I hope this helps.