# Default Secret Encryption Key

## post by ahmad.hashem on Oct 15, 2024

Ahmad Hashem

Default Secret Encryption Key

After upgrade Nexus sso from 3.72 to 3.73

I get Default Secret Encryption Key

Nexus was not configured with an encryption key and is using the Default key.

Is there a guide to fix that?

## post by mpiggott on Oct 16, 2024

Matthew Piggott

[https://help.sonatype.com/en/re-encryption-in-nexus-repository.html](https://help.sonatype.com/en/re-encryption-in-nexus-repository.html)

## post by ahmad.hashem on Oct 17, 2024

Ahmad Hashem

Thanks for your response, I have read this Guide, But it is totally non-understandable to me.

## post by alexey.stepanov on Oct 18, 2024

Alexey Stepanov

I think this instruction is for cloud installations

## post by ahmad.hashem on Oct 18, 2024

Ahmad Hashem

I have my own on-premise installation

## post by mpiggott on Oct 18, 2024

Matthew Piggott

The instructions are for on premise.

## post by lemonsterfy on Oct 21, 2024

lemonsterfy

Based on my experience, you can follow the steps below for configuring an encryption key for Nexus using two different methods: using an environment variable or using a property in the nexus.properties file. Each method includes updating the configuration through the Nexus web interface.

### Method 1: Using the NEXUS_SECRETS_KEY_FILE Environment Variable

#### Step 1: Create the JSON Configuration File

1. Create the secrets JSON file:

Create a file, e.g., `/path/to/nexus.secrets.json`, with the following content:
   ```json
   {
        "active": "your-key-id",
        "keys": [
          {
            "id": "your-key-id",
            "key": "your-encryption-key"
          }
        ]
   }
   ```
   - Replace “your-key-id” with your desired key ID.
   - Replace “your-encryption-key” with your generated encryption key (e.g., a 32-byte Base64 encoded string).

2. Secure the file:
   Set appropriate file permissions to prevent unauthorized access:
   ```bash
   chmod 600 /path/to/nexus.secrets.json
   ```

#### Step 2: Configure Nexus Service File

1. Edit the Nexus systemd service file (typically located at `/etc/systemd/system/nexus.service`). Add the following line in the `[Service]` section:
   ```ini
   [Service]
   Environment="NEXUS_SECRETS_KEY_FILE=/path/to/nexus.secrets.json"
   ```
   Replace `/path/to/nexus.secrets.json` with the actual path to your secrets JSON file.

2. Reload systemd and restart Nexus:
   ```bash
   sudo systemctl daemon-reload
   sudo systemctl restart nexus
   ```

#### Step 3: Verify the Configuration

1. Check Nexus startup logs for any errors or warnings related to the encryption key configuration:
   ```bash
   sudo journalctl -u nexus
   ```

2. Log in to the Nexus UI and verify that the previous warnings about using the default encryption key are no longer present.

#### Step 4: Update Encryption Settings via Web Interface

1. Log in to the Nexus web interface using the admin account.

2. Navigate to:
   System > API > Security Management: Secrets Encryption

3. Update the configuration with the following JSON:
   ```json
   {
        "secretKeyId": "your-key-id",
        "notifyEmail": "your-email@example.com"
   }
   ```
   - Replace “your-key-id” with the ID of the key you want to activate (the same ID specified in the JSON file).
   - Replace "your-email@example.com" with the email address to receive notifications.

4. Execute the update to apply the new encryption settings.

### Method 2: Using the nexus.secrets.file Property in nexus.properties

#### Step 1: Create the JSON Configuration File

1. Create the secrets JSON file:
   As in Method 1, create a file, e.g., `/path/to/nexus.secrets.json`, with the following content:
   ```json
   {
        "active": "your-key-id",
        "keys": [
          {
            "id": "your-key-id",
            "key": "your-encryption-key"
          }
        ]
   }
   ```
   - Replace “your-key-id” with your desired key ID.
   - Replace “your-encryption-key” with your generated encryption key (e.g., a 32-byte Base64 encoded string).

2. Secure the file:
   Set appropriate file permissions to prevent unauthorized access:
   ```bash
   chmod 600 /path/to/nexus.secrets.json
   ```

#### Step 2: Edit nexus.properties

1. Locate the `nexus.properties` file, typically found in the custom directory at `/your-path/sonatype-work/nexus3/etc/nexus.properties`.

2. Add the following line to specify the secrets file location:
   ```properties
   nexus.secrets.file=/path/to/nexus.secrets.json
   ```
   Replace `/path/to/nexus.secrets.json` with the path to your secrets JSON file.

#### Step 3: Restart Nexus

After modifying nexus.properties, restart Nexus to apply the changes:
```bash
sudo systemctl restart nexus
```

#### Step 4: Verify the Configuration

1. Check Nexus startup logs for any errors or warnings related to the encryption key configuration:
   ```bash
   sudo journalctl -u nexus
   ```

2. Log in to the Nexus UI and verify that the previous warnings about using the default encryption key are no longer present.

#### Step 5: Update Encryption Settings via Web Interface

1. Log in to the Nexus web interface using the admin account.

2. Navigate to:
   System > API > Security Management: Secrets Encryption

4. Execute the update to apply the new encryption settings.

By following either of these methods, you can configure a custom encryption key for Nexus, apply it either through an environment variable or a properties file, and ensure that the configuration is updated through the Nexus web interface.

## post by ahmad.hashem on Oct 21, 2024

Ahmad Hashem

OK, Thanks, But the instructions still not understandable to me, how and where to run these commands.

## post by ahmad.hashem on Oct 22, 2024

Ahmad Hashem

Thanks for excellent guide. It works as charm

## post by Uma_palakolanu on Oct 28, 2025

Uma palakolanu

Method#2 worked for us, Appreciate the detailed steps.