Disabling HTTPS host authentication in TortoiseHG for internal self-signed certificates

Question

How do you disable HTTPS host authentication in TortoiseHG for internal self-signed certificates. For internal servers HTTPS is primarily used for encryption.

The Torto

Answer 1

In the TortoiseHG Workbench, in the Sync tab (or in the Sync screen), if you have a remote path selected, you should see a button with a lock icon on it:

That will bring up the Security window, where you can select the option No host validation, but still encrypted, among other settings. When you turn that on, it adds something like this to your mercurial.ini:

[insecurehosts]
bitbucket.org = 1

That's machine-level config for TortoiseHg, but it doesn't seem to affect the Clone window.

On the command-line, you can use --insecure to skip verifying certificates:

hg clone --insecure https://hostname.org/user/repository repository-clone

This will spit out a number of warnings about not verifying the certificate, and will also show you the host fingerprint in each message, like the example warning below (formatted from the original for readability):

warning: bitbucket.org certificate with fingerprint 
 24:9c:45:8b:9c:aa:ba:55:4e:01:6d:58:ff:e4:28:7d:2a:14:ae:3b not verified
 (check hostfingerprints or web.cacerts config setting)

A better option, however, is host fingerprints, which are used by both hg and TortoiseHg. In TortoiseHg's Security window, above No host validation is the option Verify with stored host fingerprint. The Query button retrieves the fingerprint of the host's certificate and stores it in mercurial.ini:

[hostfingerprints]
bitbucket.org = 81:2b:08:90:dc:d3:71:ee:e0:7c:b4:75:ce:9b:6c:48:94:56:a1:fe

This should skip actual verification of the certificate because you are declaring that you already trust the certificate.

This documentation on certificates may help, as well.