terraform Configuring GitLab EE and CE Access Learn how to use on premise installation of GitLab Enterprise Edition EE or GitLab Community Edition CE for VCS features page title GitLab EE and CE VCS Providers HCP Terraform These instructions are for using an on premise installation of GitLab Enterprise Edition EE or GitLab Community Edition CE for HCP Terraform s VCS features GitLab com has separate instructions terraform cloud docs vcs gitlab com as do the other supported VCS providers terraform cloud docs vcs

Answer:
---
page_title: GitLab EE and CE - VCS Providers - HCP Terraform
description: >-
  Learn how to use on-premise installation of GitLab Enterprise Edition (EE) or GitLab Community Edition (CE) for VCS features.
---

# Configuring GitLab EE and CE Access

These instructions are for using an on-premise installation of GitLab Enterprise Edition (EE) or GitLab Community Edition (CE) for HCP Terraform's VCS features. [GitLab.com has separate instructions,](/terraform/cloud-docs/vcs/gitlab-com) as do the [other supported VCS providers.](/terraform/cloud-docs/vcs)

Configuring a new VCS provider requires permission to manage VCS settings for the organization. ([More about permissions.](/terraform/cloud-docs/users-teams-organizations/permissions))

[permissions-citation]: #intentionally-unused---keep-for-maintainers

Connecting HCP Terraform to your VCS involves four steps:

| On your VCS                                                                                | On HCP Terraform                                                          |
| ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
|                                                                                | Create a new connection in HCP Terraform. Get redirect URI.               |
| Register your HCP Terraform organization as a new app. Provide redirect URI. Get ID and key. |                                                                             |
|                                                                                | Provide HCP Terraform with application ID and secret. Request VCS access. |
| Approve access request.                                                                        |                                                                             |

The rest of this page explains the on-premise GitLab versions of these steps.

~> **Important:** HCP Terraform needs to contact your GitLab instance during setup and during normal operation. For the SaaS version of HCP Terraform, this means GitLab must be internet-accessible; for Terraform Enterprise, you must have network connectivity between your Terraform Enterprise and GitLab instances.

-> **Note:** Alternately, you can skip the OAuth configuration process and authenticate with a personal access token. This requires using HCP Terraform's API. For details, see [the OAuth Clients API page](/terraform/cloud-docs/api-docs/oauth-clients).

-> **Version Note:** HCP Terraform supports GitLab versions 9.0 and newer. HashiCorp does not test older versions of GitLab with HCP Terraform, and they might not work as expected. Also note that, although we do not deliberately remove support for versions that have reached end of life (per the [GitLab Support End of Life Policy](https://docs.gitlab.com/ee/policy/maintenance.html#patch-releases)), our ability to resolve customer issues with end of life versions might be limited.

## Step 1: On HCP Terraform, Begin Adding a New VCS Provider

1. Go to your organization's settings and then click **Providers**. The **VCS Providers** page appears.

1. Click **Add VCS Provider**. The **VCS Providers** page appears.

1. Select **GitLab** and then select **GitLab Enterprise Edition** or **GitLab Community Edition** from the menu. The page moves to the next step.

1. In the "Set up provider" step, fill in the **HTTP URL** and **API URL** of your GitLab Enterprise Edition or GitLab Community Edition instance, as well as an optional **Name** for this VCS connection. Click "Continue."

   | Field    | Value                                       |
   | -------- | ------------------------------------------- |
   | HTTP URL | `https://<GITLAB INSTANCE HOSTNAME>`        |
   | API URL  | `https://<GITLAB INSTANCE HOSTNAME>/api/v4` |

   Note that HCP Terraform uses GitLab's v4 API.

Leave the page open in a browser tab. In the next step you will copy values from this page, and in later steps you will continue configuring HCP Terraform.

## Step 2: On GitLab, Create a New Application

1. In a new browser tab, open your GitLab instance and log in as whichever account you want HCP Terraform to act as. For most organizations this should be a dedicated service user, but a personal account will also work.

   ~> **Important:** The account you use for connecting HCP Terraform **must have admin (master) access** to any shared repositories of Terraform configurations, since creating webhooks requires admin permissions. Do not create the application as an administrative application not owned by a user; HCP Terraform needs user access to repositories to create webhooks and ingress configurations.

   ~> **Important**: In GitLab CE or EE 10.6 and up, you may also need to enable **Allow requests to the local network from hooks and services** on the "Outbound requests" section inside the Admin area under Settings (`/admin/application_settings/network`). Refer to [the GitLab documentation](https://docs.gitlab.com/ee/security/webhooks.html) for details.

1. Navigate to GitLab's "User Settings > Applications" page.

   This page is located at `https://<GITLAB INSTANCE HOSTNAME>/profile/applications`. You can also reach it through GitLab's menus:

   - Click your profile picture and choose "Settings."
   - Click "Applications."

1. This page has a list of applications and a form for adding new ones. The form has two text fields and some checkboxes.

   Fill out the fields and checkboxes with the corresponding values currently displayed in your HCP Terraform browser tab. HCP Terraform lists the values in the order they appear, and includes controls for copying values to your clipboard.

   Fill out the form as follows:

   | Field                   | Value                                          |
   | ----------------------- | ---------------------------------------------- |
   | Name                    | HCP Terraform (`<YOUR ORGANIZATION NAME>`)   |
   | Redirect URI            | `https://app.terraform.io/<YOUR CALLBACK URL>` |
   | Confidential (checkbox) | ✔ (enabled)                                   |
   | Expire access tokens (checkbox) | (no longer required)                   |
   | Scopes (all checkboxes) | api                                            |

   -> **Note:** For previous versions of HCP Terraform and GitLab, we recommended disabling a setting called `Expire access tokens`. This action was required because Gitlab marked OAuth tokens as expired after 2 hours, but HCP Terraform only refreshed tokens after 6 hours. This setting does not exist on Gitlab v15+ and HCP Terraform now refreshes tokens more often.

1. Click the "Save application" button, which creates the application and takes you to its page.

1. Leave this page open in a browser tab. In the next step, you will copy and paste the unique **Application ID** and **Secret.**

## Step 3: On HCP Terraform, Set up Your Provider

1. On the "Configure settings" step on HCP Terraform, enter the **Application ID** and **Secret** from the previous step.

1. Click **Connect and continue.** This takes you to a page on GitLab asking whether you want to authorize the app. Alternatively, if you are redirected to a 500 error, it usually means HCP Terraform was unable to reach your GitLab instance.

1. Click the green **Authorize** button at the bottom of the authorization page.

## Step 4: On HCP Terraform, Configure Advanced Settings (Optional)

The settings in this section are optional. The Advanced Settings you can configure are:
- **Scope of VCS Provider** - You can configure which workspaces can use repositories from this VCS provider. By default the **All Projects** option is selected, meaning this VCS provider is available to be used by all workspaces in the organization.
- **Set up a PEM formatted SSH Keypair** - Most organizations will not need to add an SSH key. However, if the organization repositories include Git submodules that can only be accessed via SSH, an SSH key can be added along with the OAuth credentials. You can add or update the SSH key at a later time.

### If You Don't Need to Configure Advanced Settings:

1. Click the **Skip and Finish** button. This returns you to HCP Terraform's VCS Provider page, which now includes your new GitLab client.

### If You Need to Limit the Scope of this VCS Provider:

1. Select the **Selected Projects** option and use the text field that appears to search for and select projects to enable. All current and future workspaces for any selected projects can use repositories from this VCS Provider.

1. Click the **Update VCS Provider** button to save your selections.

### If You Do Need a PEM formatted SSH Keypair:

#### Important Notes

- SSH will only be used to clone Git submodules. All other Git operations will still use HTTPS.
- Do not use your personal SSH key to connect HCP Terraform and GitLab; generate a new one or use an existing key reserved for service access.
- In the following steps, you must provide HCP Terraform with the private key. Although HCP Terraform does not display the text of the key to users after it is entered, it retains it and will use it when authenticating to GitLab.
- **Protect this private key carefully.** It can push code to the repositories you use to manage your infrastructure. Take note of your organization's policies for protecting important credentials and be sure to follow them.

1. On a secure workstation, create a PEM formatted SSH keypair that HCP Terraform can use to connect to GitLab. The exact command depends on your OS, but is usually something like:
   `ssh-keygen -t rsa -m PEM -f "/Users/<NAME>/.ssh/service_terraform" -C "service_terraform_enterprise"`
   This creates a `service_terraform` file with the private key, and a `service_terraform.pub` file with the public key. This SSH key **must have an empty passphrase**. HCP Terraform cannot use SSH keys that require a passphrase.

1. While logged into the GitLab account you want HCP Terraform to act as, navigate to the SSH Keys settings page, add a new SSH key and paste the value of the SSH public key you just created.

1. In HCP Terraform's **Add VCS Provider** page, paste the text of the **SSH private key** you just created, and click the **Add SSH Key** button.

## Finished

At this point, GitLab access for HCP Terraform is fully configured, and you can create Terraform workspaces based on your organization's shared repositories.

page title  GitLab EE and CE   VCS Providers   HCP Terraform description       Learn how to use on premise installation of GitLab Enterprise Edition  EE  or GitLab Community Edition  CE  for VCS features         Configuring GitLab EE and CE Access  These instructions are for using an on premise installation of GitLab Enterprise Edition  EE  or GitLab Community Edition  CE  for HCP Terraform s VCS features   GitLab com has separate instructions    terraform cloud docs vcs gitlab com  as do the  other supported VCS providers    terraform cloud docs vcs   Configuring a new VCS provider requires permission to manage VCS settings for the organization    More about permissions    terraform cloud docs users teams organizations permissions     permissions citation    intentionally unused   keep for maintainers  Connecting HCP Terraform to your VCS involves four steps     On your VCS                                                                                On HCP Terraform                                                                                Create a new connection in HCP Terraform  Get redirect URI                    Register your HCP Terraform organization as a new app  Provide redirect URI  Get ID and key                                                                                Provide HCP Terraform with application ID and secret  Request VCS access      Approve access request                                                                                The rest of this page explains the on premise GitLab versions of these steps        Important    HCP Terraform needs to contact your GitLab instance during setup and during normal operation  For the SaaS version of HCP Terraform  this means GitLab must be internet accessible  for Terraform Enterprise  you must have network connectivity between your Terraform Enterprise and GitLab instances        Note    Alternately  you can skip the OAuth configuration process and authenticate with a personal access token  This requires using HCP Terraform s API  For details  see  the OAuth Clients API page   terraform cloud docs api docs oauth clients         Version Note    HCP Terraform supports GitLab versions 9 0 and newer  HashiCorp does not test older versions of GitLab with HCP Terraform  and they might not work as expected  Also note that  although we do not deliberately remove support for versions that have reached end of life  per the  GitLab Support End of Life Policy  https   docs gitlab com ee policy maintenance html patch releases    our ability to resolve customer issues with end of life versions might be limited      Step 1  On HCP Terraform  Begin Adding a New VCS Provider  1  Go to your organization s settings and then click   Providers    The   VCS Providers   page appears   1  Click   Add VCS Provider    The   VCS Providers   page appears   1  Select   GitLab   and then select   GitLab Enterprise Edition   or   GitLab Community Edition   from the menu  The page moves to the next step   1  In the  Set up provider  step  fill in the   HTTP URL   and   API URL   of your GitLab Enterprise Edition or GitLab Community Edition instance  as well as an optional   Name   for this VCS connection  Click  Continue         Field      Value                                                                                HTTP URL    https    GITLAB INSTANCE HOSTNAME                 API URL     https    GITLAB INSTANCE HOSTNAME  api v4        Note that HCP Terraform uses GitLab s v4 API   Leave the page open in a browser tab  In the next step you will copy values from this page  and in later steps you will continue configuring HCP Terraform      Step 2  On GitLab  Create a New Application  1  In a new browser tab  open your GitLab instance and log in as whichever account you want HCP Terraform to act as  For most organizations this should be a dedicated service user  but a personal account will also work           Important    The account you use for connecting HCP Terraform   must have admin  master  access   to any shared repositories of Terraform configurations  since creating webhooks requires admin permissions  Do not create the application as an administrative application not owned by a user  HCP Terraform needs user access to repositories to create webhooks and ingress configurations           Important    In GitLab CE or EE 10 6 and up  you may also need to enable   Allow requests to the local network from hooks and services   on the  Outbound requests  section inside the Admin area under Settings    admin application settings network    Refer to  the GitLab documentation  https   docs gitlab com ee security webhooks html  for details   1  Navigate to GitLab s  User Settings   Applications  page      This page is located at  https    GITLAB INSTANCE HOSTNAME  profile applications   You can also reach it through GitLab s menus        Click your profile picture and choose  Settings        Click  Applications    1  This page has a list of applications and a form for adding new ones  The form has two text fields and some checkboxes      Fill out the fields and checkboxes with the corresponding values currently displayed in your HCP Terraform browser tab  HCP Terraform lists the values in the order they appear  and includes controls for copying values to your clipboard      Fill out the form as follows        Field                     Value                                                                                Name                      HCP Terraform    YOUR ORGANIZATION NAME             Redirect URI               https   app terraform io  YOUR CALLBACK URL          Confidential  checkbox        enabled                                           Expire access tokens  checkbox     no longer required                           Scopes  all checkboxes    api                                                       Note    For previous versions of HCP Terraform and GitLab  we recommended disabling a setting called  Expire access tokens   This action was required because Gitlab marked OAuth tokens as expired after 2 hours  but HCP Terraform only refreshed tokens after 6 hours  This setting does not exist on Gitlab v15  and HCP Terraform now refreshes tokens more often   1  Click the  Save application  button  which creates the application and takes you to its page   1  Leave this page open in a browser tab  In the next step  you will copy and paste the unique   Application ID   and   Secret         Step 3  On HCP Terraform  Set up Your Provider  1  On the  Configure settings  step on HCP Terraform  enter the   Application ID   and   Secret   from the previous step   1  Click   Connect and continue    This takes you to a page on GitLab asking whether you want to authorize the app  Alternatively  if you are redirected to a 500 error  it usually means HCP Terraform was unable to reach your GitLab instance   1  Click the green   Authorize   button at the bottom of the authorization page      Step 4  On HCP Terraform  Configure Advanced Settings  Optional   The settings in this section are optional  The Advanced Settings you can configure are      Scope of VCS Provider     You can configure which workspaces can use repositories from this VCS provider  By default the   All Projects   option is selected  meaning this VCS provider is available to be used by all workspaces in the organization      Set up a PEM formatted SSH Keypair     Most organizations will not need to add an SSH key  However  if the organization repositories include Git submodules that can only be accessed via SSH  an SSH key can be added along with the OAuth credentials  You can add or update the SSH key at a later time       If You Don t Need to Configure Advanced Settings   1  Click the   Skip and Finish   button  This returns you to HCP Terraform s VCS Provider page  which now includes your new GitLab client       If You Need to Limit the Scope of this VCS Provider   1  Select the   Selected Projects   option and use the text field that appears to search for and select projects to enable  All current and future workspaces for any selected projects can use repositories from this VCS Provider    1  Click the   Update VCS Provider   button to save your selections       If You Do Need a PEM formatted SSH Keypair        Important Notes    SSH will only be used to clone Git submodules  All other Git operations will still use HTTPS    Do not use your personal SSH key to connect HCP Terraform and GitLab  generate a new one or use an existing key reserved for service access    In the following steps  you must provide HCP Terraform with the private key  Although HCP Terraform does not display the text of the key to users after it is entered  it retains it and will use it when authenticating to GitLab      Protect this private key carefully    It can push code to the repositories you use to manage your infrastructure  Take note of your organization s policies for protecting important credentials and be sure to follow them   1  On a secure workstation  create a PEM formatted SSH keypair that HCP Terraform can use to connect to GitLab  The exact command depends on your OS  but is usually something like      ssh keygen  t rsa  m PEM  f   Users  NAME   ssh service terraform   C  service terraform enterprise      This creates a  service terraform  file with the private key  and a  service terraform pub  file with the public key  This SSH key   must have an empty passphrase    HCP Terraform cannot use SSH keys that require a passphrase   1  While logged into the GitLab account you want HCP Terraform to act as  navigate to the SSH Keys settings page  add a new SSH key and paste the value of the SSH public key you just created   1  In HCP Terraform s   Add VCS Provider   page  paste the text of the   SSH private key   you just created  and click the   Add SSH Key   button      Finished  At this point  GitLab access for HCP Terraform is fully configured  and you can create Terraform workspaces based on your organization s shared repositories


terraform HCP Terraform is more powerful when you integrate it with your version control system VCS provider Although you can use many of HCP Terraform s features without one a VCS connection provides additional features and improved workflows In particular Connecting VCS Providers to HCP Terraform page title Connecting VCS Providers HCP Terraform Learn how to connect a version control system VCS to your organization to integrate HCP Terraform into your development workflow and access additional features

Answer:
---
page_title: Connecting VCS Providers - HCP Terraform
description: >-
  Learn how to connect a version control system (VCS) to your organization to integrate HCP Terraform into your development workflow and access additional features.
---

# Connecting VCS Providers to HCP Terraform

HCP Terraform is more powerful when you integrate it with your version control system (VCS) provider. Although you can use many of HCP Terraform's features without one, a VCS connection provides additional features and improved workflows. In particular:

- When workspaces are linked to a VCS repository, HCP Terraform can [automatically initiate Terraform runs](/terraform/cloud-docs/run/ui) when changes are committed to the specified branch.
- HCP Terraform makes code review easier by [automatically predicting](/terraform/cloud-docs/run/ui#speculative-plans-on-pull-requests) how pull requests will affect infrastructure.
- Publishing new versions of a [private Terraform module](/terraform/cloud-docs/registry/publish-modules) is as easy as pushing a tag to the module's repository.

We recommend configuring VCS access when first setting up an organization, and you might need to add additional VCS providers later depending on how your organization grows.

Configuring a new VCS provider requires permission to manage VCS settings for the organization. ([More about permissions.](/terraform/cloud-docs/users-teams-organizations/permissions))

[permissions-citation]: #intentionally-unused---keep-for-maintainers

## Supported VCS Providers

HCP Terraform supports the following VCS providers:
<!-- BEGIN: TFC:only -->
-   [GitHub.com](/terraform/cloud-docs/vcs/github-app)

<!-- END: TFC:only -->

- [GitHub App for TFE](/terraform/enterprise/admin/application/github-app-integration)
- [GitHub.com (OAuth)](/terraform/cloud-docs/vcs/github)
- [GitHub Enterprise](/terraform/cloud-docs/vcs/github-enterprise)
- [GitLab.com](/terraform/cloud-docs/vcs/gitlab-com)
- [GitLab EE and CE](/terraform/cloud-docs/vcs/gitlab-eece)
- [Bitbucket Cloud](/terraform/cloud-docs/vcs/bitbucket-cloud)
- [Bitbucket Data Center](/terraform/cloud-docs/vcs/bitbucket-data-center)
- [Azure DevOps Server](/terraform/cloud-docs/vcs/azure-devops-server)
- [Azure DevOps Services](/terraform/cloud-docs/vcs/azure-devops-services)

Use the links above to see details on configuring VCS access for each supported provider. If you use another VCS that is not supported, you can build an integration via [the API-driven run workflow](/terraform/cloud-docs/run/api).

## How HCP Terraform Uses VCS Access

Most workspaces in HCP Terraform are associated with a VCS repository, which provides Terraform configurations for that workspace. To find out which repos are available, access their contents, and create webhooks, HCP Terraform needs access to your VCS provider.

Although HCP Terraform's API lets you create workspaces and push configurations to them without a VCS connection, the primary workflow expects every workspace to be backed by a repository.

To use configurations from VCS, HCP Terraform needs to do several things:

- Access a list of repositories, to let you search for repos when creating new workspaces.
- Register webhooks with your VCS provider, to get notified of new commits to a chosen branch.
- Download the contents of a repository at a specific commit in order to run Terraform with that code.

~> **Important:** HCP Terraform usually performs VCS actions using a designated VCS user account, but it has no other knowledge about your VCS's authorization controls and does not associate HCP Terraform user accounts with VCS user accounts. This means HCP Terraform's VCS user might have a different level of access to repositories than any given HCP Terraform user. Keep this in mind when selecting a VCS user, as it may affect your security posture in one or both systems.

### Webhooks

HCP Terraform uses webhooks to monitor new commits and pull requests.

- When someone adds new commits to a branch, any HCP Terraform workspaces based on that branch will begin a Terraform run. Usually a user must inspect the plan output and approve an apply, but you can also enable automatic applies on a per-workspace basis. You can prevent automatic runs by locking a workspace. A run will only occur if the workspace has not previously processed a run for the commit SHA.
- When someone submits a pull request/merge request to a branch, any HCP Terraform workspaces based on that branch will perform a [speculative plan](/terraform/cloud-docs/run/remote-operations#speculative-plans) with the contents of the request and links to the results on the PR's page. This helps you avoid merging PRs that cause plan failures.

~> **Important:** In Terraform Enterprise, integration with a SaaS VCS provider (GitHub.com, GitLab.com, Bitbucket Cloud, or Azure DevOps Services) requires ingress from the public internet. This lets the inbound web hooks reach Terraform Enterprise. You should also configure appropriate security controls, such as a Web Application Firewall (WAF).

### SSH Keys

For most supported VCS providers, HCP Terraform does not need an SSH key. This is because Terraform can do everything it needs with the provider's API and an OAuth token. The exceptions are Azure DevOps Server and Bitbucket Data Center, which require an SSH key for downloading repository contents. Refer to the setup instructions for  [Azure DevOps Server](/terraform/cloud-docs/vcs/azure-devops-server) and [Bitbucket Data Center](/terraform/cloud-docs/vcs/bitbucket-data-center) for details.

For other VCS providers, most organizations will not need to add an SSH private key. However, if the organization repositories include Git submodules that can only be accessed via SSH, an SSH key can be added along with the OAuth credentials.

For VCS providers where adding an SSH private key is optional, SSH will only be used to clone Git submodules. All other Git operations will still use HTTPS.

If submodules will be cloned via SSH from a private VCS instance, SSH must be running on the standard port 22 on the VCS server.

To add an SSH key to a VCS connection, finish configuring OAuth in the organization settings, and then use the "add a private SSH key" link on the VCS Provider settings page to add a private key that has access to the submodule repositories. When setting up a workspace, if submodules are required, select "Include submodules on clone". More at [Workspace settings](/terraform/cloud-docs/workspaces/settings).

### Multiple VCS Connections

If your infrastructure code is spread across multiple VCS providers, you can configure multiple VCS connections. You can choose which VCS connection to use whenever you create a new workspace.

#### Scoping VCS Connections using Projects

You can configure which projects can use repositories from a VCS connection. By default each VCS connection is enabled for all workspaces in the organization. If you need to limit which projects can use repositories from a given VCS connection, you can change this setting to enable the connection for only workspaces in the selected projects.

## Configuring VCS Access

HCP Terraform uses the OAuth protocol to authenticate with VCS providers.

~> **Important:** Even if you've used OAuth before, read the instructions carefully. Since HCP Terraform's security model treats each _organization_ as a separate OAuth application, we authenticate with OAuth's developer workflow, which is more complex than the standard user workflow.

The exact steps to authenticate are different for each VCS provider, but they follow this general order:

| On your VCS                                                              | On HCP Terraform                                                               |
| ------------------------------------------------------------------------ | -------------------------------------------------------------------------------- |
| Register your HCP Terraform organization as a new app. Get ID and key. |                                                                                |
|                                                                          | Tell HCP Terraform how to reach VCS, and provide ID and key. Get callback URL. |
| Provide callback URL.                                                    |                                                                                |
|                                                                          | Request VCS access.                                                              |
| Approve access request.                                                  |                                                                                |

For complete details, click the link for your VCS provider:

- [GitHub](/terraform/cloud-docs/vcs/github)
- [GitHub Enterprise](/terraform/cloud-docs/vcs/github-enterprise)
- [GitLab.com](/terraform/cloud-docs/vcs/gitlab-com)
- [GitLab EE and CE](/terraform/cloud-docs/vcs/gitlab-eece)
- [Bitbucket Cloud](/terraform/cloud-docs/vcs/bitbucket-cloud)
- [Bitbucket Data Center](/terraform/cloud-docs/vcs/bitbucket-data-center)
- [Azure DevOps Server](/terraform/cloud-docs/vcs/azure-devops-server)
- [Azure DevOps Services](/terraform/cloud-docs/vcs/azure-devops-services)

-> **Note:** Alternatively, you can skip the OAuth configuration process and authenticate with a personal access token. This requires using HCP Terraform's API. For details, see [the OAuth Clients API page](/terraform/cloud-docs/api-docs/oauth-clients).

<!-- BEGIN: TFC:only -->
### Private VCS

You can use self-hosted HCP Terraform Agents to connect HCP Terraform to your private VCS provider, such as GitHub Enterprise, GitLab Enterprise, and BitBucket Data Center. For more information, refer to [Connect to Private VCS Providers](/terraform/cloud-docs/vcs/private).

<!-- END: TFC:only -->

## Viewing events

VCS events describe changes within your organization for VCS-related actions. The VCS events page only displays events from previously processed commits in the past 30 days. The VCS page indicates previously processed commits with the message, `"Processing skipped for duplicate commit SHA"`.

Viewing VCS events requires permission to manage VCS settings for the organization. ([More about permissions.](/terraform/cloud-docs/users-teams-organizations/permissions))

[permissions-citation]: #intentionally-unused---keep-for-maintainers

To view VCS events for your organization, go to your organization's settings and click **Events**. The **VCS Events** page appears.

page title  Connecting VCS Providers   HCP Terraform description       Learn how to connect a version control system  VCS  to your organization to integrate HCP Terraform into your development workflow and access additional features          Connecting VCS Providers to HCP Terraform  HCP Terraform is more powerful when you integrate it with your version control system  VCS  provider  Although you can use many of HCP Terraform s features without one  a VCS connection provides additional features and improved workflows  In particular     When workspaces are linked to a VCS repository  HCP Terraform can  automatically initiate Terraform runs   terraform cloud docs run ui  when changes are committed to the specified branch    HCP Terraform makes code review easier by  automatically predicting   terraform cloud docs run ui speculative plans on pull requests  how pull requests will affect infrastructure    Publishing new versions of a  private Terraform module   terraform cloud docs registry publish modules  is as easy as pushing a tag to the module s repository   We recommend configuring VCS access when first setting up an organization  and you might need to add additional VCS providers later depending on how your organization grows   Configuring a new VCS provider requires permission to manage VCS settings for the organization    More about permissions    terraform cloud docs users teams organizations permissions     permissions citation    intentionally unused   keep for maintainers     Supported VCS Providers  HCP Terraform supports the following VCS providers       BEGIN  TFC only          GitHub com   terraform cloud docs vcs github app        END  TFC only         GitHub App for TFE   terraform enterprise admin application github app integration     GitHub com  OAuth    terraform cloud docs vcs github     GitHub Enterprise   terraform cloud docs vcs github enterprise     GitLab com   terraform cloud docs vcs gitlab com     GitLab EE and CE   terraform cloud docs vcs gitlab eece     Bitbucket Cloud   terraform cloud docs vcs bitbucket cloud     Bitbucket Data Center   terraform cloud docs vcs bitbucket data center     Azure DevOps Server   terraform cloud docs vcs azure devops server     Azure DevOps Services   terraform cloud docs vcs azure devops services   Use the links above to see details on configuring VCS access for each supported provider  If you use another VCS that is not supported  you can build an integration via  the API driven run workflow   terraform cloud docs run api       How HCP Terraform Uses VCS Access  Most workspaces in HCP Terraform are associated with a VCS repository  which provides Terraform configurations for that workspace  To find out which repos are available  access their contents  and create webhooks  HCP Terraform needs access to your VCS provider   Although HCP Terraform s API lets you create workspaces and push configurations to them without a VCS connection  the primary workflow expects every workspace to be backed by a repository   To use configurations from VCS  HCP Terraform needs to do several things     Access a list of repositories  to let you search for repos when creating new workspaces    Register webhooks with your VCS provider  to get notified of new commits to a chosen branch    Download the contents of a repository at a specific commit in order to run Terraform with that code        Important    HCP Terraform usually performs VCS actions using a designated VCS user account  but it has no other knowledge about your VCS s authorization controls and does not associate HCP Terraform user accounts with VCS user accounts  This means HCP Terraform s VCS user might have a different level of access to repositories than any given HCP Terraform user  Keep this in mind when selecting a VCS user  as it may affect your security posture in one or both systems       Webhooks  HCP Terraform uses webhooks to monitor new commits and pull requests     When someone adds new commits to a branch  any HCP Terraform workspaces based on that branch will begin a Terraform run  Usually a user must inspect the plan output and approve an apply  but you can also enable automatic applies on a per workspace basis  You can prevent automatic runs by locking a workspace  A run will only occur if the workspace has not previously processed a run for the commit SHA    When someone submits a pull request merge request to a branch  any HCP Terraform workspaces based on that branch will perform a  speculative plan   terraform cloud docs run remote operations speculative plans  with the contents of the request and links to the results on the PR s page  This helps you avoid merging PRs that cause plan failures        Important    In Terraform Enterprise  integration with a SaaS VCS provider  GitHub com  GitLab com  Bitbucket Cloud  or Azure DevOps Services  requires ingress from the public internet  This lets the inbound web hooks reach Terraform Enterprise  You should also configure appropriate security controls  such as a Web Application Firewall  WAF        SSH Keys  For most supported VCS providers  HCP Terraform does not need an SSH key  This is because Terraform can do everything it needs with the provider s API and an OAuth token  The exceptions are Azure DevOps Server and Bitbucket Data Center  which require an SSH key for downloading repository contents  Refer to the setup instructions for   Azure DevOps Server   terraform cloud docs vcs azure devops server  and  Bitbucket Data Center   terraform cloud docs vcs bitbucket data center  for details   For other VCS providers  most organizations will not need to add an SSH private key  However  if the organization repositories include Git submodules that can only be accessed via SSH  an SSH key can be added along with the OAuth credentials   For VCS providers where adding an SSH private key is optional  SSH will only be used to clone Git submodules  All other Git operations will still use HTTPS   If submodules will be cloned via SSH from a private VCS instance  SSH must be running on the standard port 22 on the VCS server   To add an SSH key to a VCS connection  finish configuring OAuth in the organization settings  and then use the  add a private SSH key  link on the VCS Provider settings page to add a private key that has access to the submodule repositories  When setting up a workspace  if submodules are required  select  Include submodules on clone   More at  Workspace settings   terraform cloud docs workspaces settings        Multiple VCS Connections  If your infrastructure code is spread across multiple VCS providers  you can configure multiple VCS connections  You can choose which VCS connection to use whenever you create a new workspace        Scoping VCS Connections using Projects  You can configure which projects can use repositories from a VCS connection  By default each VCS connection is enabled for all workspaces in the organization  If you need to limit which projects can use repositories from a given VCS connection  you can change this setting to enable the connection for only workspaces in the selected projects      Configuring VCS Access  HCP Terraform uses the OAuth protocol to authenticate with VCS providers        Important    Even if you ve used OAuth before  read the instructions carefully  Since HCP Terraform s security model treats each  organization  as a separate OAuth application  we authenticate with OAuth s developer workflow  which is more complex than the standard user workflow   The exact steps to authenticate are different for each VCS provider  but they follow this general order     On your VCS                                                                On HCP Terraform                                                                                Register your HCP Terraform organization as a new app  Get ID and key                                                                                Tell HCP Terraform how to reach VCS  and provide ID and key  Get callback URL      Provide callback URL                                                                                Request VCS access                                                                   Approve access request                                                                                For complete details  click the link for your VCS provider      GitHub   terraform cloud docs vcs github     GitHub Enterprise   terraform cloud docs vcs github enterprise     GitLab com   terraform cloud docs vcs gitlab com     GitLab EE and CE   terraform cloud docs vcs gitlab eece     Bitbucket Cloud   terraform cloud docs vcs bitbucket cloud     Bitbucket Data Center   terraform cloud docs vcs bitbucket data center     Azure DevOps Server   terraform cloud docs vcs azure devops server     Azure DevOps Services   terraform cloud docs vcs azure devops services        Note    Alternatively  you can skip the OAuth configuration process and authenticate with a personal access token  This requires using HCP Terraform s API  For details  see  the OAuth Clients API page   terraform cloud docs api docs oauth clients         BEGIN  TFC only         Private VCS  You can use self hosted HCP Terraform Agents to connect HCP Terraform to your private VCS provider  such as GitHub Enterprise  GitLab Enterprise  and BitBucket Data Center  For more information  refer to  Connect to Private VCS Providers   terraform cloud docs vcs private         END  TFC only         Viewing events  VCS events describe changes within your organization for VCS related actions  The VCS events page only displays events from previously processed commits in the past 30 days  The VCS page indicates previously processed commits with the message    Processing skipped for duplicate commit SHA     Viewing VCS events requires permission to manage VCS settings for the organization    More about permissions    terraform cloud docs users teams organizations permissions     permissions citation    intentionally unused   keep for maintainers  To view VCS events for your organization  go to your organization s settings and click   Events    The   VCS Events   page appears


terraform This topic describes how to connect Bitbucket Cloud to HCP Terraform Bitbucket Cloud is the cloud hosted version of Bitbucket For self hosted Bitbucket Data Center instances refer to Configuring Bitbucket Data Center Access terraform cloud docs vcs bitbucket data center Refer to Connecting VCS Providers to HCP Terraform terraform cloud docs vcs for other supported VCS providers Configuring Bitbucket Cloud Access Learn how to use Bitbucket Cloud for VCS features page title Bitbucket Cloud VCS Providers HCP Terraform

Answer:
---
page_title: Bitbucket Cloud - VCS Providers - HCP Terraform
description: >-
  Learn how to use Bitbucket Cloud for VCS features.
---

# Configuring Bitbucket Cloud Access

This topic describes how to connect Bitbucket Cloud to HCP Terraform. Bitbucket Cloud is the cloud-hosted version of Bitbucket. For self-hosted Bitbucket Data Center instances, refer to [Configuring Bitbucket Data Center Access](/terraform/cloud-docs/vcs/bitbucket-data-center). Refer to [Connecting VCS Providers to HCP Terraform](/terraform/cloud-docs/vcs) for other supported VCS providers.

Configuring a new VCS provider requires permission to manage VCS settings for the organization. ([More about permissions.](/terraform/cloud-docs/users-teams-organizations/permissions))

[permissions-citation]: #intentionally-unused---keep-for-maintainers

Connecting HCP Terraform to your VCS involves four steps:

| On your VCS                                                                                | On HCP Terraform                                            |
| ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
|                                                                                | Create a new connection in HCP Terraform. Get callback URL. |
| Register your HCP Terraform organization as a new app. Provide callback URL. Get ID and key. |                                                               |
|                                                                                | Provide HCP Terraform with ID and key. Request VCS access.  |
| Approve access request.                                                                        |                                                               |

The rest of this page explains the Bitbucket Cloud-specific versions of these steps.

## Step 1: On HCP Terraform, Begin Adding a New VCS Provider

1. Go to your organization's settings and then click **Providers**. The **VCS Providers** page appears.

1. Click **Add VCS Provider**. The **VCS Providers** page appears.

1. Select **Bitbucket** and then select **Bitbucket Cloud** from the menu. The page moves to the next step.

Leave the page open in a browser tab. In the next step you will copy values from this page, and in later steps you will continue configuring HCP Terraform.

## Step 2: On Bitbucket Cloud, Create a New OAuth Consumer

1. In a new browser tab, open [Bitbucket Cloud](https://bitbucket.org) and log in as whichever account you want HCP Terraform to act as. For most organizations this should be a dedicated service user, but a personal account will also work.

   ~> **Important:** The account you use for connecting HCP Terraform **must have admin access** to any shared repositories of Terraform configurations, since creating webhooks requires admin permissions.

1. Navigate to Bitbucket's "Add OAuth Consumer" page.

   This page is located at `https://bitbucket.org/<YOUR WORKSPACE NAME>/workspace/settings/oauth-consumers/new`. You can also reach it through Bitbucket's menus:

   - Click your profile picture and choose the workspace you want to access.
   - Click "Settings".
   - Click "OAuth consumers," which is in the "Apps and Features" section.
   - On the OAuth settings page, click the "Add consumer" button.

1. This page has a form with several text fields and checkboxes.

   Fill out the fields and checkboxes with the corresponding values currently displayed in your HCP Terraform browser tab. HCP Terraform lists the values in the order they appear, and includes controls for copying values to your clipboard.

   Fill out the text fields as follows:

   | Field        | Value                                                                         |
   | ------------ | ----------------------------------------------------------------------------- |
   | Name         | HCP Terraform (`<YOUR ORGANIZATION NAME>`)                                  |
   | Description  | Any description of your choice.                                               |
   | Callback URL | `https://app.terraform.io/<YOUR CALLBACK URL>`                                |
   | URL          | `https://app.terraform.io` (or the URL of your Terraform Enterprise instance) |

   Ensure that the "This is a private consumer" option is checked. Then, activate the following permissions checkboxes:

   | Permission type | Permission level |
   | --------------- | ---------------- |
   | Account         | Write            |
   | Repositories    | Admin            |
   | Pull requests   | Write            |
   | Webhooks        | Read and write   |

1. Click the "Save" button, which returns you to the OAuth settings page.

1. Find your new OAuth consumer under the "OAuth Consumers" heading, and click its name to reveal its details.

   Leave this page open in a browser tab. In the next step, you will copy and paste the unique **Key** and **Secret.**

## Step 3: On HCP Terraform, Set up Your Provider

1. Enter the **Key** and **Secret** from the previous step, as well as an optional **Name** for this VCS connection.

1. Click "Connect and continue." This takes you to a page on Bitbucket Cloud asking whether you want to authorize the app.

1. Click the blue "Grant access" button to proceed.

## Step 4: On HCP Terraform, Configure Advanced Settings (Optional)

The settings in this section are optional. The Advanced Settings you can configure are:
- **Scope of VCS Provider** - You can configure which workspaces can use repositories from this VCS provider. By default the **All Projects** option is selected, meaning this VCS provider is available to be used by all workspaces in the organization.
- **Set up SSH Keypair** - Most organizations will not need to add an SSH key. However, if the organization repositories include Git submodules that can only be accessed via SSH, an SSH key can be added along with the OAuth credentials. You can add or update the SSH key at a later time.

### If You Don't Need to Configure Advanced Settings:

1. Click the **Skip and Finish** button. This returns you to HCP Terraform's VCS Provider page, which now includes your new Bitbucket Cloud client.

### If You Need to Limit the Scope of this VCS Provider:

1. Select the **Selected Projects** option and use the text field that appears to search for and select projects to enable. All current and future workspaces for any selected projects can use repositories from this VCS Provider.

1. Click the **Update VCS Provider** button to save your selections.

### If You Do Need an SSH Keypair:

#### Important Notes

- SSH will only be used to clone Git submodules. All other Git operations will still use HTTPS.
- Do not use your personal SSH key to connect HCP Terraform and Bitbucket Cloud; generate a new one or use an existing key reserved for service access.
- In the following steps, you must provide HCP Terraform with the private key. Although HCP Terraform does not display the text of the key to users after it is entered, it retains it and will use it when authenticating to Bitbucket Cloud.
- **Protect this private key carefully.** It can push code to the repositories you use to manage your infrastructure. Take note of your organization's policies for protecting important credentials and be sure to follow them.

1. On a secure workstation, create an SSH keypair that HCP Terraform can use to connect to Bitbucket Cloud. The exact command depends on your OS, but is usually something like:
   `ssh-keygen -t rsa -m PEM -f "/Users/<NAME>/.ssh/service_terraform" -C "service_terraform_enterprise"`
   This creates a `service_terraform` file with the private key, and a `service_terraform.pub` file with the public key. This SSH key **must have an empty passphrase**. HCP Terraform cannot use SSH keys that require a passphrase.

1. While logged into the Bitbucket Cloud account you want HCP Terraform to act as, navigate to the SSH Keys settings page, add a new SSH key and paste the value of the SSH public key you just created.

1. In HCP Terraform's **Add VCS Provider** page, paste the text of the **SSH private key** you just created, and click the **Add SSH Key** button.

## Finished

At this point, Bitbucket Cloud access for HCP Terraform is fully configured, and you can create Terraform workspaces based on your organization's shared repositories.

page title  Bitbucket Cloud   VCS Providers   HCP Terraform description       Learn how to use Bitbucket Cloud for VCS features         Configuring Bitbucket Cloud Access  This topic describes how to connect Bitbucket Cloud to HCP Terraform  Bitbucket Cloud is the cloud hosted version of Bitbucket  For self hosted Bitbucket Data Center instances  refer to  Configuring Bitbucket Data Center Access   terraform cloud docs vcs bitbucket data center   Refer to  Connecting VCS Providers to HCP Terraform   terraform cloud docs vcs  for other supported VCS providers   Configuring a new VCS provider requires permission to manage VCS settings for the organization    More about permissions    terraform cloud docs users teams organizations permissions     permissions citation    intentionally unused   keep for maintainers  Connecting HCP Terraform to your VCS involves four steps     On your VCS                                                                                On HCP Terraform                                                                                Create a new connection in HCP Terraform  Get callback URL      Register your HCP Terraform organization as a new app  Provide callback URL  Get ID and key                                                                                Provide HCP Terraform with ID and key  Request VCS access       Approve access request                                                                                The rest of this page explains the Bitbucket Cloud specific versions of these steps      Step 1  On HCP Terraform  Begin Adding a New VCS Provider  1  Go to your organization s settings and then click   Providers    The   VCS Providers   page appears   1  Click   Add VCS Provider    The   VCS Providers   page appears   1  Select   Bitbucket   and then select   Bitbucket Cloud   from the menu  The page moves to the next step   Leave the page open in a browser tab  In the next step you will copy values from this page  and in later steps you will continue configuring HCP Terraform      Step 2  On Bitbucket Cloud  Create a New OAuth Consumer  1  In a new browser tab  open  Bitbucket Cloud  https   bitbucket org  and log in as whichever account you want HCP Terraform to act as  For most organizations this should be a dedicated service user  but a personal account will also work           Important    The account you use for connecting HCP Terraform   must have admin access   to any shared repositories of Terraform configurations  since creating webhooks requires admin permissions   1  Navigate to Bitbucket s  Add OAuth Consumer  page      This page is located at  https   bitbucket org  YOUR WORKSPACE NAME  workspace settings oauth consumers new   You can also reach it through Bitbucket s menus        Click your profile picture and choose the workspace you want to access       Click  Settings        Click  OAuth consumers   which is in the  Apps and Features  section       On the OAuth settings page  click the  Add consumer  button   1  This page has a form with several text fields and checkboxes      Fill out the fields and checkboxes with the corresponding values currently displayed in your HCP Terraform browser tab  HCP Terraform lists the values in the order they appear  and includes controls for copying values to your clipboard      Fill out the text fields as follows        Field          Value                                                                                Name           HCP Terraform    YOUR ORGANIZATION NAME                                            Description    Any description of your choice                                                       Callback URL    https   app terraform io  YOUR CALLBACK URL                                         URL             https   app terraform io   or the URL of your Terraform Enterprise instance        Ensure that the  This is a private consumer  option is checked  Then  activate the following permissions checkboxes        Permission type   Permission level                                                  Account           Write                   Repositories      Admin                   Pull requests     Write                   Webhooks          Read and write      1  Click the  Save  button  which returns you to the OAuth settings page   1  Find your new OAuth consumer under the  OAuth Consumers  heading  and click its name to reveal its details      Leave this page open in a browser tab  In the next step  you will copy and paste the unique   Key   and   Secret         Step 3  On HCP Terraform  Set up Your Provider  1  Enter the   Key   and   Secret   from the previous step  as well as an optional   Name   for this VCS connection   1  Click  Connect and continue   This takes you to a page on Bitbucket Cloud asking whether you want to authorize the app   1  Click the blue  Grant access  button to proceed      Step 4  On HCP Terraform  Configure Advanced Settings  Optional   The settings in this section are optional  The Advanced Settings you can configure are      Scope of VCS Provider     You can configure which workspaces can use repositories from this VCS provider  By default the   All Projects   option is selected  meaning this VCS provider is available to be used by all workspaces in the organization      Set up SSH Keypair     Most organizations will not need to add an SSH key  However  if the organization repositories include Git submodules that can only be accessed via SSH  an SSH key can be added along with the OAuth credentials  You can add or update the SSH key at a later time       If You Don t Need to Configure Advanced Settings   1  Click the   Skip and Finish   button  This returns you to HCP Terraform s VCS Provider page  which now includes your new Bitbucket Cloud client       If You Need to Limit the Scope of this VCS Provider   1  Select the   Selected Projects   option and use the text field that appears to search for and select projects to enable  All current and future workspaces for any selected projects can use repositories from this VCS Provider    1  Click the   Update VCS Provider   button to save your selections       If You Do Need an SSH Keypair        Important Notes    SSH will only be used to clone Git submodules  All other Git operations will still use HTTPS    Do not use your personal SSH key to connect HCP Terraform and Bitbucket Cloud  generate a new one or use an existing key reserved for service access    In the following steps  you must provide HCP Terraform with the private key  Although HCP Terraform does not display the text of the key to users after it is entered  it retains it and will use it when authenticating to Bitbucket Cloud      Protect this private key carefully    It can push code to the repositories you use to manage your infrastructure  Take note of your organization s policies for protecting important credentials and be sure to follow them   1  On a secure workstation  create an SSH keypair that HCP Terraform can use to connect to Bitbucket Cloud  The exact command depends on your OS  but is usually something like      ssh keygen  t rsa  m PEM  f   Users  NAME   ssh service terraform   C  service terraform enterprise      This creates a  service terraform  file with the private key  and a  service terraform pub  file with the public key  This SSH key   must have an empty passphrase    HCP Terraform cannot use SSH keys that require a passphrase   1  While logged into the Bitbucket Cloud account you want HCP Terraform to act as  navigate to the SSH Keys settings page  add a new SSH key and paste the value of the SSH public key you just created   1  In HCP Terraform s   Add VCS Provider   page  paste the text of the   SSH private key   you just created  and click the   Add SSH Key   button      Finished  At this point  Bitbucket Cloud access for HCP Terraform is fully configured  and you can create Terraform workspaces based on your organization s shared repositories


terraform Learn how to use Bitbucket Data Center for VCS features Configuring Bitbucket Data Center Access page title Bitbucket Data Center VCS Providers HCP Terraform This topic describes how to connect Bitbucket Data Center to HCP Terraform For instructions on how to connect Bitbucket Cloud refer to Configuring Bitbucket Cloud Access terraform cloud docs vcs bitbucket cloud Refer to Connecting VCS Providers to HCP Terraform terraform cloud docs vcs for other supported VCS providers

Answer:
---
page_title: Bitbucket Data Center - VCS Providers - HCP Terraform
description: >-
   Learn how to use Bitbucket Data Center for VCS features.
---

# Configuring Bitbucket Data Center Access

This topic describes how to connect Bitbucket Data Center to HCP Terraform. For instructions on how to connect Bitbucket Cloud, refer to [Configuring Bitbucket Cloud Access](/terraform/cloud-docs/vcs/bitbucket-cloud). Refer to [Connecting VCS Providers to HCP Terraform](/terraform/cloud-docs/vcs) for other supported VCS providers.

**Bitbucket Server is deprecated**.  Atlassian ended support for Bitbucket Server on February 15, 2024, and recommends using either Bitbucket Data Center (v8.0 or newer) or Bitbucket Cloud instead. Refer to the [Atlassian documentation](https://bitbucket.org/blog/cloud-migration-benefits) for additional information.

HCP Terraform will end support Bitbucket Server on August 15, 2024. Terraform Enterprise will also end support for Bitbucket Server in Terraform Enterprise v202410. [Contact HashiCorp support](https://support.hashicorp.com/hc/en-us) if you have any questions regarding this change.

## Overview

The following steps provide an overview of how to connect HCP Terraform and Terraform Enterprise to Bitbucket Data Center:

1. Add a new VCS provider to HCP Terraform or Enterprise.
1. Create a new application link in Bitbucket.
1. Create an SSH key pair. SSH keys must have an empty passphrase because HCP Terraform cannot use SSH keys that require a passphrase.
1. Add an SSH key to Bitbucket. You must complete this step as a non-administrator user in Bitbucket.
1. Add the private SSH key to Terraform.

## Requirements

- You must have permission to manage VCS settings for the organization. Refer to [Permissions](/terraform/cloud-docs/users-teams-organizations/permissions) for additional information.

[permissions-citation]:#intentionally-unused---keep-for-maintainers

- You must have OAuth authentication credentials for Bitbucket Data Center.

- Your instance of Bitbucket Data Center must be internet-accessible on its SSH and HTTP(S) ports. This is because HCP Terraform must be able to contact Bitbucket Data Center over both SSH and HTTP or HTTPS during setup and during normal operation.

- HCP Terraform must have network connectivity to Bitbucket Data Center instances. Note that [Bitbucket Data Center's default ports](https://confluence.atlassian.com/bitbucketserverkb/which-ports-does-bitbucket-server-listen-on-and-what-are-they-used-for-806029586.html) are `7999` for SSH and `7990` for HTTP. Check your configuration to confirm your BitBucket instance's real ports.

## Add a new VCS provider to Terraform

1. Go to your organization's settings and then click **Providers**. The **VCS Providers** page appears.

1. Click **Add VCS Provider**. The **VCS Providers** page appears.

1. Choose **Bitbucket Data Center** from the **Bitbucket** drop-down menu.

1. (Optional) Enter a **Name** for this VCS connection.

1. Specify the URL of your Bitbucket Data Center instance in the **HTTP URL** and **API URL** fields. If the context path is not set for your Bitbucket Data Center instance, the **API URL** is the same as the **HTTP URL**. Refer to the [Atlassian documentation](https://confluence.atlassian.com/bitbucketserver/moving-bitbucket-server-to-a-different-context-path-776640153.html) for additional information. Specify the following values if the context path is set for your Bitbucket Data Center instance:

   - Set the **HTTP URL** field to your Bitbucket Data Center instance URL and add the context path: `https://<BITBUCKET INSTANCE HOSTNAME>/<CONTEXT PATH>`.
   - Set the **API URL** field to your Bitbucket Data Center instance URL: `https://<BITBUCKET INSTANCE HOSTNAME>`.

   By default, HCP Terraform uses port `80` for HTTP and `443` for HTTPS. If Bitbucket Data Center is configured to use non-standard ports or is behind a reverse proxy, you may need to include the port number in the URL.

1. You can either generate new consumer and public keys that you can use to create a new application link in Bitbucket Data Center described in [Create an application link](#create-an-application-link) or use keys from an existing application link:
   - To generate new keys, click **Continue**. Do not leave this screen until you have copied the key values.
   - To use existing keys, enable the **Use Custom Keys** option and enter them into the fields.

## Create an application link

1. Log into Bitbucket Data Center as an admin.
1. Open the **Application Links** administration page using the navigation or by entering `https://<BITBUCKET INSTANCE HOSTNAME>/plugins/servlet/applinks/listApplicationLinks` in your browser's address bar.

1. Click **Application Links** in the sidebar, then click **Create new link**.
1. Choose **Atlassian product** as the link type. This option also works for external applications and lets you continue to use OAuth 1.0 integrations.
1. Enter `https://app.terraform.io` or the hostname of your Terraform Enterprise instance when prompted. You can only specify the main URL once. To connect multiple HCP Terraform organizations to the same Bitbucket Data Center instance, enter the organization URL when creating the link instead. The organization URL is the HCP Terraform URL or Terraform Enterprise hostname appended with `/app/<ORG NAME>`.
1. When prompted, confirm that you wish to use the URL as entered. If you specified HCP Terraform's main URL, click **Continue**.  If you specified an organization URL, enable the **Use this URL** option and then click **Continue**.

1. In the **Link applications** dialog, configure the following settings:
   - Specify `HCP Terraform <ORG NAME>` in the **Application Name** field
   - Choose **Generic Application** from the **Application Type** drop-down menu
   - Enable the **Create incoming link** option

   Leave all the other fields empty.
1. Click **Continue**. The **Link applications** screen progresses to the second configuration screen.
1. In the **Consumer Key** and **Public Key** fields, enter the key values you created in the [Add a new VCS provider to Terraform](#add-a-new-vcs-provider-to-terraform) instructions.
1. In the **Consumer Name** field, enter `HCP Terraform (<ORG NAME>)`.
1. Click **Continue**. Bitbucket prompts you to authorize Terraform to make changes. Before you proceed, verify that you are logged in with the user account that HCP Terraform will use to access Bitbucket and not as a Bitbucket administrator. If Bitbucket returns a 500 error instead of the authorization screen, Terraform may have been unable to reach your Bitbucket Data Center instance.
1. Click **Allow**  and enter the SSH key when prompted.

## Create an SSH key for Terraform

On a secure workstation, create an SSH keypair that HCP Terraform or Terraform Enterprise can use to connect to Bitbucket Data Center. The command for generating SSH keys depends on your OS. The following example for Linux creates a `service_terraform` file with the private key and a `service_terraform.pub` file with the public key:

 ```shell-session
 $ ssh-keygen -t rsa -m PEM -f "/Users/<NAME>/.ssh/service_terraform" -C "service_terraform_enterprise"
 ```

Do not specify a passphrase because Terraform cannot use SSH keys that require a passphrase.

## Add an SSH key to Bitbucket

In the following steps, you must provide HCP Terraform with the private SSH key you created in [Create an SSH key for Terraform](#create-an-ssh-key-for-terraform). Although HCP Terraform does not display the text of the key to users after it is entered, it retains the key and uses it for authenticating to Bitbucket Data Center.

1. If you are logged into Bitbucket Data Center as an administrator, log out before proceeding.
1. Log in with the account that you want to enable HCP Terraform or Terraform Enterprise to log in with. Many organizations use a dedicated service user account for this purpose. The account you use for connecting HCP Terraform must have admin access to any shared repositories of Terraform configurations because since creating webhooks requires admin permissions. Refer to [Requirements](#requirements) for additional information.
1. Open the **SSH keys** page and click the profile icon.
1. Choose **Manage account**.
1. Click **SSH keys** or enter `https://<BITBUCKET INSTANCE HOSTNAME>/plugins/servlet/ssh/account/keys` in the address bar to go to the **SSH keys** screen.
1. Click **Add key** and enter the SSH public key you created in [Create an SSH key for Terraform](#create-an-ssh-key-for-terraform) into the text field. Open the `.pub` file to get the key value.
1. Click **Add key** to finish adding the key.

## Add an SSH private key

Complete the following steps in HCP Terraform or Terraform Enterprise to request access to Bitbucket and add the SSH private key.

1. Open the **SSH keys** settings page and click **Add a private SSH key**. A large text field appears.
1. Enter the text of the **SSH private key** you created in [Create an SSH key for Terraform](#create-an-ssh-key-for-terraform) and click **Add SSH Key**.

## Next steps

After completing these instructions, you can create Terraform workspaces based on your organization's shared repositories. Refer to the following resources for additional guidance:

- [Creating Workspaces](/terraform/cloud-docs/workspaces/create) in HCP Terraform
- [Creating Workspaces](/terraform/enterprise/workspaces/create) in Terraform Enterprise

page title  Bitbucket Data Center   VCS Providers   HCP Terraform description        Learn how to use Bitbucket Data Center for VCS features         Configuring Bitbucket Data Center Access  This topic describes how to connect Bitbucket Data Center to HCP Terraform  For instructions on how to connect Bitbucket Cloud  refer to  Configuring Bitbucket Cloud Access   terraform cloud docs vcs bitbucket cloud   Refer to  Connecting VCS Providers to HCP Terraform   terraform cloud docs vcs  for other supported VCS providers     Bitbucket Server is deprecated     Atlassian ended support for Bitbucket Server on February 15  2024  and recommends using either Bitbucket Data Center  v8 0 or newer  or Bitbucket Cloud instead  Refer to the  Atlassian documentation  https   bitbucket org blog cloud migration benefits  for additional information    HCP Terraform will end support Bitbucket Server on August 15  2024  Terraform Enterprise will also end support for Bitbucket Server in Terraform Enterprise v202410   Contact HashiCorp support  https   support hashicorp com hc en us  if you have any questions regarding this change        Overview  The following steps provide an overview of how to connect HCP Terraform and Terraform Enterprise to Bitbucket Data Center   1  Add a new VCS provider to HCP Terraform or Enterprise  1  Create a new application link in Bitbucket  1  Create an SSH key pair  SSH keys must have an empty passphrase because HCP Terraform cannot use SSH keys that require a passphrase  1  Add an SSH key to Bitbucket  You must complete this step as a non administrator user in Bitbucket  1  Add the private SSH key to Terraform      Requirements    You must have permission to manage VCS settings for the organization  Refer to  Permissions   terraform cloud docs users teams organizations permissions  for additional information     permissions citation   intentionally unused   keep for maintainers    You must have OAuth authentication credentials for Bitbucket Data Center     Your instance of Bitbucket Data Center must be internet accessible on its SSH and HTTP S  ports  This is because HCP Terraform must be able to contact Bitbucket Data Center over both SSH and HTTP or HTTPS during setup and during normal operation     HCP Terraform must have network connectivity to Bitbucket Data Center instances  Note that  Bitbucket Data Center s default ports  https   confluence atlassian com bitbucketserverkb which ports does bitbucket server listen on and what are they used for 806029586 html  are  7999  for SSH and  7990  for HTTP  Check your configuration to confirm your BitBucket instance s real ports      Add a new VCS provider to Terraform  1  Go to your organization s settings and then click   Providers    The   VCS Providers   page appears   1  Click   Add VCS Provider    The   VCS Providers   page appears   1  Choose   Bitbucket Data Center   from the   Bitbucket   drop down menu   1   Optional  Enter a   Name   for this VCS connection   1  Specify the URL of your Bitbucket Data Center instance in the   HTTP URL   and   API URL   fields  If the context path is not set for your Bitbucket Data Center instance  the   API URL   is the same as the   HTTP URL    Refer to the  Atlassian documentation  https   confluence atlassian com bitbucketserver moving bitbucket server to a different context path 776640153 html  for additional information  Specify the following values if the context path is set for your Bitbucket Data Center instance        Set the   HTTP URL   field to your Bitbucket Data Center instance URL and add the context path   https    BITBUCKET INSTANCE HOSTNAME   CONTEXT PATH         Set the   API URL   field to your Bitbucket Data Center instance URL   https    BITBUCKET INSTANCE HOSTNAME        By default  HCP Terraform uses port  80  for HTTP and  443  for HTTPS  If Bitbucket Data Center is configured to use non standard ports or is behind a reverse proxy  you may need to include the port number in the URL   1  You can either generate new consumer and public keys that you can use to create a new application link in Bitbucket Data Center described in  Create an application link   create an application link  or use keys from an existing application link       To generate new keys  click   Continue    Do not leave this screen until you have copied the key values       To use existing keys  enable the   Use Custom Keys   option and enter them into the fields      Create an application link  1  Log into Bitbucket Data Center as an admin  1  Open the   Application Links   administration page using the navigation or by entering  https    BITBUCKET INSTANCE HOSTNAME  plugins servlet applinks listApplicationLinks  in your browser s address bar   1  Click   Application Links   in the sidebar  then click   Create new link    1  Choose   Atlassian product   as the link type  This option also works for external applications and lets you continue to use OAuth 1 0 integrations  1  Enter  https   app terraform io  or the hostname of your Terraform Enterprise instance when prompted  You can only specify the main URL once  To connect multiple HCP Terraform organizations to the same Bitbucket Data Center instance  enter the organization URL when creating the link instead  The organization URL is the HCP Terraform URL or Terraform Enterprise hostname appended with   app  ORG NAME    1  When prompted  confirm that you wish to use the URL as entered  If you specified HCP Terraform s main URL  click   Continue     If you specified an organization URL  enable the   Use this URL   option and then click   Continue     1  In the   Link applications   dialog  configure the following settings       Specify  HCP Terraform  ORG NAME   in the   Application Name   field      Choose   Generic Application   from the   Application Type   drop down menu      Enable the   Create incoming link   option     Leave all the other fields empty  1  Click   Continue    The   Link applications   screen progresses to the second configuration screen  1  In the   Consumer Key   and   Public Key   fields  enter the key values you created in the  Add a new VCS provider to Terraform   add a new vcs provider to terraform  instructions  1  In the   Consumer Name   field  enter  HCP Terraform   ORG NAME     1  Click   Continue    Bitbucket prompts you to authorize Terraform to make changes  Before you proceed  verify that you are logged in with the user account that HCP Terraform will use to access Bitbucket and not as a Bitbucket administrator  If Bitbucket returns a 500 error instead of the authorization screen  Terraform may have been unable to reach your Bitbucket Data Center instance  1  Click   Allow    and enter the SSH key when prompted      Create an SSH key for Terraform  On a secure workstation  create an SSH keypair that HCP Terraform or Terraform Enterprise can use to connect to Bitbucket Data Center  The command for generating SSH keys depends on your OS  The following example for Linux creates a  service terraform  file with the private key and a  service terraform pub  file with the public key       shell session    ssh keygen  t rsa  m PEM  f   Users  NAME   ssh service terraform   C  service terraform enterprise        Do not specify a passphrase because Terraform cannot use SSH keys that require a passphrase       Add an SSH key to Bitbucket  In the following steps  you must provide HCP Terraform with the private SSH key you created in  Create an SSH key for Terraform   create an ssh key for terraform   Although HCP Terraform does not display the text of the key to users after it is entered  it retains the key and uses it for authenticating to Bitbucket Data Center   1  If you are logged into Bitbucket Data Center as an administrator  log out before proceeding  1  Log in with the account that you want to enable HCP Terraform or Terraform Enterprise to log in with  Many organizations use a dedicated service user account for this purpose  The account you use for connecting HCP Terraform must have admin access to any shared repositories of Terraform configurations because since creating webhooks requires admin permissions  Refer to  Requirements   requirements  for additional information  1  Open the   SSH keys   page and click the profile icon  1  Choose   Manage account    1  Click   SSH keys   or enter  https    BITBUCKET INSTANCE HOSTNAME  plugins servlet ssh account keys  in the address bar to go to the   SSH keys   screen  1  Click   Add key   and enter the SSH public key you created in  Create an SSH key for Terraform   create an ssh key for terraform  into the text field  Open the   pub  file to get the key value  1  Click   Add key   to finish adding the key      Add an SSH private key  Complete the following steps in HCP Terraform or Terraform Enterprise to request access to Bitbucket and add the SSH private key   1  Open the   SSH keys   settings page and click   Add a private SSH key    A large text field appears  1  Enter the text of the   SSH private key   you created in  Create an SSH key for Terraform   create an ssh key for terraform  and click   Add SSH Key        Next steps  After completing these instructions  you can create Terraform workspaces based on your organization s shared repositories  Refer to the following resources for additional guidance      Creating Workspaces   terraform cloud docs workspaces create  in HCP Terraform    Creating Workspaces   terraform enterprise workspaces create  in Terraform Enterprise


terraform page title Troubleshooting VCS Providers HCP Terraform Troubleshooting VCS Integration in HCP Terraform This page collects solutions to the most common problems our users encounter with VCS integration in HCP Terraform Learn how to address common problems in VCS integrations

page title  Troubleshooting   VCS Providers   HCP Terraform description       Learn how to address common problems in VCS integrations         Troubleshooting VCS Integration in HCP Terraform  This page collects solutions to the most common problems our users encounter with VCS integration in HCP Terraform      Azure DevOps      Required status checks not sending  When configuring  status checks with Azure DevOps  https   learn microsoft com en us azure devops repos git pr status policy  the web interface may auto populate Genre and Name fields  beneath  Status to check   with incorrect values that do not reflect what HCP Terraform is sending  To function correctly as required checks the Genre must be populated with  Terraform Cloud   or the first segment for a Terraform Enterprise install   and the remainder of the status check goes in the Name field  This requires using the  Enter genre name separately  checkbox to not use the default configuration   In the example below the status check is named  Terraform Cloud paul hcp gianni test 1  and needs to be configured with Genre  Terraform Cloud  and Name  paul hcp gianni test 1      Azure DevOps screenshot  configuring required status checks correctly   img docs ado required status check png   With an older version of Azure DevOps Server it may be that the web interface does not allow entering the Genre and Name separately  In which case the status check will need to be created via the  API  https   learn microsoft com en us rest api azure devops policy configurations create       Bitbucket Data Center  The following errors are specific to Bitbucket Data Center integrations       Clicking  Connect organization   X    with Bitbucket Data Center raises an error message in HCP Terraform  HCP Terraform uses OAuth 1 to authenticate the user to Bitbucket Data Center  The first step in the authentication process is for HCP Terraform to call Bitbucket Data Center to obtain a request token  After the call completes  HCP Terraform redirects you to Bitbucket Data Center with the request token   An error occurs when HCP Terraform calls to Bitbucket Data Center to obtain the request token but the request is rejected  Some common reasons for the request to be rejected are     The API endpoint is unreachable  this can happen if the address or port is incorrect or the domain name doesn t resolve    The certificate used on Bitbucket Data Center is rejected by the HCP Terraform HTTP client because the SSL verification fails  This is often the case with self signed certificates or when the Terraform Enterprise instance is not configured to trust the signing chain of the Bitbucket Data Center SSL certificate   To fix this issue  do the following     Verify that the instance running Terraform Enterprise can resolve the domain name and can reach Bitbucket Data Center    Verify that the HCP Terraform client accepts the HTTPS connection to Bitbucket Data Center  This can be done by performing a  curl  from the Terraform Enterprise instance to Bitbucket Data Center  it should not return any SSL errors    Verify that the Consumer Key  Consumer Name  and the Public Key are configured properly in Bitbucket Data Center    Verify that the HTTP URL and API URL in HCP Terraform are correct for your Bitbucket Data Center instance  This includes the proper scheme  HTTP vs HTTPS   as well as the port       Creating a workspace from a repository hangs indefinitely  displaying a spinner on the confirm button  If you were able to connect HCP Terraform to Bitbucket Data Center but cannot create workspaces  it often means HCP Terraform isn t able to automatically add webhook URLs for that repository   To fix this issue     Make sure you haven t manually entered any webhook URLs for the affected repository or project  Although the Bitbucket Web Post Hooks Plugin documentation describes how to manually enter a hook URL  HCP Terraform handles this automatically  Manually entered URLs can interfere with HCP Terraform s operation     To check the hook URLs for a repository  go to the repository s settings  then go to the  Hooks  page  in the  Workflow  section  and click on the  Post Receive WebHooks  link     Also note that some Bitbucket Data Center versions might allow you to set per project or server wide hook URLs in addition to per repository hooks  These should all be empty  if you set a hook URL that might affect more than one repo when installing the plugin  go back and delete it    Make sure you aren t trying to connect too many workspaces to a single repository  Bitbucket Data Center s webhooks plugin can only attach five hooks to a given repo  You might need to create additional repositories if you need to make more than five workspaces from a single configuration repo      Bitbucket Cloud      HCP Terraform fails to obtain repositories  This typically happens when the HCP Terraform application in Bitbucket Cloud wasn t configured to have the full set of permissions  Go to the OAuth section of the Bitbucket settings  find your HCP Terraform OAuth consumer  click the edit link in the       menu  and ensure it has the required permissions enabled     Permission type   Permission level                                            Account           Write                Repositories      Admin                Pull requests     Write                Webhooks          Read and write         GitHub       Host key verification failed  error in  terraform init  when attempting to ingress Terraform modules via Git over SSH  This is most common when running Terraform 0 10 3 or 0 10 4  which had a bug in handling SSH submodule ingress  Try upgrading affected HCP Terraform workspaces to the latest Terraform version or 0 10 8  the latest in the 0 10 series        HCP Terraform can t ingress Git submodules  with auth errors during init  This usually happens when an SSH key isn t associated with the VCS provider s OAuth client     Go to your organization s  VCS Provider  settings page and check your GitHub client  If it still says  You can add a private SSH key to this connection to be used for git clone operations   instead of  A private SSH key has been added       you need to click the  add a private SSH key  link and add a key    Check the settings page for affected workspaces and ensure that  Include submodules on clone  is enabled   Note that the  SSH Key  section in a workspace s settings is only used for mid run operations like cloning Terraform modules  It isn t used when cloning the linked repository before a run      General  The following errors may occur for all VCS providers except Bitbucket Data Center       HCP Terraform returns 500 after authenticating with the VCS provider   The Callback URL in the OAuth application configuration in the VCS provider probably wasn t updated in the last step of the instructions and still points to the default     path  or an example com link  instead of the full callback url   The fix is to update the callback URL in your VCS provider s application settings  You can look up the real callback URL in HCP Terraform s settings       Can t delete a workspace or module  resulting in 500 errors  This often happens when the VCS connection has been somehow broken  it might have had permissions revoked  been reconfigured  or had the repository removed  Check for these possibilities and contact HashiCorp support for further assistance  including any information you collected in your support ticket        redirect uri mismatch  error on  Connect   The domain name for HCP Terraform s SaaS release changed on 02 22 at 9AM from  atlas hashicorp com  to  app terraform io   If the OAuth client was originally configured on the old domain  using it for a new VCS connection can result in this error   The fix is to update the OAuth Callback URL in your VCS provider to use app terraform io instead of atlas hashicorp com       Can t trigger workspace runs from VCS webhook  A workspace with no runs will not accept new runs from a VCS webhook  You must queue at least one run manually   A workspace will not process a webhook if the workspace previously processed a webhook with the same commit SHA and created a run  To trigger a run  create a new commit  If a workspace receives a webhook with a previously processed commit  HCP Terraform adds a new event to the  VCS Events   terraform cloud docs vcs viewing events  page documenting the received webhook       Changing the URL for a VCS provider  On rare occasions  you might need HCP Terraform to change the URL it uses to reach your VCS provider  This usually only happens if you move your VCS server or the VCS vendor changes their supported API versions   HCP Terraform does not allow you to change the API URL for an existing VCS connection  but you can create a new VCS connection and update existing resources to use it  This is most efficient if you script the necessary updates using HCP Terraform s API  In brief   1   Configure a new VCS connection   terraform cloud docs vcs  with the updated URL  1  Obtain the  oauth token IDs   terraform cloud docs api docs oauth tokens  for the old and new OAuth clients  1   List all workspaces   terraform cloud docs api docs workspaces list workspaces   dealing with pagination if necessary   and use a JSON filtering tool like  jq  to make a list of all workspace IDs whose  attributes vcs repo oauth token id  matches the old VCS connection  1  Iterate over the list of workspaces and  PATCH each one   terraform cloud docs api docs workspaces update a workspace  to use the new  oauth token id   1   List all registry modules   terraform registry api docs list modules  and use their  source  property to determine which ones came from the old VCS connection  1   Delete each affected module   terraform cloud docs api docs private registry modules delete a module   then  create a new module   terraform cloud docs api docs private registry modules publish a private module from a vcs  from the new connection s version of the relevant repo  1  Delete the old VCS connection        Reauthorizing VCS OAuth Providers  If a VCS OAuth connection breaks  you can reauthorize an existing VCS provider while retaining any VCS connected resources  like workspaces  We recommend only using this feature to fix broken VCS connections  We also recommend reauthorizing using the same VCS account to avoid permission changes to your repositories         Important    Reauthorizing is not available when the  TFE Provider  https   registry terraform io providers hashicorp tfe latest docs resources oauth client  is managing the OAuth Client  Instead  you can update the  oauth token  https   registry terraform io providers hashicorp tfe latest docs resources oauth client oauth token  argument with a new token from your VCS Provider   To reauthorize a VCS connection  complete the following steps  1  Go to your organization s settings and click   Providers   under   Version Control    1  Click   Reauthorize   in the   OAuth Token ID   column   1  Confirm the reauthorization  HCP Terraform redirects you to your VCS Provider where you can reauthorize the connection      Certificate Errors on Terraform Enterprise  When debugging failures of VCS connections due to certificate errors  running additional diagnostics using the OpenSSL command may provide more information about the failure   First  attach a bash session to the application container       docker exec  it ptfe atlas sh  c  stty rows 50    stty cols 150    bash       Then run the  openssl s client  command  using the certificate at   tmp cust ca certificates crt  in the container       openssl s client  showcerts  CAfile  tmp cust ca certificates crt  connect git server hostname 443      For example  a Gitlab server that uses a self signed certificate might result in an error like  verify error num 18 self signed certificate   as shown in the output below       bash 4 3  openssl s client  showcerts  CAfile  tmp cust ca certificates crt  connect gitlab local 443 CONNECTED 00000003  depth 0 CN   gitlab local verify error num 18 self signed certificate verify return 1 depth 0 CN   gitlab local verify return 1     Certificate chain  0 s  CN gitlab local    i  CN gitlab local      BEGIN CERTIFICATE      MIIC DCCAeSgAwIBAgIJAIhG2GWtcj7lMA0GCSqGSIb3DQEBCwUAMCAxHjAcBgNV BAMMFWdpdGxhYi1sb2NhbC5oYXNoaS5jbzAeFw0xODA2MDQyMjAwMDhaFw0xOTA2 MDQyMjAwMDhaMCAxHjAcBgNVBAMMFWdpdGxhYi1sb2NhbC5oYXNoaS5jbzCCASIw DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMMgrpo3zsoy2BP AoGIgrYwEMnj PwSOFGNHbclmiVBCW9jvrZrtva8Qh twU7CSQdkeSP34ZgLrRp1msmLvUuVMgPts i7isrI5hug IHLLOGO5xMvxOcrHknvySYJRmvYFriEBPNRPYJGJ9O1ZUVUYeNwW  l9eegBDpJrdsjGmFKCOzZEdUA3zu7PfNgf788uIi4UkVXZNa OFHsZi63OYyfOc2 Zm0 vRKOn17dewOOesHhw77yYbBH8OFsEiC10JCe5y3MD9yrhV1h9Z4niK8rHPXz XEh3JfV BBArodmDbvi4UtT IGdDueUllXv7kbwqvQ67OFmmek0GZOY7ZvMCAwEA AaM5MDcwIAYDVR0RBBkwF4IVZ2l0bGFiLWxvY2FsLmhhc2hpLmNvMBMGA1UdJQQM MAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4IBAQCfkukNV 9vCA 8qoEbPt1M mvf2FHyUD69p Gq 04IhGty3sno4eVcwWEc5EvfNt8vv1FykFQ6zMJuWA0jL9x2s LbC8yuRDnsAlukSBvyazCZ9pt3qseGOLskaVCeOqG3b hJqikZihFUD95IvWNFQs RpvGvnA AH2Lqqeyk2ITtLYj1AcSB1hBSnG 0fdtao9zs0JQsrS59CD1lbbTPPRN orbKtVTWF2JlJxl2watfCNTw6nTCPI 51CYd687T3MuRN7LsTgglzP4xazuNjbWB QGAiQRd6aKj xAJnqjzXt9wl6a493m8aNkyWrxZGHfIA1W70RtMqIC 554flZ4ia      END CERTIFICATE          Server certificate subject  CN gitlab local issuer  CN gitlab local     No client certificate CA names sent Peer signing digest  SHA512 Server Temp Key  ECDH  P 256  256 bits     SSL handshake has read 1443 bytes and written 433 bytes     New  TLSv1 SSLv3  Cipher is ECDHE RSA AES256 GCM SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression  NONE Expansion  NONE No ALPN negotiated SSL Session      Protocol    TLSv1 2     Cipher      ECDHE RSA AES256 GCM SHA384     Session ID  AF5286FB7C7725D377B4A5F556DEB6DDC38B302153DDAE90C552ACB5DC4D86B8     Session ID ctx      Master Key  DB75AEC12C6E7B62246C653C8CB8FC3B90DE86886D68CB09898A6A6F5D539007F7760BC25EC4563A893D34ABCFAAC28A     Key Arg     None     PSK identity  None     PSK identity hint  None     SRP username  None     TLS session ticket lifetime hint  300  seconds      TLS session ticket      0000   03 c1 35 c4 ff 6d 24 a8 6c 70 61 fb 2c dc 2e b8     5  m  lpa          0010   de 4c 6d b0 2c 13 8e b6 63 95 18 ee 4d 33 a6 dc    Lm     c   M3       0020   0d 64 24 f0 8d 3f 9c aa b8 a4 e2 4f d3 c3 4d 88    d         O  M      0030   58 99 10 73 83 93 70 4a 2c 61 e7 2d 41 74 d3 e9   X  s  pJ a  At       0040   83 8c 4a 7f ae 7b e8 56 5c 51 fc 6f fe e3 a0 ec     J    V Q o         0050   3c 2b 6b 13 fc a0 e5 15 a8 31 16 19 11 98 56 43     k      1    VC     0060   16 86 c4 cd 53 e6 c3 61 e2 6c 1b 99 86 f5 a8 bd       S  a l           0070   3c 49 c0 0a ce 81 a9 33 9b 95 2c e1 f4 6d 05 1e    I     3     m       0080   18 fa bf 2e f2 27 cc 0b df 08 13 7e 4d 5a c8 41               MZ A     0090   93 26 23 90 f1 bb ba 3a 15 17 1b 09 6a 14 a8 47               j  G     00a0   61 eb d9 91 0a 5c 4d e0 4a 8f 4d 50 ab 4b 81 aa   a     M J MP K        Start Time  1528152434     Timeout     300  sec      Verify return code  18  self signed certificate      closed