How to troubleshoot "Untrusted Server Certificate Warning"

Symptoms

• IntelliJ IDEA displays an "Untrusted Server Certificate" warning when connecting to:

  • Git repositories (HTTPS)
  • Remote deployment servers (e.g., via SFTP, FTP over SSL)
  • Web services/APIs using HTTPS
  • Trying to connect with JetBrains services

• Sample popup window which provides the details Common name and Certificate authority and server address(destination)

  

Possible Causes

• The SSL certificate is self-signed or expired.
• The certificate is issued by a non-trusted Certificate Authority (CA).
• IntelliJ IDEA or the underlying Java Runtime Environment (JRE) does not trust the certificate.
• A corporate proxy is intercepting SSL traffic and re-signing certificates.
• Using a custom/internal Git or API server with no valid public SSL cert.

Resolution

To ensure secure communication, your IDE must validate the SSL/TLS server certificates of services it connects to. This affects development tools like Gradle, Maven, Git, and clients for remote servers or APIs using HTTPS. When a connection fails due to a certificate issue, you must configure the IDE to trust that certificate. To resolve these errors, you must add the server's certificate (or its root CA certificate) to the IDE's trust store. By importing a trusted certificate, you are explicitly telling your IDE to accept it as valid.

1. If the certificate is untrusted or suspicious, click 'Reject' to deny the connection.
2. Confirm with the network provider (e.g., ISP) if this certificate is genuine and necessary for proper operation.
3. If required, add the certificate to the IDE trust store by following the guidelines.
4. Ensure your network devices, like modems and routers, are secure and updated to prevent potential impersonation or interception issues.

Scope: which processes use the IDE trust store

The IDE trust store does not cover every process that the IDE starts. A tool that the IDE runs as a separate process has its own JVM, and that JVM reads its own trust store. Check the scope before you conclude that a certificate was imported incorrectly.

Covered:

• Connections that the IDE process makes itself, such as JetBrains services, the plugin repository, and the HTTP Client.
• Maven project import and dependency resolution, since IntelliJ IDEA 2024.3. The Maven server process passes an unknown certificate back to the IDE, and the IDE checks it against the IDE trust store. If it is still unknown, the IDE shows the certificate prompt. See Maven Server SSL should use standard Idea certificate managers. The registry key maven.delegate.trust.ssl.to.ide controls this and is enabled by default. Accepting the prompt applies to that one request. The IDE does not add the certificate to the trust store in this flow.

Not covered:

• Running Maven goals, from a Maven run configuration or from the Maven tool window. This starts a separate mvn process. It reads only the trust store of the JDK that is selected in Maven | Runner.
• Other build tools and command line tools that the IDE starts as external processes.

For a case that is not covered, add the CA certificate to the trust store of the JDK that runs the tool:

keytool -importcert -trustcacerts -cacerts -storepass changeit -alias my-root-ca -file my-root.cer

Run keytool from the bin directory of that JDK. The -cacerts option selects the trust store of the JDK that owns the command.

On Windows, you can instead point the JVM at the Windows certificate store. Add this VM option for the tool:

-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT

This replaces the JDK list of certificates with the Windows list. It does not add to it.

How to always accept non-trusted certificates

To accept non-trusted certificates automatically, go to Settings | Appearance & Behavior | System Settings | Server Certificates and select Accept non-trusted certificates automatically. The IDE then accepts certificates that are not in the list without asking, so use this only on a network you trust:

⚠️ If the issue persists or seems unusual, contacting your ISP or consulting a professional for network analysis might be beneficial. Feel free to reach out to JetBrains support for further analysis.