How to Fix SSL Certificate Errors in Git

When trying to access a remote repository in Git, you may sometimes encounter an error message like the one below and fail to connect:

fatal: unable to access 'https://xxx': server certificate verification failed. CAfile: none CRLfile: none

This is an error message indicating that certificate verification failed during secure communication via SSL/TLS. In this article, we will explain in detail the causes of this error and how to handle it while maintaining security.

目次

Understanding the Background of the Error

This error occurs because the CA certificate file (CAfile) required to verify the SSL certificate could not be found when Git attempts to connect to a remote using the HTTPS protocol.

Possible Causes:

  • CA certificates were not set up correctly during the Git installation.

  • The certificate on the server side is self-signed.

  • An older version of Git or cURL is being used, causing issues with CA certificate support.

  • Git is being used in an environment-dependent state on Windows or Mac.

Temporary Workaround (Not Recommended)

First, let’s look at a “temporary workaround." This is a way to resolve the issue immediately at the expense of security.

git config --global http.sslVerify false

This command instructs Git to skip SSL certificate verification. However, this is not recommended for regular use as it increases the risk of Man-in-the-Middle (MITM) attacks.

How to Apply SSL Verification Disabling to Specific Domains Only (Limited Temporary Workaround)

Applying sslVerify = false globally is dangerous. However, you can minimize the risk by limiting it to specific domains only.

Example: If you want to ignore only git.sample.com

git config --global http."https://git.sample.com".sslVerify false

This causes only Git communication targeting https://git.sample.com to skip certificate verification. Other repositories (such as GitHub, GitLab, etc.) will not be affected.

The configuration details will be saved in ~/.gitconfig as follows:

[http "https://git.sample.com"]
sslVerify = false

This is useful when you temporarily need to access a self-signed test server or an internal corporate repository.

The Correct Approach: Explicitly Specify CA Certificates

[For Windows]

If you are using Git for Windows, you can explicitly specify the certificate file as follows:

git config --system http.sslCAInfo "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt"

This path points to the certificate bundle included with Git for Windows.

[For Linux]

It is possible that CA certificates are not installed or are not in the PATH.

For Debian/Ubuntu:

sudo apt install ca-certificates
sudo update-ca-certificates

For Red Hat/CentOS:

sudo yum install ca-certificates
sudo update-ca-trust

Then, set the appropriate path in Git:

git config --global http.sslCAInfo /etc/ssl/certs/ca-certificates.crt

Communicating with Servers Using Self-Signed Certificates

If you are using a self-signed certificate on an internal Git server or similar, you can enable secure communication by registering the server’s public key locally and making it trusted.

Steps:

  1. Download the certificate from the server:

echo | openssl s_client -connect your.git.server:443 -showcerts 2>/dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' > /path/to/mycert.crt

  1. Copy the displayed certificate and save it as a .crt file (e.g., mycert.crt)

  2. Specify it in Git:

git config --global http.sslCAInfo /path/to/mycert.crt

Checkpoints If the Issue Still Persists

  • Try updating Git to the latest version

  • Check the version of curl and its SSL support status (Git uses curl internally)

  • Consider the possibility of SSL interference by internal networks or proxies

  • There are often environment-dependent constraints, such as WSL or virtual machine environments

  • The certificate may have expired!

Conclusion

Git SSL certificate errors are one of the pitfalls of environment setup, but they can be dealt with by calmly analyzing the cause. By being mindful of proper certificate configuration and establishing a chain of trust rather than relying on temporary workarounds, you can maintain a secure development environment.

From a DIY perspective, understanding how SSL communication works and how certificates are handled is similar to “organizing invisible wiring." Having the mindset to question mechanisms that run automatically and verify them one by one will be the key to solving problems.

Development, Programming, GitDIY,git,HTTPS,SSL certificate,server

Posted by 納戸工房