Git ignore certificate error

Git Self-Signed Certificate Configuration

tl;dr

NEVER disable all SSL verification!

This creates a bad security culture. Don’t be that person.

The config keys you are after are:

• http.sslverify — Always true. See above note.

These are for configuring host certificates you trust

• http.sslCAPath
• http.sslCAInfo

These are for configuring YOUR certificate to respond to SSL challenges.

• http.sslCert
• http.sslCertPasswordProtected

Selectively apply the above settings to specific hosts.

• http.<url>.*

Global .gitconfig for Self-Signed Certificate Authorities

For my own and my colleagues’ sake here is how we managed to get self signed certificates to work without disabling sslVerify. Edit your .gitconfig to using git config --global -e add these:

# Specify the scheme and host as a 'context' that only these settings apply
# Must use Git v1.8.5+ for these contexts to work
[credential "https://your.domain.com"]
  username = user.name

  # Uncomment the credential helper that applies to your platform
  # Windows
  # helper = manager

  # OSX
  # helper = osxkeychain

  # Linux (in-memory credential helper)
  # helper = cache

  # Linux (permanent storage credential helper)
  # https://askubuntu.com/a/776335/491772

# Specify the scheme and host as a 'context' that only these settings apply 
# Must use Git v1.8.5+ for these contexts to work
[http "https://your.domain.com"]
  ##################################
  # Self Signed Server Certificate #
  ##################################

  # MUST be PEM format
  # Some situations require both the CAPath AND CAInfo 
  sslCAInfo = /path/to/selfCA/self-signed-certificate.crt
  sslCAPath = /path/to/selfCA/
  sslVerify = true

  ###########################################
  # Private Key and Certificate information #
  ###########################################

  # Must be PEM format and include BEGIN CERTIFICATE / END CERTIFICATE, 
  # not just the BEGIN PRIVATE KEY / END PRIVATE KEY for Git to recognise it.
  sslCert = /path/to/privatekey/myprivatecert.pem

  # Even if your PEM file is password protected, set this to false.
  # Setting this to true always asks for a password even if you don't have one.
  # When you do have a password, even with this set to false it will prompt anyhow. 
  sslCertPasswordProtected = 0

References:

• Git Credentials
• Git Credential Store
• Using Gnome Keyring as credential store
• Git Config http.<url>.* Supported from Git v1.8.5

Specify config when git clone-ing

If you need to apply it on a per repo basis, the documentation tells you to just run git config --local in your repo directory. Well that’s not useful when you haven’t got the repo cloned locally yet now is it?

You can do the global -> local hokey-pokey by setting your global config as above and then copy those settings to your local repo config once it clones…

OR what you can do is specify config commands at git clone that get applied to the target repo once it is cloned.

# Declare variables to make clone command less verbose     
OUR_CA_PATH=/path/to/selfCA/
OUR_CA_FILE=$OUR_CA_PATH/self-signed-certificate.crt
MY_PEM_FILE=/path/to/privatekey/myprivatecert.pem
SELF_SIGN_CONFIG="-c http.sslCAPath=$OUR_CA_PATH -c http.sslCAInfo=$OUR_CA_FILE -c http.sslVerify=1 -c http.sslCert=$MY_PEM_FILE -c http.sslCertPasswordProtected=0"

# With this environment variable defined it makes subsequent clones easier if you need to pull down multiple repos.
git clone $SELF_SIGN_CONFIG https://mygit.server.com/projects/myproject.git myproject/

One Liner

EDIT: See VonC’s answer that points out a caveat about absolute and relative paths for specific git versions from 2.14.x/2.15 to this one liner

git clone -c http.sslCAPath="/path/to/selfCA" -c http.sslCAInfo="/path/to/selfCA/self-signed-certificate.crt" -c http.sslVerify=1 -c http.sslCert="/path/to/privatekey/myprivatecert.pem" -c http.sslCertPasswordProtected=0 https://mygit.server.com/projects/myproject.git myproject/

CentOS unable to load client key

If you are trying this on CentOS and your .pem file is giving you

unable to load client key: "-8178 (SEC_ERROR_BAD_KEY)"

Then you will want this StackOverflow answer about how curl uses NSS instead of Open SSL.

And you’ll like want to rebuild curl from source:

git clone http://github.com/curl/curl.git curl/
cd curl/
# Need these for ./buildconf
yum install autoconf automake libtool m4 nroff perl -y
#Need these for ./configure
yum install openssl-devel openldap-devel libssh2-devel -y

./buildconf
su # Switch to super user to install into /usr/bin/curl
./configure --with-openssl --with-ldap --with-libssh2 --prefix=/usr/
make
make install

restart computer since libcurl is still in memory as a shared library

Python, pip and conda

Related: How to add a custom CA Root certificate to the CA Store used by pip in Windows?

Disable SSL verification in git repositories with self-signed certificates

• 28-Jul-2015

$ git clone https://wwwgit.jamescoyle.net/test/test-project.git
Cloning into 'test-project'...
fatal: unable to access 'https://[email protected]/test/test-project.git/': SSL certificate problem: unable to get local issuer certificate

git config --global http.sslVerify false

git config --system http.sslCAPath /git/certificates