When trying to access a remote repository in Git, you may sometimes encounter an error message like the one below and fail to connect:<\/p>\n
fatal: unable to access 'https:\/\/xxx': server certificate verification failed. CAfile: none CRLfile: none<\/pre>\nThis is an error message indicating that certificate verification failed<\/strong> during secure communication via SSL\/TLS. In this article, we will explain in detail the causes of this error and how to handle it while maintaining security.<\/p>\n
\nUnderstanding the Background of the Error<\/h2>\n
This error occurs because the CA certificate file (CAfile) required to verify the SSL certificate could not be found<\/strong> when Git attempts to connect to a remote using the HTTPS protocol.<\/p>\n
Possible Causes:<\/h3>\n
\n
- \n
CA certificates were not set up correctly during the Git installation.<\/p>\n<\/li>\n
- \n
The certificate on the server side is self-signed.<\/p>\n<\/li>\n
- \n
An older version of Git or cURL is being used, causing issues with CA certificate support.<\/p>\n<\/li>\n
- \n
Git is being used in an environment-dependent state on Windows or Mac.<\/p>\n<\/li>\n<\/ul>\n
\nTemporary Workaround (Not Recommended)<\/h2>\n
First, let’s look at a “temporary workaround.” This is a way to resolve the issue immediately at the expense of security<\/strong>.<\/p>\n
git config --global http.sslVerify false<\/pre>\nThis command instructs Git to skip SSL certificate verification<\/strong>. However, this is not recommended for regular use as it increases the risk of Man-in-the-Middle (MITM) attacks<\/strong>.<\/p>\n
\nHow to Apply SSL Verification Disabling to Specific Domains Only (Limited Temporary Workaround)<\/h2>\n
Applying
sslVerify = false<\/code> globally is dangerous. However, you can minimize the risk by limiting it to specific domains only.<\/p>\nExample: If you want to ignore only
git.sample.com<\/code><\/h3>\n\ngit config --global http."https:\/\/git.sample.com".sslVerify false\n<\/pre>\nThis causes only Git communication targeting
https:\/\/git.sample.com<\/code> to skip certificate verification. Other repositories (such as GitHub, GitLab, etc.) will not be affected.<\/p>\nThe configuration details will be saved in
~\/.gitconfig<\/code> as follows:<\/p>\n\n[http "https:\/\/git.sample.com"]\nsslVerify = false\n<\/pre>\nThis is useful when you temporarily need to access a self-signed test server or an internal corporate repository.<\/p>\n
\nThe Correct Approach: Explicitly Specify CA Certificates<\/h2>\n
[For Windows]<\/h3>\n
If you are using Git for Windows, you can explicitly specify the certificate file as follows:<\/p>\n
git config --system http.sslCAInfo "C:\/Program Files\/Git\/mingw64\/ssl\/certs\/ca-bundle.crt"<\/pre>\nThis path points to the certificate bundle included with Git for Windows.<\/p>\n
[For Linux]<\/h3>\n
It is possible that CA certificates are not installed or are not in the PATH.<\/p>\n
For Debian\/Ubuntu:<\/p>\n
sudo apt install ca-certificates\nsudo update-ca-certificates<\/pre>\nFor Red Hat\/CentOS:<\/p>\n
sudo yum install ca-certificates\nsudo update-ca-trust<\/pre>\nThen, set the appropriate path in Git:<\/p>\n
git config --global http.sslCAInfo \/etc\/ssl\/certs\/ca-certificates.crt<\/pre>\n
\nCommunicating with Servers Using Self-Signed Certificates<\/h2>\n
If you are using a self-signed certificate on an internal Git server or similar, you can enable secure communication by registering the server’s public key locally and making it trusted<\/strong>.<\/p>\n
Steps:<\/h3>\n
\n
- \n
Download the certificate from the server:<\/p>\n<\/li>\n<\/ol>\n
\necho | openssl s_client -connect your.git.server:443 -showcerts 2>\/dev\/null | awk '\/BEGIN CERTIFICATE\/,\/END CERTIFICATE\/' > \/path\/to\/mycert.crt\n<\/pre>\n\n
- \n
Copy the displayed certificate and save it as a
.crt<\/code> file (e.g.,mycert.crt<\/code>)<\/p>\n<\/li>\n- \n
Specify it in Git:<\/p>\n<\/li>\n<\/ol>\n
\ngit config --global http.sslCAInfo \/path\/to\/mycert.crt\n<\/pre>\n
\nCheckpoints If the Issue Still Persists<\/h2>\n
\n
- \n
Try updating Git to the latest version<\/p>\n<\/li>\n
- \n
Check the version of
curl<\/code> and its SSL support status (Git usescurl<\/code> internally)<\/p>\n<\/li>\n- \n
Consider the possibility of SSL interference by internal networks or proxies<\/p>\n<\/li>\n
- \n
There are often environment-dependent constraints, such as WSL or virtual machine environments<\/p>\n<\/li>\n
- The certificate may have expired!<\/strong><\/li>\n<\/ul>\n
\nConclusion<\/h2>\n
Git SSL certificate errors are one of the pitfalls of environment setup, but they can be dealt with by calmly analyzing the cause<\/strong>. By being mindful of proper certificate configuration and establishing a chain of trust<\/strong> rather than relying on temporary workarounds, you can maintain a secure development environment.<\/p>\n
From a DIY perspective, understanding how SSL communication works and how certificates are handled is similar to “organizing invisible wiring.” Having the mindset to question mechanisms that run automatically and verify them one by one will be the key to solving problems.<\/p>\n","protected":false},"excerpt":{"rendered":"
When trying to access a remote repository in Git, you may sometimes encounter an error message like the one be […]<\/p>\n","protected":false},"author":4,"featured_media":1879,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=1872","footnotes":""},"categories":[1172],"tags":[9,51,52,97,10],"class_list":["post-5127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-development-programming-git","tag-diy","tag-git","tag-https","tag-ssl","tag-server","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5127"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5127\/revisions"}],"predecessor-version":[{"id":5130,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5127\/revisions\/5130"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/1879"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}