Gradle "Using insecure protocols ... is unsupported" (Gradle 7) in CI

By Daniel Zoghalchali·Latchkey

Gradle 7+ refuses to use a plain http:// repository unless you explicitly opt in. A repository URL still on http triggers Using insecure protocols ... is unsupported, failing resolution by default.

What this error means

After upgrading to Gradle 7, a build that referenced an http:// repo fails with Using insecure protocols with repositories, without explicit opt-in, is unsupported. The same build worked on Gradle 6, which only warned.

gradle output

* What went wrong:
A problem occurred configuring root project 'app'.
> Using insecure protocols with repositories, without explicit opt-in, is
  unsupported. Switch Maven repository 'maven(http://nexus.internal/repo)' to
  redirect to a secure protocol (like HTTPS) or allow insecure protocols.

Diagnose it: get the real failure out of Gradle

Gradle summarises failures aggressively, and the top-level message frequently describes a downstream symptom rather than the cause. Re-run the failing task with diagnostics before changing build logic.

Terminal

# the actual stack, plus what Gradle decided about the build
./gradlew <task> --stacktrace --info

# is a stale daemon or cache involved?
./gradlew --stop
./gradlew <task> --no-daemon --no-build-cache

# what does Gradle think the environment is?
./gradlew -version

Common causes

An http:// repository URL

Gradle 7 made insecure-protocol repositories an error rather than a warning. Any repo declared with http:// is rejected unless explicitly allowed.

A plugin or convention adds an http repo

Even if your build is clean, an applied plugin or a shared convention can declare an http:// repository that triggers the same failure.

How to fix it

Switch the repository to HTTPS

Almost every repo serves HTTPS. Update the URL to the secure endpoint.

build.gradle.kts

repositories {
    maven { url = uri("https://nexus.internal/repository/maven-public/") }
}

Opt in only for a trusted internal http repo

If an internal repo genuinely has no HTTPS, opt in explicitly - never for public repos.

build.gradle.kts

repositories {
    maven {
        url = uri("http://nexus.internal/repository/maven-public/")
        isAllowInsecureProtocol = true
    }
}

Configuration cache and CI

The configuration cache rejects build logic that reads mutable state at execution time, which is why enabling it surfaces errors an existing build never showed.
Run with --configuration-cache-problems=warn first to see the full list rather than failing on the first one.
A cached configuration keyed to a different environment is worse than none. Include the JDK version in your cache key.

How to prevent it

Use HTTPS URLs for every declared repository.
Audit applied plugins/conventions for stray http:// repos before upgrading Gradle.
Front internal artifacts with an HTTPS-terminating proxy.

Frequently asked questions

What causes Gradle "Using insecure protocols ... is unsupported" (Gradle 7) in CI?

There are 2 common causes: an http:// repository url and a plugin or convention adds an http repo. Gradle 7 made insecure-protocol repositories an error rather than a warning.

How do I fix Gradle "Using insecure protocols ... is unsupported" (Gradle 7) in CI?

There are 2 fixes depending on which cause you have: switch the repository to https and opt in only for a trusted internal http repo. Work through them in order, since the first is the most common.

What does Gradle "Using insecure protocols ... is unsupported" (Gradle 7) in CI actually mean?

After upgrading to Gradle 7, a build that referenced an http:// repo fails with Using insecure protocols with repositories, without explicit opt-in, is unsupported.

How do I stop Gradle "Using insecure protocols ... is unsupported" (Gradle 7) in CI happening again?

Use HTTPS URLs for every declared repository. The prevention section lists 3 changes that keep it from recurring.