title: What is the correct way of forcing maven to use HTTPS for maven central?
body: <p>Recently sonatype enabled maven central to support https (<a href="http://blog.sonatype.com/2014/07/ssl_connectivity_for_central/#.U_PBTrvbBv8" rel="noreferrer">background information</a>). I've now added the following snippet to my pom.xml to force using https everywhere:</p>
  
  <pre><code>&lt;!-- force https --&gt;
  &lt;repositories&gt;
      &lt;repository&gt;
          &lt;id&gt;central&lt;/id&gt;
          &lt;url&gt;https://repo1.maven.org/maven2&lt;/url&gt;
          &lt;snapshots&gt;
              &lt;enabled&gt;false&lt;/enabled&gt;
          &lt;/snapshots&gt;
      &lt;/repository&gt;
  &lt;/repositories&gt;
  &lt;pluginRepositories&gt;
      &lt;pluginRepository&gt;
          &lt;id&gt;central&lt;/id&gt;
          &lt;url&gt;https://repo1.maven.org/maven2&lt;/url&gt;
          &lt;snapshots&gt;
              &lt;enabled&gt;false&lt;/enabled&gt;
          &lt;/snapshots&gt;
      &lt;/pluginRepository&gt;
  &lt;/pluginRepositories&gt;
  </code></pre>
  
  <p>Questions:</p>
  
  <ul>
  <li>Is this sufficient? Or will there be still http involved somewhere?</li>
  <li>Is this the correct way of doing it? As I've read that I should do this in the settings.xml instead. But then others using my (open source) project won't use the secure connection.</li>
  </ul>
  
  <p><strong>Update</strong></p>
  
  <p>It does not look sufficient as for e.g. the assembly plugin still HTTP is used: </p>
  
  <pre><code>[INFO] --- maven-assembly-plugin:2.4:single (make-assembly) @ graphhopper-web ---
  Downloading: http://repo.maven.apache.org/maven2/org/slf4j/slf4j-jdk14/1.5.6/slf4j-jdk14-1.5.6.jar
  </code></pre>