Is allowUntrustedServer safe for a Gradle remote build cache?

No. Gradle documents that enabling allowUntrustedServer on an HTTP build cache is a security risk, because it lets any cache server impersonate the intended one. Fix the certificate trust instead, and make sure only CI pushes to the remote cache.

What the setting does

By default, using HTTPS for the remote build cache requires the server to present a certificate trusted by the build's Java runtime. If yours is not trusted, Gradle lists three choices: update the trust store of your Java runtime, change the build environment to use an alternative trust store, or disable the trust requirement with the untrusted server setting.

Gradle's documentation then states the cost directly. Enabling it allows any cache server to impersonate the intended server.

What an impersonator could do

A cache server returns build outputs. Someone who can sit in the network path, or who controls DNS for the cache name, could serve outputs of their choosing. Your build would restore them as if they came from your cache.

The right fix, step by step

1. Get the real cause. Is the certificate self signed, expired or missing the name?
2. For an internal certificate authority, import the authority certificate into the trust store used by the build's Java runtime.
3. Or point the build environment at an alternative trust store that includes it.
4. Keep the trust requirement on everywhere, including developer machines and CI.
5. Search the repository for the setting and remove it. Check both Kotlin and Groovy settings files.

Push rules, the other half

Trust settings protect the read path. The write path needs its own rule. In Gradle, the local cache has push enabled by default, while the remote cache has push disabled by default. Gradle's example enables remote push only when running on a CI server.

buildCache {
    remote(HttpBuildCache::class) {
        url = uri("https://cache.example.internal/cache/")
        isPush = System.getenv("CI") != null
    }
}

A CI variable is a convenience, not a security control. Also restrict by credential on the server: only protected branch jobs should hold a key that allows writes.

Credentials

HTTP Basic Authentication is supported, with credentials sent preemptively. Use it only over HTTPS and keep the secret in your CI secret store rather than in the build file.

Audit checklist

Quick check

Sources

• Gradle documentation: Build cache

Last reviewed: 19 October 2026.