Skip to content

Mention non-experimental TLS settings #1328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 15, 2025
Merged

Mention non-experimental TLS settings #1328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions docs/admin/code_hosts/github.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,21 +192,16 @@ These are OAuth tokens that Sourcegraph receives when a user signs into Sourcegr

### Custom Certificates

> NOTE: Feature supported in Sourcegraph 5.1.5+
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥳



If you are using a self-signed certificate for your GitHub Enterprise instance, configure `tls.external` under `experimentalFeatures`
If you are using a self-signed certificate for your GitHub Enterprise instance, configure `tls.external`
in the **Site configuration** with your certificate(s).

```json
{
"experimentalFeatures": {
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\n..."
]
}
}
}
```

Expand Down
4 changes: 1 addition & 3 deletions docs/admin/code_hosts/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,15 +76,13 @@ It may be the case that you'd like to temporarily disable all `git` and API requ

## Using Self-signed TLS Certificates

To use Sourcegraph with self-signed TLS Certificates, update the site configuration to add the certificate and skip verification of the certificate chain. This configuration exists within the `experimentalFeatures`:
To use Sourcegraph with self-signed TLS Certificates, update the site configuration to add the certificate and skip verification of the certificate chain:

```json
"experimentalFeatures": {
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\n..."
],
"insecureSkipVerify": true
}
}
```
15 changes: 5 additions & 10 deletions docs/admin/config/batch_changes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,19 +306,14 @@ Admins can configure Batch Changes to error when it creates commits that are not

## Custom Certificates

<span class="badge badge-note">Sourcegraph 5.1.5+</span>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥳


If you are using a self-signed certificate for your GitHub Enterprise instance, configure `tls.external` under `experimentalFeatures`
in the **Site configuration** with your certificate(s).
If you are using a self-signed certificate for your GitHub Enterprise instance, configure `tls.external` in the **Site configuration** with your certificate(s).

```json
{
"experimentalFeatures": {
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\n..."
]
}
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\n..."
]
}
}
```
Expand Down
22 changes: 9 additions & 13 deletions docs/admin/config/private-network.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,26 +168,22 @@ Add the formatted certificate to your Sourcegraph site configuration.

```json
{
"experimentalFeatures": {
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\naZ...==\n-----END CERTIFICATE-----"
]
}
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\naZ...==\n-----END CERTIFICATE-----"
]
}
}
```

For organizations with multiple root CAs (uncommon), additional certificates can be added to the array:
```json
{
"experimentalFeatures": {
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\naZ...==\n-----END CERTIFICATE-----",
"-----BEGIN CERTIFICATE-----\nMI...I7\n-----END CERTIFICATE-----"
]
}
"tls.external": {
"certificates": [
"-----BEGIN CERTIFICATE-----\naZ...==\n-----END CERTIFICATE-----",
"-----BEGIN CERTIFICATE-----\nMI...I7\n-----END CERTIFICATE-----"
]
}
}
```
Expand Down
2 changes: 1 addition & 1 deletion docs/cloud/private_connectivity_aws.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ Only if the private artifact registry is protected by authentication, the custom

### Can I use self-signed TLS certificate for my private resources?

Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config#experimentalFeatures) at `experimentalFeatures.tls.external.certificates`.
Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config) at `tls.external.certificates`.

### What is the disaster recovery plan?

Expand Down
2 changes: 1 addition & 1 deletion docs/cloud/private_connectivity_gcp.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,4 +81,4 @@ Only if the private artifact registry is protected by authentication, the custom

### Can I use self-signed TLS certificate for my private resources?

Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config#experimentalFeatures) at `experimentalFeatures.tls.external.certificates`.
Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config) at `tls.external.certificates`.
2 changes: 1 addition & 1 deletion docs/cloud/private_connectivity_public_lb.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,4 +69,4 @@ If private artifact registry is protected by authentication, the customer will n

### Can I use self-signed TLS certificate for my private resources?

Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config#experimentalFeatures) at `experimentalFeatures.tls.external.certificates`.
Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config) at `tls.external.certificates`.
2 changes: 1 addition & 1 deletion docs/cloud/private_connectivity_sourcegraph_connect.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ The tunnel from the agent to the server is encrypted and authenticated by mTLS o

### Can I use Internal PKI or self-signed TLS certificates for my private resources?

Yes. Please work with your account team to add the public certificate chain of your internal CAs, and / or your private resources' self-signed certs, under `experimentalFeatures.tls.external.certificates` in your instance's [site configuration](/admin/config/site_config#experimentalFeatures).
Yes. Please work with your account team to add the public certificate chain of your internal CAs, and / or your private resources' self-signed certs, under `tls.external.certificates` in your instance's [site configuration](/admin/config/site_config).

### Is this connection highly available?

Expand Down