IntelliJ plugin repository unreachable behind proxy: DNS failure or TLS certificate validation error

Question

The goal is to determine why IntelliJ IDEA cannot reach the plugin repository when operating behind a corporate proxy. The Plugins dialog returns a generic connection failure, and the proxy connection test only confirms basic reachability, not a successful TLS handshake to the repository endpoint.

IntelliJ validates repository traffic through the JetBrains Runtime trust store and the IDE’s Server Certificates manager rather than automatically using the operating system store. DNS lookup failures and certificate validation failures can produce the same surface error, and behavior may differ between the bundled runtime and a custom JDK. Importing a proxy root CA may be version-sensitive, and background update checks can cache validation results differently from foreground plugin searches.

Which log entry distinguishes a DNS resolution failure from a TLS certificate validation failure for plugin repository traffic? Does trusting the proxy certificate in the IDE’s Server Certificates manager also require updating the JDK trust store for the bundled JetBrains Runtime? Can background plugin update checks and foreground repository searches maintain separate certificate trust states?

Tasadduq Burney · Answer

The log entry that distinguishes a DNS failure from a TLS validation failure is java.net.UnknownHostException for DNS and javax.net.ssl.SSLHandshakeException or sun.security.validator.ValidatorException for TLS.

Confirmed facts:

The bundled JetBrains Runtime (JBR) used by IntelliJ IDEA validates HTTPS connections against its own trust store, not the OS cacerts.
Trusting the proxy’s root certificate in the IDE’s Server Certificates manager is usually sufficient for JBR; editing the JDK cacerts file is rarely required.
Foreground plugin searches and background update checks run in the same JVM process, so they share the same certificate trust state.

Steps to verify the issue:

Open idea.log and locate the message during a plugin update attempt. Look for UnknownHostException (DNS) or SSLHandshakeException (TLS).
Check the runtime version via Help | About IntelliJ IDEA to confirm the IDE is using the bundled JetBrains Runtime.
In Settings | HTTP Proxy, click Check connection to ensure basic reachability; this does not test TLS handshake.
If the log shows a TLS exception, open Settings | Server Certificates, select the repository host, and click Import to add the proxy’s root certificate.
If the IDE uses a custom JDK, verify that the custom cacerts file contains the same root certificate, because the custom runtime bypasses the IDE trust store.

Missing diagnostic detail that could change the recommendation:

Is the IDE configured to run on a custom JDK rather than the bundled JetBrains Runtime?

IntelliJ plugin repository unreachable behind proxy: DNS failure or TLS certificate validation error

IntelliJ plugin repository unreachable behind proxy: DNS failure or TLS certificate validation error

1 answer

Your perspective belongs here.

0 question comments