Certificates and HTTPS

What you get out of the box

A new Nexus listens on two ports:

Port	Protocol	Certificate
8080	HTTP	none — traffic is in the clear
8443	HTTPS	a self-signed certificate Nexus generates on first start

Both are open by default. Plain HTTP is there so first contact with a new Nexus does not begin with a browser security warning, and so Studio and Lens can list projects on a Nexus instance nobody has configured yet.

The self-signed certificate lands in certs/ inside the data directory.

A self-signed certificate is encryption without identity

Traffic on 8443 is encrypted from the first boot, which is worth having. But nobody can tell your Nexus from an impostor, and every browser warns. Install a real certificate before Nexus carries production traffic.

Installing a real certificate

1. Obtain a certificate and private key in PEM format for the name people will actually type — the hostname in the browser's address bar, not the machine's internal name.
2. Copy both onto Nexus, somewhere only the service account can read.
3. Point Nexus at them in its configuration file (where is it?):

{
  "gateway": {
    "tlsCertPath": "C:\\ProgramData\\Raylux\\certs\\gateway.crt",
    "tlsKeyPath":  "C:\\ProgramData\\Raylux\\certs\\gateway.key"
  }
}

4. Restart Nexus.
5. Browse to https://<name>:8443/ and confirm the browser is satisfied.

Include the full chain

If your certificate is issued by an intermediate authority, the certificate file must contain the full chain — your certificate first, then the intermediates. A chain that is complete in a browser you have already visited but incomplete on the wire is a classic source of "it works on my machine".

Turning off plain HTTP

Once HTTPS works, close the cleartext port:

{
  "gateway": {
    "httpDisable": true
  }
}

Restart, and Nexus serves HTTPS only. Do this on any Nexus reachable from a network you do not control.

If you set a single port only

Nexus will not silently move HTTPS to make room for HTTP. If the configuration gives it nowhere distinct to put a cleartext listener, it stays HTTPS-only. An existing Nexus therefore cannot become cleartext just because it restarted on a newer build.

Behind a reverse proxy

If you terminate TLS at nginx, IIS or a load balancer, you can have Nexus serve plain HTTP to the proxy only:

{
  "gateway": {
    "tlsDisable": true,
    "bindAddress": "127.0.0.1"
  }
}

Binding to loopback matters: without it, tlsDisable means an unencrypted Nexus listening on every interface.

Your proxy must send X-Forwarded headers

Nexus uses their presence to tell a local request from a remote one — which is what stops a proxy handing the no-secret first-run path to the whole network. Any standard proxy configuration sets them.

Certificate trust in Studio and Lens

Studio and Lens do not use the operating system's certificate store for Nexus instances. The first time they connect they show you the certificate and ask you to accept it, then remember that exact certificate.

If it changes later they ask again. On a planned certificate renewal, accept it. If you are asked unexpectedly, stop and find out why before accepting.