Git error ssl certificate - Исправление ошибок и поиск оптимальных решений проблем

I am using Git on Windows. I installed the msysGit package. My test repository has a self signed certificate at the server. I can access and use the repository using HTTP without problems. Moving to HTTPS gives the error:

SSL Certificate problem: unable to get local issuer certificate.

I have the self signed certificate installed in the Trusted Root Certification Authorities of my Windows 7 — client machine. I can browse to the HTTPS repository URL in Internet Explorer with no error messages.

This blog post by Philip Kelley explained that cURL does not use the client machine’s certificate store. I followed the blog post’s advice to create a private copy of curl-ca-bundle.crt and configure Git to use it. I am sure Git is using my copy. If I rename the copy; Git complains the file is missing.

I pasted in my certificate, as mentioned in the blog post, I still get the message «unable to get local issuer certificate».

I verified that Git was still working by cloning a GitHub Repository via HTTPS.

The only thing I see that’s different to the blog post is that my certificate is the root — there is no chain to reach it. My certificate originally came from clicking the IIS8 IIS Manager link ‘Create Self Signed Certificate’. Maybe that makes a certificate different in some way to what cURL expects.

How can I get Git/cURL to accept the self signed certificate?

asked May 27, 2014 at 9:15

RichardHowellsRichardHowells

7,3263 gold badges23 silver badges24 bronze badges

The problem is that git by default using the «Linux» crypto backend.

Beginning with Git for Windows 2.14, you can now configure Git to use SChannel, the built-in Windows networking layer as the crypto backend. This means that it will use the Windows certificate storage mechanism and you do not need to explicitly configure the curl CA storage mechanism: https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123(v=vs.85).aspx

Just execute:

git config --global http.sslbackend schannel

That should help.

Using schannel is by now the standard setting when installing git for Windows, also it is recommended to not checkout repositories by SSH anmore if possible, as https is easier to configure and less likely to be blocked by a firewall it means less chance of failure.

answered Oct 30, 2018 at 12:41

Open Git Bash and run the command if you want to completely disable SSL verification.

git config --global http.sslVerify false

Note: This solution opens you to attacks like man-in-the-middle attacks.
Therefore turn on verification again as soon as possible:

git config --global http.sslVerify true

static_rtti

53.1k46 gold badges131 silver badges188 bronze badges

answered Dec 2, 2015 at 17:23

SamirSamir

6,4003 gold badges16 silver badges27 bronze badges

I had this issue as well. In my case, I was trying to get a post-receive Git hook to update a working copy on a server with each push. Tried to follow the instructions in the blog you linked to. Didn’t work for me as well and overriding the settings on a per-user basis didn’t seem to work either.

What I ended up having to do was disable SSL verification (as the article mentions) for Git as a whole. Not the perfect solution, but it’ll work until I can figure out a better one.

I edited the Git config text file (with my favorite line-ending neutral app like Notepad++) located at:

C:Program Files (x86)Gitetcgitconfig

In the [http] block, I added an option to disable sslVerify. It looked like this when I was done:

[http]
    sslVerify = false
    sslCAinfo = /bin/curl-ca-bundle.crt

That did the trick.

NOTE:

This disables SSL verification and is not recommended as a long term solution.
You can disable this per-repository which still isn’t great, but localizes the setting.
With the advent of LetsEncrypt.org, it is now fairly simple, automated and free to set up SSL as an alternative to self-signed certs and negates the need to turn off sslVerify.

answered Aug 6, 2014 at 3:33

kiddaileykiddailey

3,1423 gold badges21 silver badges21 bronze badges

kiddailey I think was pretty close, however I would not disable ssl verification but rather rather just supply the local certificate:

In the Git config file

[http]
    sslCAinfo = /bin/curl-ca-bundle.crt

Or via command line:

git config --global http.sslCAinfo /bin/curl-ca-bundle.crt

Vimes

9,89717 gold badges62 silver badges86 bronze badges

answered Nov 3, 2014 at 8:36

OliverOliver

34.6k12 gold badges64 silver badges77 bronze badges

I faced this issue as well. And finally got resolved by getting guidance from this MSDN Blog.

Update

Actually you need to add the certificate in git’s certificates file curl-ca-bundel.cert that resides in Gitbin directory.

Steps

Open your github page in browser, and click over lock icon in address bar.
In the opened little popup up navigate to ‘view certificate’ link, it will open a popup window.
In which navigate to certificates tab (3rd in my case). Select the top node that is root certificate. And press copy certificate button in the bottom and save the file.
In file explorer navigate Gitbin directory and open curl-ca-bundle.crt in text editor.
Open the exported certificate file (in step 3) in text editor as well.
Copy all of the content from exported certificate to the end of curl-ca-bundle.crt, and save.

Finally check the status. Please note that backup curl-ca-bundle.crt file before editing to remain on safe side.

Franklin Yu

8,3005 gold badges42 silver badges54 bronze badges

answered Jun 23, 2015 at 17:18

Nadeem JamaliNadeem Jamali

1,3333 gold badges16 silver badges26 bronze badges

An answer to Using makecert for Development SSL fixed this for me.

I do not know why, but the certificate created by the simple ‘Create Self Signed Certificate’ link in IIS Manager does not do the trick. I followed the approach in the linked question of creating and installing a self-signed CA Root; then using that to issue a Server Authentication Certificate for my server. I installed both of them in IIS.

That gets my situation the same as the blog post referenced in the original question. Once the root certificate was copy/pasted into curl-ca-bundle.crt the git/curl combo were satisfied.

isherwood

56.5k16 gold badges109 silver badges151 bronze badges

answered May 27, 2014 at 15:12

RichardHowellsRichardHowells

7,3263 gold badges23 silver badges24 bronze badges

To avoid disabling ssl verification entirely or duplicating / hacking the bundled CA certificate file used by git, you can export the host’s certificate chain into a file, and make git use it:

git config --global http.https://the.host.com/.sslCAInfo c:/users/me/the.host.com.cer

If that does not work, you can disable ssl verification only for the host:

git config --global http.https://the.host.com/.sslVerify false

Note : Subjected to possible man in the middle attacks when ssl verification is turned off.

answered Feb 1, 2017 at 22:24

zionyxzionyx

1,86719 silver badges14 bronze badges

In case of github Repositories (or any none-self-signed certs), choosing below while installing Git-on-windows, resolved the issue.

answered Aug 15, 2017 at 15:01

Jawad Al ShaikhJawad Al Shaikh

2,4152 gold badges28 silver badges40 bronze badges

To completely detail out the summary of all the above answers.

Reason

This problem is occuring because git cannot complete the https handshake with the git server were the repository you are trying to access is present.

Solution

Steps to get the certificate from the github server

Open the github you are trying to access in the browser
Press on the lock icon in the address bar > click on ‘certificate’
Go to ‘Certification Path’ tab > select the top most node in the hierarchy of certificates > click on ‘view certificate’
Now click on ‘Details’ and click on ‘Copy to File..’ > Click ‘Next’ > Select ‘Base 64 encoded X509 (.CER)’ > save it to any of your desired path.

Steps to add the certificate to local git certificate store

Now open the certificate you saved in the notepad and copy the content along with —Begin Certificate— and —end certificate—
To find the path were all the certificates are stored for your git, execute the following command in cmd.

git config —list
Check for the key ‘http.sslcainfo’, the corresponding value will be path.

Note: If u can’t find the key http.sslcainfo check for Git’s default path: C:Program FilesGitmingw64sslcerts

Now open ‘ca-bundle.crt’ present in that path.

Note 1 : open this file administrator mode otherwise you will not be able to save it after update. (Tip — you can use Notepad++ for this
purpose)

Note 2 : Before modifying this file please keep a backup elsewhere.

Now copy the contents of file mentioned in step 1 to the file in step 4 at end file, like how other certificates are placed in ca-bundle.crt.
Now open a new terminal and now you should be able to perform operations related to the git server using https.

phifi

2,7131 gold badge20 silver badges39 bronze badges

answered Oct 27, 2020 at 8:58

Paul JasonPaul Jason

2613 silver badges3 bronze badges

I’ve just had the same issue but using sourcetree on windows Same steps for normal GIT on Windows as well. Following the following steps I was able to solve this issue.

Obtain the server certificate tree
This can be done using chrome.
Navigate to be server address.
Click on the padlock icon and view the certificates.
Export all of the certificate chain as base64 encoded files (PEM) format.
Add the certificates to the trust chain of your GIT trust config file
Run «git config —list».
find the «http.sslcainfo» configuration this shows where the certificate trust file is located.
Copy all the certificates into the trust chain file including the «- -BEGIN- -» and the «- -END- -«.
Make sure you add the entire certificate Chain to the certificates file

This should solve your issue with the self-signed certificates and using GIT.

I tried using the «http.sslcapath» configuration but this did not work. Also if i did not include the whole chain in the certificates file then this would also fail. If anyone has pointers on these please let me know as the above has to be repeated for a new install.

If this is the system GIT then you can use the options in TOOLS -> options
GIt tab to use the system GIT and this then solves the issue in sourcetree as well.

answered Jul 19, 2016 at 13:59

JamesDJamesD

2,40623 silver badges38 bronze badges

I have had this issue before, and solve it using the following config.

[http "https://your.domain"] sslCAInfo=/path/to/your/domain/priviate-certificate

Since git 2.3.1, you can put https://your.domain after http to indicate the following certificate is only for it.

answered Nov 9, 2017 at 7:50

Jan 2021 — Got around this in VS2019 by setting Menu > Git > Settings > Git Global Settings > Cryptographic Network Provider > [Secure Channel] instead of [OpenSSL]

Git SSL certificate problem unable to get local issuer certificate (fix)

PS: Didn’t need to set —global or —local http.sslVerify false. I was cloning an Azure DevOps repo which wasn’t using any self signed certs.. This seems like an issue with either VS2019 or Git for Windows.. They need to fix it !!

Dharman♦

29.3k21 gold badges80 silver badges131 bronze badges

answered Jan 15, 2021 at 18:28

veenzveenz

1011 silver badge4 bronze badges

In my case, as I have installed the ConEmu Terminal for Window 7, it creates the ca-bundle during installation at C:Program FilesGitmingw64sslcerts.

Thus, I have to run the following commands on terminal to make it work:

$ git config --global http.sslbackend schannel
$ git config --global http.sslcainfo /mingw64/ssl/certs/ca-bundle.crt

Hence, my C:Program FilesGitetcgitconfig contains the following:

[http]
    sslBackend = schannel
    sslCAinfo = /mingw64/ssl/certs/ca-bundle.crt

Also, I chose same option as mentioned here when installing the Git.

Hope that helps!

answered Jan 20, 2020 at 16:32

rc.adhikarirc.adhikari

1,8141 gold badge21 silver badges23 bronze badges

When using Windows, the problem resides that git by default uses the «Linux» crypto backend. Starting with Git for Windows 2.14, you can configure Git to use SChannel, the built-in Windows networking layer as the crypto backend. To do that, just run the following command in the GIT client:

git config --global http.sslbackend schannel

This means that it will use the Windows certificate storage mechanism and you don’t need to explicitly configure the curl CA storage (http.sslCAInfo) mechanism.

answered May 30, 2022 at 7:47

Nirbhay JhaNirbhay Jha

4615 silver badges12 bronze badges

One thing that messed me up was the format of the path (on my Windows PC). I originally had this:

git config --global http.sslCAInfo C:certscacert.pem

But that failed with the «unable to get local issuer certificate» error.

What finally worked was this:

git config --global http.sslCAInfo "C:\certs\cacert.pem"

answered Feb 21, 2019 at 18:16

solved my problem
git config —global http.sslBackend schannel

answered Jul 26, 2021 at 14:22

Download certificate from this link:
https://github.com/bagder/ca-bundle
Add it to C:Program FilesGitbin and C:Program FilesGitmingw64bin

Then try something like: git clone https://github.com/heroku/node-js-getting-started.git

answered May 6, 2017 at 15:44

ManjeetManjeet

90115 silver badges23 bronze badges

git config —global http.sslVerify false

answered Aug 10, 2021 at 16:49

To fix the especific error SSL certificate problem: unable to get local issuer certificate in git

I had the same issue with Let’s Encrypt certificates .

An web site with https we just to need :

SSLEngine On
SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf

but git pull says :

fatal: unable to access 'https://example.com/git/demo.git/': SSL certificate problem: unable to get local issuer certificate

To fix it, we need also add:

SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

answered Feb 20, 2020 at 23:30

SérgioSérgio

6,8381 gold badge47 silver badges52 bronze badges

In my case, I had to use different certificates for different git repositories.

Follow steps below (If you have a certificate of your repository, you can read from step 5)

Go to remote repository’s site. Ex: github.com, bitbucket.org, tfs.example…
Click Lock icon on the upper left side and click Certificate.
Go to Certification Path tab and double click to .. Root Certificate
Go to Details tab and click Copy to file.
Export/Copy certificate to wherever you want. Ex: C:certsexample.cer
Open git bash at your local repository folder and type:

$ git config http.sslCAInfo "C:certsexample.cer"

Now you can use different certificates for each repository.

Remember, calling with the --global parameter will also change the certificates of git repositories in other folders, so you should not use the --global parameter when executing this command.

answered Oct 13, 2020 at 18:02

okanokan

73010 silver badges11 bronze badges

git config --global http.sslbackend secure-transport

(had to do that after update to Big Sюr)

answered Apr 6, 2021 at 10:47

Anton TropashkoAnton Tropashko

5,3245 gold badges39 silver badges63 bronze badges

This works for me. I opened cmd line and ran following command. and pulled again.

git config —global http.sslVerify false

answered Jul 12, 2022 at 15:53

I’ve had the same problem from Azure DevOps (Visual Studio). Finally I’ve decided to clone my repo using SSH protocol because of i’ve prefered it instead of disabling SSL verification.

You only need to generate a SSH Key, you can do it so… SSH documentation

ssh-keygen

And then, import your public key on yout git host (like Azure Devops, Github, Bitbucket, Gitlab, etc.)

answered Nov 13, 2020 at 21:21

Brian OcampoBrian Ocampo

1,2571 gold badge12 silver badges22 bronze badges

I had this error occur when using visual studio. This occurs when you have the Cryptographic Network provider settings set to OpenSSL in the Visual Studio Options window. When I changed the setting to Secure Channel it solved it for me. This setting must have been set for me when I upgraded my VS.

answered Apr 26, 2021 at 16:51

Error

push failed
fatal: unable to access
SSL certificate problem: unable to get local issuer certificate

Reason

After committing files on a local machine, the «push fail» error can occur when the local Git connection parameters are outdated (e.g. HTTP change to HTTPS).

Solution

Open the .git folder in the root of the local directory
Open the config file in a code editor or text editor (VS Code, Notepad, Textpad)

Replace HTTP links inside the file with the latest HTTPS or SSH link available from the web page of the appropriate Git repo (clone button)
Examples:

url = http://git.[host]/[group/project/repo_name]     (actual path)

replace it with either

url = ssh://git@git.[host]:/[group/project/repo_name] (new path SSH)
url = https://git.[host]/[group/project/repo_name]    (new path HTTPS)

answered Aug 26, 2020 at 7:25

Sven HaileSven Haile

1,01111 silver badges11 bronze badges

I have resolved the issue by adding below entry in ${HOME}/.gitconfig file

[remote «origin»]

proxy=

In most case it will happen when proxy enabled in your machine so above mentioned entry will fix this problem.

answered Oct 7, 2021 at 6:37

You might have a DNS issue and not a certificate issue, so before you disable SSL verification in your Git shell you should rule out a DNS problem. Cases such as these have been mentioned in Q&A forums such as https-issues-possibly-related-to-dns. If you are using WSL on Windows as your terminal, then you can try running sudo echo nameserver 8.8.8.8 > /etc/resolv.conf and then issue the git commands to see if that makes a difference. This does not seem to be a permanent DNS fix (lasting only the lifetime of your terminal session), but it could help you determine whether it is a DNS issue and not a certificate issue. You could also check this document on configuring your network to use a public DNS. Again, this is only to help you determine if your DNS settings might need adjusting in order to help resolve the certificate issues.

answered Aug 10, 2022 at 2:58

Download and install local certificate. Probably it is published at your company site. For instance, *.cer file.

Right click it and select Install Certificate. ‘Certificate Inport Wizard’ will appear. Select Local Machine. Press Next, confirm.
Select Place all certificates in the following store, press Browse and select Trusted Root Certification Authorities, OK, Finish.

Also you can check if other applications can fetch, pull or push data. For instance, in Android Studio or probably IDEA you should select in Settings this checkbox: Use credential helper.

answered Sep 19, 2022 at 7:35

CoolMindCoolMind

25.3k14 gold badges179 silver badges214 bronze badges

I got this error when trying to «clone» the project. One work-around is to just use the «download as zip» on the webpage, which, for me, achieved what I wanted to do.

answered Jan 18 at 18:00

JosephDoggieJosephDoggie

1,5024 gold badges24 silver badges55 bronze badges

This might help some who come across this error. If you are working across a VPN and it becomes disconnected, you can also get this error. The simple fix is to reconnect your VPN.

answered Dec 9, 2020 at 18:22

Источник

What is the ‘ssl certificate problem unable to get local issuer certificate’ error

The unable to get local issuer certificate is a common issue faced by developers when trying to push, pull, or clone a git repository using Git Bash, a command-line tool specific to Windows.

The unable to get local issuer certificate error often occurs when the Git server’s SSL certificate is self-signed. The issue with self-signed certificates is that the private key associated with them cannot be revoked, making it a security vulnerability.

Alternatively, it can be due to incorrect configuration for Git on your system or when using git inside Visual Studio Code (VS Code) terminal.

What causes ‘ssl certificate problem unable to get local issuer certificate’

The unable to get local issuer certificate error is caused by the misconfiguration of the SSL certificate on your local machine. When pushing, pulling, or cloning, Git cannot verify your SSL certification, which leads to the error.

A valid HTTPS handshake requires both the client and the server to create a secure connection, allowing for safe communication between your local machine and where the source code is hosted. When the SSL certificate cannot be verified, Git cannot complete the HTTPS handshake with the server that hosts the repository.

When the unable to get local issuer certificate error occurs in VS Code, it is often because Visual Studio cannot locate the SSL certificate. This may be due to the path being misconfigured on the local machine.

How can you fix ‘ssl certificate problem unable to get local issuer certificate errors’

When ssl certificate problem unable to get local issuer certificate error is caused by a self-signed certificate, the fix is to add the certificate to the trusted certificate store.

By default, the trusted certificate store is located in the following directory for Git Bash:

C:Program FilesGitmingw64sslcerts

Open the file ca-bundle.crt located in the directory above, then copy and paste the Git SSL certificate to the end of the file. Once completed, save the file and run your git pull, push, or clone command.

Disabling SSL certificate validation is not recommended for security purposes. However, it is an option for fixing the ssl certificate problem unable to get local issuer certificate error.

You can disable SSL certificate validation locally in Git using the following command:

$ git -c http.sslVerify=false clone [URL]

You can also disable SSL certificate validation at a global level using the following command:

$ git config --global http.sslVerify false

To re-enable SSL certificate validation, use the following command:

$ git config --global http.sslVerify true

Another method for fixing the ssl certificate problem unable to get local issuer certificate error is to reinstall Git and choose the SSL transport backend option during the installation process.

If the unable to get local issuer certificate error occurs inside Visual Studio Code, you need to grant your repository access to the SSL certificates. To do this, git can be reconfigured with the --global flag on your SSL certificate configuration. This will give the Git server accessibility to the required SSL certificate.

To do this, run the following command in the Terminal:

git config --global http.sslBackend schannel

Accessibility to SSL certificate verification can also be set at the system level. To do this, you must be running in administrator mode before executing the following command:

git config --system http.sslBackend schannel

If the unable to get local issuer certificate error in Visual Studio Code is not due to accessibility but a location misconfiguration, this can be fixed by reassigning the path. This can be done through the following command:

git config --global http.sslcainfo "Path"

How to prevent ‘ssl certificate problem unable to get local issuer certificate’ errors

The main purpose of a SSL certificate is to confirm authentication so that the information passed between client and server is secure. When an unable to get local issuer certificate error occurs, a secure connection cannot be established, and the git client rejects your attempt to push, pull, or clone a repository for security reasons.

While disabling SSL certificates altogether is an option and common fix, it is not recommended. It opens up a security vulnerability for your repository and your local machine. Nevertheless, you can negate the unable to get local issuer certificate error by disabling SSL certificates at a local and global level. If SSL certificates are disabled at a global level, it is good to always enable them again so that other projects are not impacted by the intentional security disablement.

To prevent the error, ensure that you have a valid SSL certificate in your certificate store. Alternatively, you can reinstall your Git Bash with SSL Transport backend selected during the installation process.

If you are using Git via Visual Studio Code and have a valid SSL certificate in your certificate store but still encounter the certificate problem error, use the --global flag on your SSL certificate configuration to grant the Git server accessibility.

Kubernetes Troubleshooting With Komodor

We hope that the guide above helps you better understand the troubleshooting steps you need to take in order to fix the unable to get local issuer certificate error.

Keep in mind that this is just one of many Git errors that can pop up in your k8s logs and cause the system to fail. Due to the complex and distributed nature of k8s, the search for the root cause of each such failure can be stressful, disorienting, and time-consuming.

Komodor is a Kubernetes troubleshooting platform that turns hours of guesswork into actionable answers in just a few clicks. Using Komodor, you can monitor, alert and troubleshoot incidents in your entire K8s cluster.

For each K8s resource, Komodor automatically constructs a coherent view, including the relevant deploys, config changes, dependencies, metrics, and past incidents. Komodor seamlessly integrates and utilizes data from cloud providers, source controls, CI/CD pipelines, monitoring tools, and incident response platforms.

Discover the root cause automatically with a timeline that tracks all changes made in your application and infrastructure.
Quickly tackle the issue, with easy-to-follow remediation instructions.
Give your entire team a way to troubleshoot independently, without having to escalate.

Источник

Platform Notice: Cloud, Server, and Data Center — This article applies equally to all platforms.

Problem

The following is seen on the command line when pushing or pulling:

SSL Certificate problem: unable to get local issuer

Cause

There are two potential causes that have been identified for this issue.

A Self-signed certificate cannot be verified.
Default GIT crypto backend (Windows clients)

Resolution

Resolution #1 — Self Signed certificate

Workaround

Tell git to not perform the validation of the certificate using the global option:

git config --global http.sslVerify false

Please be advised disabling SSL verification globally might be considered a security risk and should be implemented only temporarily

Resolution — Client Side

Please notice that we refer to the Certificate Authority in this article by the acronym CA.

There are several ways this issue has been resolved previously. Below we suggest possible solutions that should be run on the client side:

Ensure the root cert is added to git.exe’s certificate store. The location of this file will depend on how/where GIT was installed. For instance, the trusted certificate store directory for Git Bash is C:Program FilesGitmingw64sslcerts. This is also discussed on this Microsoft blog.
Tell Git where to find the CA bundle, either by running:
```
git config --system http.sslCAPath /absolute/path/to/git/certificates
```
where /absolute/path/to/git/certificates is the path to where you placed the file that contains the CA certificate(s).

or by copying the CA bundle to the /bin directory and adding the following to the gitconfig file:
```
sslCAinfo = /bin/curl-ca-bundle.crt
```
Reinstall Git.
Ensure that the complete certificate chain is present in the CA bundle file, including the root cert.

Resolution — Server Side

This issue can also happen on configurations where Bitbucket Server is secured with an SSL-terminating connector rather than a proxy

Ensure that the Java KeyStore has the entire certificate chain (Intermediate CA and Root CA)
- View the Certificate Chain Details inside the KeyStore using a tool like the KeyStore Explorer to check

Resolution #2 — Default GIT crypto backend

When using Windows, the problem resides that git by default uses the «Linux» crypto backend, so the GIT operation may not complete occasionally. Starting with Git for Windows 2.14, you can configure Git to use SChannel, the built-in Windows networking layer as the crypto backend. To do that, just run the following command in the GIT client:

git config --global http.sslbackend schannel

This means that it will use the Windows certificate storage mechanism and you don’t need to explicitly configure the curl CA storage (http.sslCAInfo) mechanism.

Источник

Содержание

Name already in use
LetsHack / howto / GIT-SSL-Issues.md
error setting certificate verify locations #1484
Comments
Bitbucket Support
Knowledge base
Products
Jira Software
Jira Service Management
Jira Work Management
Confluence
Bitbucket
Resources
Documentation
Community
Suggestions and bugs
Marketplace
Billing and licensing
Viewport
Confluence
SSL certificate problem: Unable to get local issuer certificate
Related content
Still need help?
Problem
Cause
Resolution
Resolution #1 — Self Signed certificate
Resolution #2 — Default GIT crypto backend
SSL certificate problem: self signed certificate in certificate chain #646
Comments
Error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
Problem
Analysis
Solution
Solution 1
Solution 2
Solution 3

Name already in use

LetsHack / howto / GIT-SSL-Issues.md

Go to file T
Go to line L
Copy path
Copy permalink

Copy raw contents

Fixing Git SSL Certificate Issues

Git use SSL extensively to ensure that communication between the Git client and the Git server is encrypted preventing MITM or Man In The Middle Attacks. However this can also cause issues when you’ve setup your own Git server and generate a self signed certificate. We’ve also seen these issues arise when using Git on Windows.

In this short howto we will look at fixing the GIT SSL issues that’s regularly encountered while using windows.

What Do The Errors Look Like

You should not have these issues if developing code on Linux or Raspbian on the Raspberry Pi.
The SSL issues can also crop up when trying to commit code into the master repo at Github from your local windows repository.
Here’s what the error might look like —

There are a few different approaches to sort this out. Let’s look at both of them below.

Option 1 : Turn off Git SSL Verification

You can stop the Git client from verifying your servers certificate and to trust all SSL certificates you use with the Git client.
This has it’s own security risks as you would not be warned if there was a valid problem with the server you are trying to connect to.
That said, it’s the quickest and easiest fix for a non trusted server certificate.
Simply run the below git command on your Git client.

bash# git config —global http.sslVerify false

Option 2 : Tell Git Where Your Certificate Authority Certificates Are Located

Another option is to point your Git client towards a folder that contains the Certificate Authority certificate that was used to sign your Git server’s SSL certificate.
You may not have one of these if you’re using Self Signed certificates.
Save the CA certificate to a folder on your Git client and run the following git command to tell your Git client to use it when connecting t the server:

bash# git config —system http.sslCAPath /git/certificates

Hope either of the above approaches have helped you fix your git SSL issue.

Источник

error setting certificate verify locations #1484

Hi,
I’m trying to follow the windows install instructions here:
http://npmjs.org/doc/README.html#Installing-on-Windows-Experimental
The install git link is dead so I hay have missed something but I installed git and got to:
git clone —recursive git://github.com/isaacs/npm.git
which gives the following error
Cloning into node_modules/abbrev.
error: error setting certificate verify locations:
CAfile: bincurl-ca-bundle.crt
CApath: none
while accessing https://github.com/isaacs/abbrev-js.git/info/refs

fatal: HTTP request failed

The text was updated successfully, but these errors were encountered:

Updated the instructions already. git config —system http.sslcainfo /bin/curl-ca-bundle.crt should make it work.

git config —global http.sslverify «false» will solve the problem

Thanks a ton . I also had the same problem and got that solved with the command you shared just now.Thanks a lot !!

Wow. Thanks @DedrickEnc worked like charm

It should be noted @DedrickEnc’s «solution» turns off the ssl verification and is a «work around» not a solution to the problem.

Thanks good response!

@DedrickEnc thanks ,your advice work ！

@DedrickEnc, Thanks very much from Kiev!

@DedrickEnc You saved my hours. Thanks Man..

@DedrickEnc that worked, thanks!

@DedrickEnc, Thanks you so much!

@DedrickEnc , Thanks, but, what that command mean? Not clear why it work?

DedrickEnc’s response will work but it is ill advised to disable all SSL verification, you can specify specific paths to disable:

DISABLE ALL SSL
// or switch off ALL SSL checks completely by executing:
git config —system http.sslverify false

OR
//Set this in your config to disable it only for the GIVEN url and not for all requests
[http «https://weak.example.com»]
sslVerify = false

Also for me, the cert was just randomly in the wrong place. I made a dummy path to where my terminal thought my cert was, and copied and pasted my cert in there (in my case:

Источник

Bitbucket Support

Knowledge base

Products

Jira Software

Project and issue tracking

Jira Service Management

Service management and customer support

Jira Work Management

Manage any business project

Confluence

Bitbucket

Git code management

Resources

Documentation

Usage and admin help

Answers, support, and inspiration

Suggestions and bugs

Feature suggestions and bug reports

Marketplace

Billing and licensing

Frequently asked questions

Viewport

Confluence

SSL certificate problem: Unable to get local issuer certificate

Still need help?

The Atlassian Community is here for you.

Platform Notice: Cloud, Server, and Data Center — This article applies equally to all platforms .

Problem

The following is seen on the command line when pushing or pulling:

SSL Certificate problem: unable to get local issuer

Cause

There are two potential causes that have been identified for this issue.

A Self-signed certificate cannot be verified.
Default GIT crypto backend (Windows clients)

Resolution

Resolution #1 — Self Signed certificate

Workaround

Tell git to not perform the validation of the certificate using the global option:

Please be advised disabling SSL verification globally might be considered a security risk and should be implemented only temporarily

Resolution — Client Side

Please notice that we refer to the Certificate Authority in this article by the acronym CA.

There are several ways this issue has been resolved previously. Below we suggest possible solutions that should be run on the client side:

C:Program FilesGitmingw64sslcerts.

Tell Git where to find the CA bundle, either by running:

where /absolute/path/to/git/certificates is the path to where you placed the file that contains the CA certificate(s).

or by copying the CA bundle to the /bin directory and adding the following to the gitconfig file:

Ensure that the complete certificate chain is present in the CA bundle file, including the root cert.

Resolution — Server Side

This issue can also happen on configurations where Bitbucket Server is secured with an SSL-terminating connector rather than a proxy

Ensure that the Java KeyStore has the entire certificate chain (Intermediate CA and Root CA)
- View the Certificate Chain Details inside the KeyStore using a tool like the KeyStore Explorer to check

Resolution #2 — Default GIT crypto backend

This means that it will use the Windows certificate storage mechan ism and you don’t need t o explicitly configure the curl CA storage ( http.sslCAInfo ) mechanism.

The following is seen on the command line when pushing or pulling: SSL Certificate problem: unable to get local issuer. This error occurs when a self-signed certificate cannot be verified.

Источник

SSL certificate problem: self signed certificate in certificate chain #646

I am unable to push to git. I see that there have been changes and I’ve been upgrading to catch up, but I’m really stuck. I’m sorry to post this, I’ve been trying to figure it out.

$ git —version
git version 2.17.0.windows.1 // 64 bit

$ git credential-manager version
Git Credential Manager for Windows version 1.16.0

git push origin master
fatal: unable to access ‘https://github.com/Synaccord/synaccord.git/’: SSL certificate problem: self signed certificate in certificate chain

This use to work, but I understand github has gotten more strict about SSL. Fine. But I can’t seem to delete the old certificate and create a new one.

On Windows 10 (Home Version 1709 OS Build 16299.431) when I go to Settings and search for «Credential» I see «Credential Manager», «Manage Windows Credentials», and «Manage Web Credentials». When I click on «Credential Manager» (or any of the three) the list disappears and I’m back to the search option. Has credential management been removed from windows?

git credential-manager ‘delete https://github.com/Synaccord/synaccord.git/
It returns no error, and has no effect on the git push

git config —list //filtered
http.sslcainfo=C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
http.sslbackend=openssl
credential.usehttppath=true
credential.helper=manager
http.sslbackend=openssl
credential.manager=—version

I’m stuck. Any ideas would be appreciated.

The text was updated successfully, but these errors were encountered:

Источник

Error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Problem

When accessing a Git server (pushing or pulling new commits), we get an error:

Analysis

Apparently, the certificate of your Git server is not trusted.

This usually happens if the Git server is using a self-signed SSL certificate, a Let’s Encrypt certificate (which gets renewed every at least 3 months) or simply because the certificate is expired.

BEWARE: This error might also mean that the Git server’s certificate is forged!

Solution

There are basically 3 solutions to this issue:

Turning off the SSL cert check – fast with a possible security risk
Appending a certificate to the system wide trusted ones – requires a bit of effort but more proper
Adding the certificate to the

Solution 1

The first “fast & dirty” solution is simply to disable the SSL certificate check. There are two approaches to achieve this:

First: By setting the GIT_SSL_NO_VERIFY environment variable by executing the following command:

You can set this also in your shell startup script (i.e.

/.bashrc in case of Bash).

Setting GIT_SSL_NO_VERIFY=true will apply to all repos you are using.

If you want to turn off SSL checks only for some repos you can prefix your command with GIT_SSL_NO_VERIFY=true, for example:

Second: By setting the http.sslVerify config value of the repo to false, like this:

This will disable SSL certificate check for a specific repo only.

WARNING: Please note that by turning SSL checks off you are exposing yourself to a possible security risk. While your connection will be SSL encrypted, the SSL certificate might be forged.

You can also disable SSL checking for all repos:

There is a -c switch which enables specific configuration parameter to be passed to git when cloning a repo:

If one wants to disable SSL checks for one specific git server hosting several repositories, one can run :

This should add the setting to the user’s configuration.

Solution 2

Add the certificate to the list of trusted certificates. Follow this:

1. Retrieve the certificate

Replace YOUR_HOST with the hostname or IP of your Git server.

2. Copy the certificate between and including the following enclosing tags:

3. Append the certificate to the file:

This file can have other locations too. Determine the location of the ca-certificates.crt file by running:

Or to automatize create a script shown below. Do not forget to replace YOUR_HOST with the hostname or IP of your Git server in the script.

As a prerequisite you might need to install the libcurl4-openssl-dev package:

Solution 3

One can add a certificate to trusted ones by adding the following into

where file.pem must contain a certificate either retrieved as described in Solution 2 or a self-signed one.

Or one can disable certificate verification by adding to

represents the user’s home directory.

Lastly one can disable SSL cert checks for a specific server:

Источник

Troubleshooting SSL (FREE SELF)

This page contains a list of common SSL-related errors and scenarios that you
may encounter while working with GitLab. It should serve as an addition to the
main SSL documentation:

Omnibus SSL Configuration.
Self-signed certificates or custom Certification Authorities for GitLab Runner.
Manually configuring HTTPS.

Using an internal CA certificate with GitLab

After configuring a GitLab instance with an internal CA certificate, you might
not be able to access it by using various CLI tools. You may experience the
following issues:

curl fails:

curl "https://gitlab.domain.tld"
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

Testing by using the rails console
also fails:

uri = URI.parse("https://gitlab.domain.tld")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = 1
response = http.request(Net::HTTP::Get.new(uri.request_uri))
...
Traceback (most recent call last):
      1: from (irb):5
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate))

The error SSL certificate problem: unable to get local issuer certificate
is displayed when setting up a mirror
from this GitLab instance.

openssl works when specifying the path to the certificate:

/opt/gitlab/embedded/bin/openssl s_client -CAfile /root/my-cert.crt -connect gitlab.domain.tld:443

If you have the previously described issues, add your certificate to
/etc/gitlab/trusted-certs, and then run sudo gitlab-ctl reconfigure.

X.509 key values mismatch error

After configuring your instance with a certificate bundle, NGINX may display
the following error message:

SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

This error message means that the server certificate and key you have provided
don’t match. You can confirm this by running the following command and then
comparing the output:

openssl rsa -noout -modulus -in path/to/your/.key | openssl md5
openssl x509 -noout -modulus -in path/to/your/.crt | openssl md5

The following is an example of an md5 output between a matching key and
certificate. Note the matching md5 hashes:

$ openssl rsa -noout -modulus -in private.key | openssl md5
4f49b61b25225abeb7542b29ae20e98c
$ openssl x509 -noout -modulus -in public.crt | openssl md5
4f49b61b25225abeb7542b29ae20e98c

This is an opposing output with a non-matching key and certificate which shows
different md5 hashes:

$ openssl rsa -noout -modulus -in private.key | openssl md5
d418865077299af27707b1d1fa83cd99
$ openssl x509 -noout -modulus -in public.crt | openssl md5
4f49b61b25225abeb7542b29ae20e98c

If the two outputs differ like the previous example, there’s a mismatch between
the certificate and key. Contact the provider of the SSL certificate for
further support.

Using GitLab Runner with a GitLab instance configured with internal CA certificate or self-signed certificate

Besides getting the errors mentioned in
Using an internal CA certificate with GitLab,
your CI pipelines may get stuck in Pending status. In the runner logs you may
see the following error message:

Dec  6 02:43:17 runner-host01 gitlab-runner[15131]: #033[0;33mWARNING: Checking for jobs... failed
#033[0;m  #033[0;33mrunner#033[0;m=Bfkz1fyb #033[0;33mstatus#033[0;m=couldn't execute POST against
https://gitlab.domain.tld/api/v4/jobs/request: Post https://gitlab.domain.tld/api/v4/jobs/request:
x509: certificate signed by unknown authority

Follow the details in Self-signed certificates or custom Certification Authorities for GitLab Runner.

Mirroring a remote GitLab repository that uses a self-signed SSL certificate

When configuring a local GitLab instance to mirror a repository
from a remote GitLab instance that uses a self-signed certificate, you may see
the SSL certificate problem: self signed certificate error message in the
user interface.

The cause of the issue can be confirmed by checking if:

curl fails:

$ curl "https://gitlab.domain.tld"
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

Testing by using the Rails console also fails:

uri = URI.parse("https://gitlab.domain.tld")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = 1
response = http.request(Net::HTTP::Get.new(uri.request_uri))
...
Traceback (most recent call last):
      1: from (irb):5
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate))

To fix this problem:

Add the self-signed certificate from the remote GitLab instance to the
/etc/gitlab/trusted-certs directory on the local GitLab instance, and then
run sudo gitlab-ctl reconfigure as per the instructions for
installing custom public certificates.
If your local GitLab instance was installed using the Helm Charts, you can
add your self-signed certificate to your GitLab instance.

You may also get another error message when trying to mirror a repository from
a remote GitLab instance that uses a self-signed certificate:

2:Fetching remote upstream failed: fatal: unable to access &amp;#39;https://gitlab.domain.tld/root/test-repo/&amp;#39;:
SSL: unable to obtain common name from peer certificate

In this case, the problem can be related to the certificate itself:

Validate that your self-signed certificate isn’t missing a common name. If it
is, regenerate a valid certificate
Add the certificate to /etc/gitlab/trusted-certs.
Run sudo gitlab-ctl reconfigure.

Unable to perform Git operations due to an internal or self-signed certificate

If your GitLab instance is using a self-signed certificate, or if the
certificate is signed by an internal certificate authority (CA), you might
experience the following errors when attempting to perform Git operations:

$ git clone https://gitlab.domain.tld/group/project.git
Cloning into 'project'...
fatal: unable to access 'https://gitlab.domain.tld/group/project.git/': SSL certificate problem: self signed certificate

$ git clone https://gitlab.domain.tld/group/project.git
Cloning into 'project'...
fatal: unable to access 'https://gitlab.domain.tld/group/project.git/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

To fix this problem:

If possible, use SSH remotes for all Git operations. This is considered more
secure and convenient to use.
If you must use HTTPS remotes, you can try the following:
- Copy the self-signed certificate or the internal root CA certificate to a
  local directory (for example, ~/.ssl) and configure Git to trust your
  certificate:
```
git config --global http.sslCAInfo ~/.ssl/gitlab.domain.tld.crt
```
- Disable SSL verification in your Git client. This is intended as a
  temporary measure, as it could be considered a security risk.
```
git config --global http.sslVerify false
```

SSL_connect wrong version number

A misconfiguration may result in:

gitlab-rails/exceptions_json.log entries containing:

"exception.class":"Excon::Error::Socket","exception.message":"SSL_connect returned=1 errno=0 state=error: wrong version number (OpenSSL::SSL::SSLError)",
"exception.class":"Excon::Error::Socket","exception.message":"SSL_connect returned=1 errno=0 state=error: wrong version number (OpenSSL::SSL::SSLError)",

gitlab-workhorse/current containing:

http: server gave HTTP response to HTTPS client
http: server gave HTTP response to HTTPS client

gitlab-rails/sidekiq.log or sidekiq/current containing:

message: SSL_connect returned=1 errno=0 state=error: wrong version number (OpenSSL::SSL::SSLError)
message: SSL_connect returned=1 errno=0 state=error: wrong version number (OpenSSL::SSL::SSLError)

Some of these errors come from the Excon Ruby gem, and could be generated in
circumstances where GitLab is configured to initiate an HTTPS session to a
remote server that is serving only HTTP.

One scenario is that you’re using object storage, which
isn’t served under HTTPS. GitLab is misconfigured and attempts a TLS handshake,
but the object storage responds with plain HTTP.

`schannel: SEC_E_UNTRUSTED_ROOT`

If you’re on Windows and get the following error:

Fatal: unable to access 'https://gitlab.domain.tld/group/project.git': schannel: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted."

You must specify that Git should use OpenSSL:

git config --system http.sslbackend openssl

Источник

Reason

Solution

Error

Reason

Solution

What is the ‘ssl certificate problem unable to get local issuer certificate’ error

What causes ‘ssl certificate problem unable to get local issuer certificate’

How can you fix ‘ssl certificate problem unable to get local issuer certificate errors’

How to prevent ‘ssl certificate problem unable to get local issuer certificate’ errors

Kubernetes Troubleshooting With Komodor

Problem

Cause

Resolution

Resolution #1 — Self Signed certificate

Resolution #2 — Default GIT crypto backend

Name already in use

LetsHack / howto / GIT-SSL-Issues.md

error setting certificate verify locations #1484

Bitbucket Support

Knowledge base

Products

Jira Software

Jira Service Management

Jira Work Management

Confluence

Bitbucket

Resources

Documentation

Suggestions and bugs

Marketplace

Billing and licensing

Viewport

Confluence

SSL certificate problem: Unable to get local issuer certificate

Related content

Still need help?

Problem

Cause

Resolution

Resolution #1 — Self Signed certificate

Resolution #2 — Default GIT crypto backend

SSL certificate problem: self signed certificate in certificate chain #646

Error: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Problem

Analysis

Solution

Solution 1

Solution 2

Solution 3

Troubleshooting SSL (FREE SELF)

Using an internal CA certificate with GitLab

X.509 key values mismatch error

Using GitLab Runner with a GitLab instance configured with internal CA certificate or self-signed certificate

Mirroring a remote GitLab repository that uses a self-signed SSL certificate

Unable to perform Git operations due to an internal or self-signed certificate

SSL_connect wrong version number

schannel: SEC_E_UNTRUSTED_ROOT

Читайте также:

`schannel: SEC_E_UNTRUSTED_ROOT`