Bitbucket Data Center · JetBrains IDEs and Git · Tested October 30, 2026

Bitbucket Data Center: "PKIX path building failed" and "SSL certificate problem: unable to get local issuer certificate"

Both say the same thing: the program does not trust the certificate the Bitbucket server sent. Usually it was signed by the company's own certificate authority, or it is self-signed. The IDE and Git each keep their own list of trusted certificates, apart from the browser's, so a browser that opens Bitbucket without a warning tells you nothing about the other two. Fix it in each program that complains.

The whole answer

Tested on October 30, 2026 on Windows with a small HTTPS server on the same computer, once with a certificate signed by a test certificate authority and once with a self-signed one. Java 21, the Java that current JetBrains IDEs run on, said for both:

javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Git for Windows 2.53 said:

fatal: unable to access 'https://localhost:8443/scm/proj/repo.git/': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)

• For the self-signed certificate, Git said SSL certificate OpenSSL verify result: self-signed certificate (18). Older Git prints the same as SSL certificate problem: unable to get local issuer certificate, the wording in Atlassian's article and in most reports.
• With Windows' own TLS (Secure Channel) instead of OpenSSL, Git said schannel: SEC_E_UNTRUSTED_ROOT (0x80090325) for both.
• Once Java trusted the test certificate authority, the server it signed answered 200, and the self-signed one still failed: trusting a certificate authority does not cover a certificate it did not sign.
• A trusted certificate opened under another name fails too. Java: No subject alternative names matching IP address 127.0.0.1 found or No subject alternative DNS name matching … found. Git: SSL: no alternative certificate subject name matches target hostname '…'. Use the server's name exactly as its certificate has it.

Trust it in the IDE

Ask your administrator for the root certificate of the company's certificate authority (a .crt, .cer or .pem file), or for the server's own certificate if it is self-signed. Then add it with + in:

• 2025.2 and later: Settings › Appearance & Behavior › System Settings › Server Certificates
• 2024.1 to 2025.1: Settings › Tools › Server Certificates

(JetBrains' Server Certificates help, and the same page for each version.) The IDE keeps these in ssl/cacerts in its configuration directory, and they count only for the IDE. When the IDE meets a certificate it does not trust, it shows Untrusted Server's Certificate; accepting it adds it to the same list. Leave Accept non-trusted certificates automatically off: it accepts any certificate at all.

Trust it in Git

Fetch, pull and push in the IDE run your command-line Git, which checks the certificate itself. First see which TLS your Git uses: git config --show-origin --get http.sslBackend. On the computer of the test it was schannel, set in C:/Program Files/Git/etc/gitconfig by the Git for Windows installer.

• OpenSSL: give Git the certificate file for the Bitbucket server only: git config --global http.https://bitbucket.example.com/.sslCAInfo C:/certs/company-root.pem. In the test this let the server through and left github.com working. Without the address, http.sslCAInfo replaces Git's whole list of certificate authorities: github.com then failed with unable to get local issuer certificate (20).
• Secure Channel: Git trusts what Windows trusts. A company certificate authority that IT has installed on Windows is usually there already; a self-signed server certificate has to be added to Windows by whoever manages it. Secure Channel ignores http.sslCAInfo unless http.schannelUseSSLCAInfo is true; with both, the test server passed.
• Not http.sslVerify false: that turns the check off for the host, and Atlassian lists it only as a temporary step while you look for the cause.

When it is the server

If nobody's Git trusts the server, check what the server sends. Atlassian's article on "SSL certificate problem: unable to get local issuer certificate" says that when Bitbucket itself handles HTTPS (an SSL connector, not a proxy in front), its Java keystore must have the whole chain: the intermediate and the root certificate, not only the server's own.

Bitbucket pull requests in IntelliJ IDEA

Pull Request Inbox for Bitbucket, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the pull requests that wait for your review in an IDE tool window, from Bitbucket Cloud and, in beta, from Bitbucket Data Center 8.9 or later with a personal HTTP access token, sent only to that server. It sends its requests through the IDE's own HTTP connection, so the certificates in the IDE's list and the IDE's prompt apply to it, along with the IDE's proxy settings. It talks to the REST API, not through Git, so a Git that does not trust the server does not stop the list, but your own fetch and push need Git to trust it too. The review inbox, diffs and discussions are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Bitbucket and Atlassian are trademarks of Atlassian; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian or JetBrains.

More: Data Center "You are not permitted to access this resource" · "Permission denied (publickey)" · Bitbucket Data Center end of life · 日本語