How can I get sourcetree to see a stash repository hosted on https with a self-signed certificate if my PC will not trust the certificate?

[Joe brown]

Just to clarify, this is not related to git not being able to push/pull from stash over https (I use http.sslNoVerify=false to fix that).

In sourcetree when I click "Clone/New" then click browse hosted projects (earth button) I get an SSL errror: "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

I get this error because my network administrator enforces a rule to not trust any SSL certificates. With git I use the sslnoverify setting and in browsers I click through the SSL warning or turn it off alltogether on internal sites. Is there a way to get sourcetree to ignore SSL warnings when browsing hosted(stash) projects?

[Joe brown · Accepted solution]

It appears this isn't currently possible in SourceTree. I submitted a request to add it: https://jira.atlassian.com/browse/SRCTREEWIN-1718

[chadclan]

This was driving me nuts, but I finally found a setting in the SourceTree.exe.config file. It disables cert checks when SourceTree is connecting to the repo meta data web service to allow self signed certs.

<applicationSettings>
    <SourceTree.Properties.Settings>
        <setting name="SourceTreeHomeWebSite" serializeAs="String">
            <value>https://www.sourcetreeapp.com/</value>
        </setting>
        <setting name="ReleaseNotesRelativeUrl" serializeAs="String">
            <value>update/WindowsReleaseNotes.html</value>
        </setting>

************* Set the value to true :)
        <setting name="AllowUncertifiedSSLRequests" serializeAs="String">
            <value>True</value>
        </setting>
*************
        <setting name="IsPortable" serializeAs="String">
            <value>False</value>
        </setting>
    </SourceTree.Properties.Settings>
</applicationSettings>

[Seth]

You may have to set your Stash repos up as standard Git repositories (sacrificing the Hosted Repo integrations). Is that acceptable, or is the extra functionality important?

[Joe brown]

Currently we're using stash, accessing our repos over https and GitExtensions as the client for developers. The only reason I'm really trying to get SourceTree working is for the hosted repo integration.

[Seth]

If you aren't able to get a solution here in the next few days, you'll probably want to file a bug report on jira.atlassian.com. I'm not sure whether the hosted repository communication should respect the git/hg sslNoVerify option, or if they should define a new one.

The only other viable option I can see is to persuade your network administrator to shell out the cash for a valid certificate.

[Karen DuBrucq]

I am encountering the same problem. Did you ever come up with a resolution

[Timothy]

Under Options > Git, there is a checkbox for "Disable SSL certificate...". Have you tried that?

[Joe brown]

This problem is related to SourceTree retrieving project information over https, not git pushing/fetching over https.