Request secure Nexus binaries with HTTPS

[garrooo]

Currently, SDK modules and 3rd party dependencies are hosted by Inductive Automation at:

http://nexus.inductiveautomation.com:8081/nexus/content/repositories/inductiveautomation-releases/
http://nexus.inductiveautomation.com:8081/nexus/content/repositories/inductiveautomation-thirdparty/

To avoid the possibility of man in the middle attacks, is there a possibility of making these repositories available over a secured HTTPS connection?

The JARs are binaries and IT policies in-house do not favour the idea of fetching binaries insecurely fetched over HTTP. The JARs are accompanied by md5 and sha1 hashes, but these checksums are also hosted by the same unencrypted HTTP connection.

This topic is related to:

Nexus on normal ports ( eg https: 443 http:80)

Greetings, is it possible to use standard ports on your web services eg not 80 no 8081 for nexus repository, 8443 for your sdk docs (this one will at least work on port 80 when you change your URI). Not everyone has unfettered port access and for us behind corporate firewalls this causes no end of fun. You seem to be using Apache to serve files so you may wish to investigate mod_proxy eg ProxyPass and ProxyPassReverse directives. Regards Tarek

References:

MiTM, can a binary file be changed or swapped enroute

[Kevin.Herron]

It won’t happen quickly, but I’ll make sure this is on the radar. We’ve also been meaning to (or putting off…) upgrade Nexus to the latest 3.x version, so maybe those can happen at the same time.