If you’re currently operating NGINX Plus as your web server and load balancer or considering its adoption, understanding F5’s recent licensing policy changes and lifecycle management policies is crucial. The JWT licensing policy introduced with NGINX Plus R33 in November 2024 has direct implications for all users. This guide provides comprehensive details on NGINX Plus’s current licensing framework, EOS/EOL schedules, and essential information for technical teams.

NGINX Plus is F5’s commercial web server and application delivery platform built on open-source NGINX. Starting with NGINX Plus R33, all NGINX Plus instances require a valid JSON Web Token (JWT) license, representing a significant shift aligned with F5’s entitlement and visibility policies.

1. Key Changes in JWT Licensing Policy

Mandatory License File Requirements

All NGINX Plus instances starting from R33 require a valid JWT license file. This license is tied to your subscription (not individual instances) and must be stored at:

• Linux: /etc/nginx/license.jwt
• FreeBSD: /usr/local/etc/nginx/license.jwt
• Custom Path: Configurable via the license_token directive in the mgmt context

Usage Reporting System

NGINX Plus automatically sends usage reports to F5’s licensing endpoint (product.connect.nginx.com) every hour. Key characteristics of this system:

Critical: If the initial usage report fails, NGINX Plus immediately stops processing traffic, making network connectivity and firewall configuration verification essential beforehand.

2. License Models and Pricing Policy

Per-Instance Licensing

NGINX products are licensed “per instance,” with each subscription allowing one single instance of the software for the subscription period.

Pricing Structure

NGINX Plus offers three pricing editions ranging from $849 to $2,099, with a free trial available.

3. NGINX Plus Release and Support Lifecycle

Current Release Status (2025)

Major Historical Releases and EOL Status

Historical Major Releases (Reference)

Technical Support Policy

F5 provides 24 months of technical support for each NGINX Plus release, beginning from the initial release date of each version.

Support Phase Policy

4. EOS (End of Software Development) Policy

Software Development End Schedule

Each NGINX Plus release reaches EoSD (End of Software Development) on the release date of the next version. After EoSD, no additional features or routine bug fixes are applied to that version.

Current Support Status (August 2025)

Module-Specific EOL Schedule

1. ModSecurity WAF Module

• EOL Date: March 31, 2024 (completed)
• Impact: ModSecurity packages completely removed from NGINX Plus repository
• Alternative: Migration to NGINX App Protect WAF required

2. OpenTracing Module

• Introduction: NGINX Plus R18 (2019)
• Deprecated: NGINX Plus R32 (December 2023)
• Complete Removal: Scheduled for NGINX Plus R34
• Alternative: OpenTelemetry Distributed Tracing module recommended (introduced in R29)

3. Cookie-Flag Module (Third-party)

• Deprecated: NGINX Plus R23 (December 2020)
• Complete Removal: NGINX Plus R26 (September 2021)
• Alternative: Use proxy_cookie_flags directive

4. SSL Directive (Legacy)

• Deprecated: NGINX 1.15.0
• Complete Removal: NGINX Plus R30 (July 2023)
• Alternative: Use ssl parameter of listen directive

5. HTTP/2 Server Push Support

• Introduction: NGINX Plus R15 (2018)
• Complete Removal: NGINX Plus R30 (July 2023)
• Reason: Used in only 0.04% of sessions per IETF 102, disabled in Chrome 106

Platform-Specific EOL Schedule

Operating System Support End Status

New Platform Support Additions

API Version Support Status

NGINX Plus API Evolution

Packaging and Repository Changes

Repository Change History

PGP Key Updates

5. License Expiration and Renewal Policy

Impact of Subscription Expiration

After your support contract expires, you are no longer licensed to use NGINX Plus or receive support from NGINX. You cannot access NGINX Plus updates and must stop and delete your NGINX Plus instances.

Renewal Process

1. Advance Notification: F5 proactively notifies all subscribers when updates are available
2. Renewal Procedure: Subscription renewal through MyF5 portal
3. New JWT Download: New JWT license file issued upon renewal
4. Deployment: Batch deployment via Config Sync Group or Instance Group recommended

6. Version-Specific Migration Guide and Checklists

Essential Tasks for R33+ Upgrades

Pre-Migration Checklist

Step-by-Step Upgrade Procedure

1. JWT License Deployment

   # Verify license file location
   sudo mkdir -p /etc/nginx
   sudo cp license.jwt /etc/nginx/license.jwt
   sudo chown nginx:nginx /etc/nginx/license.jwt
   sudo chmod 600 /etc/nginx/license.jwt
   

2. Configuration File Updates

   # nginx.conf additional settings
   mgmt {
       usage_report endpoint=product.connect.nginx.com:443;
       enforce_initial_report on;
   }
   

3. Offline Environment Configuration (if needed)

   mgmt {
       usage_report endpoint=internal-nim.company.com:443;
       enforce_initial_report on;
       license_token /custom/path/license.jwt;
   }
   

Major Release-Specific Upgrade Considerations

Upgrading to R35

• OIDC RP-Initiated Logout functionality available
• QuickJS ES2023 full support enables njs script modernization
• CVE-2025-53859 security patch applied

Upgrading to R34

• Proxy usage reporting support resolves network constraints
• Native OIDC module introduction simplifies authentication
• SNI-related security issue (CVE-2025-23419) patched

Upgrading to R33 (Mandatory)

• JWT licensing system complete transition
• Usage reporting mandatory activation
• 180-day grace period configuration option

Legacy Module Migration Guide

1. ModSecurity → NGINX App Protect Migration

# Legacy ModSecurity configuration (no longer supported)
# load_module modules/ngx_http_modsecurity_module.so;
# modsecurity on;
# modsecurity_rules_file /etc/nginx/modsec/main.conf;

# NGINX App Protect alternative
load_module modules/ngx_http_app_protect_module.so;
app_protect_enable on;
app_protect_policy_file "/etc/app_protect/conf/NginxDefaultPolicy.json";
app_protect_security_log_enable on;
app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=127.0.0.1:514;

2. OpenTracing → OpenTelemetry Migration

# Legacy OpenTracing configuration (removal scheduled for R34)
# load_module modules/ngx_http_opentracing_module.so;
# opentracing_load_tracer /usr/local/lib/libjaegertracing_plugin.so /etc/jaeger-config.json;
# opentracing on;

# OpenTelemetry alternative
load_module modules/ngx_http_otel_module.so;
otel_exporter {
    endpoint http://jaeger:14268/api/traces;
}
otel_trace on;

3. Legacy SSL Directive Migration

# Legacy approach (removed in R30)
# server {
#     listen 443;
#     ssl on;
# }

# Recommended approach
server {
    listen 443 ssl;
    listen [::]:443 ssl;
}

Special Considerations for Offline Environments

NGINX Instance Manager Configuration

# /etc/nginx/nginx.conf
mgmt {
    usage_report endpoint=nim.internal.company:443 interval=1h;
    enforce_initial_report on;
    license_token /etc/nginx/license.jwt;
}

# NIM to F5 forwarding configuration (requires NIM 2.18+)

Firewall Rules Example

# Allow outbound HTTPS
sudo iptables -A OUTPUT -p tcp --dport 443 -d product.connect.nginx.com -j ACCEPT

# Allow connection to internal NIM
sudo iptables -A OUTPUT -p tcp --dport 443 -d nim.internal.company -j ACCEPT

Monitoring and Verification Methods

License Status Verification

# Verify license file
sudo nginx -t
sudo ls -la /etc/nginx/license.jwt

# Check usage reporting in logs
sudo tail -f /var/log/nginx/error.log | grep -E "(usage|report|license)"

# License status via API
curl http://localhost:8080/api/9/nginx

Post-Upgrade Verification Checklist

Emergency Response Guide

License Reporting Failure Response

1. Immediate Response (within 180-day grace period)

   # Check network connectivity
   telnet product.connect.nginx.com 443
   
   # Verify DNS resolution  
   nslookup product.connect.nginx.com
   
   # Check proxy configuration
   echo $https_proxy
   

2. Temporary Grace Period Activation

   mgmt {
       usage_report endpoint=product.connect.nginx.com:443;
       enforce_initial_report off;  # Temporarily disable
   }
   

Rollback Procedure

# 1. Stop service
sudo systemctl stop nginx

# 2. Restore previous version
sudo yum downgrade nginx-plus

# 3. Restore configuration files
sudo cp /etc/nginx/nginx.conf.backup /etc/nginx/nginx.conf

# 4. Restart service
sudo systemctl start nginx

For stable NGINX Plus operations, it’s crucial to understand licensing policies and support lifecycles while establishing regular update plans. Particularly important is reviewing network configurations and license management processes in response to JWT licensing changes.