Untrusted Server's Certificate for api.github.com: self-signed api.glb certificate

Problem

IntelliJ-based IDEs (reported in PyCharm 2025.2 and IntelliJ IDEA) intermittently show the Untrusted Server's Certificate dialog for the server address api.github.com:443. The certificate shown in the dialog is self-signed:

• Common name: api.glb
• Organization: Magic Provisioning
• Organizational unit: CI
• Validity: 7/28/26 to 7/28/27

The dialog can reappear after Reject. The prompt applies to each new connection, so this is expected while the problem lasts.

Cause

A GitHub-side incident, active in August 2026: some api.github.com servers intermittently return an internal, self-signed load-balancer certificate instead of the real GitHub certificate. The same certificate is reported by users of GitHub Desktop and other tools, on macOS and Windows. Reports are collected in the GitHub community discussion api.github.com intermittently serves a self-signed api.glb certificate.

This is not an IDE defect, not a TLS-inspecting proxy, and not a sign of a compromised machine. The IDE certificate manager detects the wrong certificate and asks before trusting it, which is the intended behavior.

Resolution

1. Click Reject each time the dialog appears.
2. Do not click Save as Trusted. Trusting the self-signed certificate disables TLS protection for GitHub API traffic.
3. No further action is needed. Retried connections normally receive the correct certificate, so GitHub features keep working. The dialogs stop when GitHub fixes the affected servers.

If the dialogs appear too often, disable the GitHub plugin in Settings | Plugins temporarily. This stops the IDE's background requests to api.github.com. GitHub pull request and clone integration is unavailable while the plugin is disabled.

Ruling out local network interception

The same dialog can also be produced by a device or software between the machine and GitHub: corporate TLS inspection, a VPN, a proxy, or DNS redirection. To confirm the cause is GitHub-side:

1. On a company network or VPN, ask the IT team whether HTTPS traffic is inspected.
2. Check the proxy settings in the operating system and in the IDE (in Settings, search for "HTTP Proxy").
3. Make sure api.github.com is not redirected in the hosts file or by custom DNS.
4. Test from a different network, for example a phone hotspot. If the dialog still appears there, the cause is on GitHub's side.