407

I'm stuck behind a firewall, so I have to use HTTPS to access my GitHub repository. I'm using Cygwin 1.7.7 on Windows XP.

I've tried setting the remote to https://username@github.com/username/ExcelANT.git, but pushing prompts for a password, but it doesn't do anything once I've entered it. https://username:<password>github.com/username/ExcelANT.git and cloning the empty repository from scratch, but each time it gives me the same error:

error: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed while accessing https://github.com/username/ExcelANT.git/info/refs

Turning on GIT_CURL_VERBOSE=1 gives me

* About to connect() to github.com port 443 (#0) * Trying 207.97.227.239... * successfully set certificate verify locations: * CAfile: none CApath: /usr/ssl/certs * SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed * Expire cleared * Closing connection #0 * About to connect() to github.com port 443 (#0) * Trying 207.97.227.239... * successfully set certificate verify locations: * CAfile: none CApath: /usr/ssl/certs * SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed * Expire cleared * Closing connection #0 error: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed while accessing https://github.com/username/ExcelANT.git/info/refs

fatal: HTTP request failed

Is this a problem with my firewall, Cygwin or what?

I hadn't set the HTTP proxy in the Git configuration. However, it's an ISA server that needs NTLM authentication, not basic, so unless anyone knows how to force Git to use NTLM, I'm scuppered.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
oharab
  • 4,405
  • 3
  • 19
  • 15
  • If i set http.sslVerify false then connection will secure? and it is good path to use ? In between we are using pfsense firewall. right now, .gitconfig file on user profile is blank. – Nullpointer Dec 22 '15 at 12:50

31 Answers31

535

The problem is that you do not have any of certificate authority (CA) certificates installed on your system. And these certificates cannot be installed with Cygwin's setup.exe.

Install Net/ca-certificates package in Cygwin (thanks dirkjot)

There are two solutions:

  1. Actually install root certificates. The curl guys extracted the certificates from Mozilla for you.

cacert.pem file is what you are looking for. This file contains more than 250 CA certificates (don't know how to trust this number of people). You need to download this file, split it to individual certificates put them to /usr/ssl/certs (your CApath) and index them.

Here is how to do it. With Cygwin setup.exe install the curl and OpenSSL packages.

Execute:

<!-- language: lang-bash -->

    $ cd /usr/ssl/certs
    $ curl http://curl.haxx.se/ca/cacert.pem |
      awk '{print > "cert" (1+n) ".pem"} /-----END CERTIFICATE-----/ {n++}'
    $ c_rehash

Important: In order to use c_rehash you have to install openssl-perl too.

  1. Ignore SSL certificate verification.

    WARNING: Disabling SSL certificate verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a man-in-the-middle attack. Be sure you fully understand the security issues and your threat model before using this as a solution.

    env GIT_SSL_NO_VERIFY=true git clone https://github...

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Alexey Vishentsev
  • 5,644
  • 2
  • 15
  • 8
  • 10
    You don't need to install curl, just use wget: `wget -O - http://curl.haxx.se/ca/cacert.pem | awk 'split_after==1{n++;split_a fter=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cert" n ".pem"}'` – Deebster Mar 08 '11 at 16:03
  • 1
    @Deebster, that would work if wget was installed by default, which for me it wasn't. – Peter Wagenet May 04 '11 at 04:17
  • 40
    I know this is cygwin, but in case anyone gets here using Centos, it's /etc/pki/tls/certs where the .pem's should go. – Stop Slandering Monica Cellio Aug 21 '11 at 19:43
  • Alternatively you can extract all certificates from Firefox (using a plugin), then convert them from DER to PEM format like this: `for i in *.der; do openssl.exe x509 -text -inform DER -fingerprint < "$i" > /usr/ssl/certs/"${i%.der}.pem"; done` Finally run `c_rehash` and job done – MarcH Aug 29 '11 at 18:04
  • 2
    Didn't work for me--however, I don't have c_rehash in my path. I tried restarting my shell. I also had to mkdir -p /usr/ssl/certs. I'm wondering if my Cygwin install is different or missing something? Also, setting GIT_SSL_NO_VERIFY=true followed by running the clone operation resulted in this error: `fatal: https://code.google.com/.../info/refs not found: did you run git update-server-info on the server?` Maybe it will work after reboot? – Jeff Axelrod Sep 09 '11 at 17:32
  • I had to `export OPENSSL=/c/OpenSSL/bin/openssl.exe` to have c_rehash find openssl - it complained about not finding C:\OpenSSL when used from cygwin – jah Sep 28 '11 at 15:05
  • @glenviewjeff cygwin has it's own openssl package with c_rehash, can be installed with cygwin's setup.exe. however problem with info/refs I think is different: try to play with url you pass to git – Alexey Vishentsev Sep 28 '11 at 22:55
  • 1
    I prefer the solution of putting `[http] sslVerify = no` in your global .gitconfig. See here: http://linux.die.net/man/1/git-config – Robin Winslow Feb 14 '12 at 16:15
  • In my case this did not work, but [this solution](http://stackoverflow.com/a/8467406/15064) did, with the difference that since git was looking for the file at /usr/ssl/certs/ca-bundle.crt, that was where I put it. – Ilkka Oct 17 '12 at 14:01
  • 8
    This answer is wrong. Just install the cygwin `ca-certificates` package to get the missing root certificates. Why did this answer get so many ups? – rurban Dec 27 '12 at 20:43
  • 1
    I would not add such a large bundle of root certificates but only the CA or server certificate of that specific repository. With `openssl s_client --printcerts --connect server:port` for example you can get a PEM dump of the cert of any SSL server. – eckes Jan 10 '13 at 19:13
  • 3
    It worked for me. Before running c_rehash, yum install openssl-perl was needed (in centos) – makriria Mar 29 '13 at 14:30
  • And for anyone here who is using Debian/Ubuntu, the certificates are stored in `/etc/ssl/certs/` – Hamish Downer Jun 03 '13 at 15:22
  • 33
    Don't turn off SSL certificate verification. This happens all too often in tools and application code throughout industry. It opens you up to a man in the middle attack. If you're going to use SSL then use it properly. – Tim Jun 19 '13 at 16:30
  • The `c_rehash` command keeps saying `bad interpreter: permission denied` for me, so I cannot apply this solution :-/ – O. R. Mapper Jun 23 '13 at 16:03
  • In Win7... set GIT_SSL_NO_VERIFY=true – Doug J. Huras Feb 21 '14 at 17:17
  • Just to elaborate on above comment...In Win7, I set an environment var... "set GIT_SSL_NO_VERIFY=true", then used the bash shell for msysgit to clone a repo. – Doug J. Huras Feb 21 '14 at 17:24
  • Thank you so much, this fixed it for me. This information (the c_rehash) is not in any other posts. – Andrew Feb 27 '14 at 05:29
  • 1
    the `curl` step from the answer didn't work for me like that - `awk` was complaining for the syntax error. I had to modify it a bit: `curl http://curl.haxx.se/ca/cacert.pem | awk 'split_after==1 {n++; split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print >> ("cert" n ".pem"); close("cert" n ".pem")}'`. Using `awk version 20070501` and Mac OS X 10.9.2. – iurii Apr 10 '14 at 12:37
  • git uses libcurl which uses openssl (at least in the version that I built). If you build your own versions of things, it is libcurl that changes where it looks for the CA certificates. Use the --with-ca-path=DIR configuration option when you configure curl and point it to where openssl puts the certificates. – pedz Apr 21 '14 at 23:49
  • If i set http.sslVerify false then connection will secure? and it is good path to use ? In between we are using pfsense firewall. right now, .gitconfig file on user profile is blank. – Nullpointer Dec 22 '15 at 12:51
  • Solution 1 must be deleted!, set GIT_SSL_NO_VERIFY=true – Then why the purpose of SSL? – Jorgesys Mar 03 '16 at 20:45
  • Splitting with `awk` can be complicated; you can also use `split -p "-----BEGIN CERTIFICATE-----" [filename]` – squidpickles Mar 24 '16 at 18:05
450

Note: disabling SSL verification has security implications. It allows Man in the Middle attacks when you use Git to transfer data over a network. Be sure you fully understand the security implications before using this as a solution. Or better yet, install the root certificates.

One way is to disable the SSL CERT verification:

git config --global http.sslVerify false

This will prevent CURL to verity the HTTPS certification.

For one repository only: 

git config http.sslVerify false
Braiam
  • 1
  • 11
  • 47
  • 78
Yi Zhao
  • 6,768
  • 1
  • 18
  • 18
  • 17
    If you don't want to edit your global settings (e.g. all repos), exclude --global – Erin Oct 31 '12 at 14:52
  • 60
    could you please add a note about how extremely dangerous this is? – Chronial Apr 16 '13 at 22:53
  • 28
    this is a terrible idea. there is a reason that certificates should be verified. if you don't verify the certificate as trusted then the certificate could be generated by anyone and you could be susceptible to a man in the middle attack. – Mark Carey May 10 '13 at 04:06
  • 27
    Don't turn off SSL verification ! – Tim Jun 19 '13 at 16:31
  • Pls do this if you have no other option. This is very dangerous if you dont know what you are doing – Ishan Liyanage Oct 07 '13 at 06:38
  • 14
    For all "do not do it" people: Sure this is not the most secure approach at all. BUT, it is far better option that not to have SSL at all! Because some people run just their private simple git servers at it is fine for them. Sure, for any real security it is NO GO setting. The most insecure thing is sending the plain bytes thru the network. – Peter Stegnar Mar 18 '14 at 07:38
  • 3
    If SSL verification wants to be enabled, then someone needs to invent a way to make it work without needing to have root certificates manually installed. Perhaps if they just came bundled with git or something, that would solve this problem. – aroth Apr 12 '14 at 14:17
  • 2
    This answer should be deleted. It's led at least 247 people to do the wrong thing. – Glenn Maynard Apr 17 '14 at 21:17
  • The only hope is to down click it. – pedz Apr 21 '14 at 23:07
  • 2
    It doesn't "disable" SSL, you are still using a secure connection, but there is no verification that you are actually connected to the correct server. – alexia May 24 '14 at 12:00
  • 2
    The universe tends to follow the **path of least resistance**. – Mrchief Jun 05 '14 at 15:08
  • 4
    For those that have a private server with a self signed certificate this will help. The guy is offering a solution.. not everyone will agree, but it may solve someones problem. That's what this site is about. StackOverflow is full of opinions - not everyone will agree with the ideas and decisions of others. Saying it should be deleted is crazy. – TravisWhidden Jun 18 '14 at 22:24
  • @TravisWhidden it needs to have a clear warning about the security implications. Which it does now, since I edited it in a while back. –  Jul 20 '14 at 19:04
  • 1
    @halfer Why the edit? (a) It was an editor's note, it wasn't a note from the original author and (b) there's no harm in warning people a bit harder, otherwise people tend to ignore problems (you just have to look at the number of upvotes on this answer, which recommends an insecure solution...) – Bruno Sep 04 '14 at 23:10
  • Hi @Bruno. I'd wager our editing guidelines (insofar as we have any at all) would discourage people from putting in edits labelled as being from a third party (so 'Edit from halfer', 'Editor's note', '(Ed)' etc. would all be discouraged). I'm pretty sure _any_ 'Edit' addenda are discouraged, come to think of it - they are meant to merge in to the original post. That's been covered on MSO, iirc. – halfer Sep 04 '14 at 23:21
  • 1
    @halfer Are there editing guidelines that say so? I would *much* prefer to say such a note being clearly marked as coming from an 3rd-party editor, to make it directly clear the initial author might not endorse it (at least out of respect for the author). As for the boldness, again, bigger warnings are not a bad thing for a security issue. It's quite a sad fact for SO that this is currently the 4th most upvoted answer on the `ssl` tag, yet it suggests an insecure solution :-( – Bruno Sep 04 '14 at 23:27
  • Glad to find this answer. We've got an actual CA issued cert on our server, but for some reason command-line git (on which Android Studio depends) refuses to acknowledge it now (it used to, but doesn't anymore). Visual Studio and Netbeans both recognize our cert fine, but looks like something is broken in git. I tried using Netbeans to push for Android Studio, but that was a no go. This is the only way I've been able to push my work. – Brian Knoblauch Nov 18 '14 at 18:03
  • Pretty much what the above said. Have work that needs to be pushed, maybe google and fiddle with things for about an hour and I can't figure it out, well, work has to get done, sslverify=false and send am email to IT if they care about it or not. – James DeRagon Feb 17 '15 at 16:51
  • Is the risk somewhat mitigated if I am behind a trusted firewall, large company-backed firewall? – tmn Jun 25 '15 at 14:23
  • 3
    @PeterStegnar No, this is ***not*** "a far better option". At best it's marginally better. Anyone who can intercept and manipulate your HTTP plaintext bytes can *also* intercept and replace the certificate, and then read and manipulate your HTTPS ciphertext bytes after decrypting them with the impostor cert. The only thing you gain from using SSL/TLS without validating the certs is that the traffic content is hidden from *passive* listeners, but any active adversary will only be slightly inconvenienced. – Emil Lundberg Jul 07 '15 at 09:57
  • If i set http.sslVerify false then connection will secure? and it is good path to use ? In between we are using pfsense firewall – Nullpointer Dec 22 '15 at 12:46
  • If i set http.sslVerify false then connection will secure? and it is good path to use ? In between we are using pfsense firewall. right now, .gitconfig file on user profile is blank. – Nullpointer Dec 22 '15 at 12:51
  • 1
    There is one point though, if you have internal git server and you know you're running behind your firewalls, maybe it's not necessary to verify the certificates because it couldn't be any risk. – Ricardo Silva Nov 06 '17 at 10:53
  • Git-config document https://git-scm.com/docs/git-config#EXAMPLES gives more examples. – Yi Zhao Sep 30 '22 at 07:23
114

I wanted Git to use the updated certificate bundle without replacing the one my entire system uses. Here's how to have Git use a specific file in my home directory:

mkdir ~/certs
curl https://curl.haxx.se/ca/cacert.pem -o ~/certs/cacert.pem

Now update .gitconfig to use this for peer verification:

[http]
sslCAinfo = /home/radium/certs/cacert.pem

Note I'm using an absolute path. Git does no path expansion here, so you can't use ~ without an ugly kludge. Alternatively, you can skip the config file and set the path via the environment variable GIT_SSL_CAINFO instead.

To troubleshoot this, set GIT_CURL_VERBOSE=1. The path of the CA file Git is using will be shown on lines starting with "CAfile:" in the output.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
kenchilada
  • 7,469
  • 5
  • 25
  • 34
  • 12
    For me, this is the best answer: it works on unix (NetBSD actually), it affects only git and not anything else on the system, and it doesn't require root/Administrator access. Thanks! – Eric Feb 09 '12 at 04:32
  • 1
    Perfect, one can even do better. I have replaced my old `/etc/ssl/certs/ca-certificates.crt` on my Ubuntu 8.04 LTS with this file and it magically worked! – Michael-O Nov 24 '12 at 12:24
  • 1
    @Eric thanks for mentioning NetBSD as it meant I found this answer. NetBSD is a bit odd. I installed the OpenSSL package, but even that doesn't get you the certs, just a placeholder directory. – atomicules Apr 09 '13 at 14:53
  • +200 More awesome, it also worked on my Ubuntu box. No need to disable certificate checking in git, just do this quick fix. – Colin D Bennett Aug 22 '13 at 04:21
  • 12
    Excellent answer, you can skip hand-editing the ~/.gitconfig file with the following command: `git config --global http.sslCAinfo "$HOME/certs/cacert.pem"` – Aron Ahmadia Oct 25 '13 at 21:24
  • @Michael-O's comment is the solution for Hardy 8.04 for sure. Nice and easy in the end lol! – Brendon Muir Dec 10 '13 at 00:55
  • this solution is great, simple and effective, it works on red hat – zhaozhi Jan 13 '14 at 07:29
  • If i set http.sslVerify false then connection will secure? and it is good path to use ? In between we are using pfsense firewall . – Nullpointer Dec 22 '15 at 12:45
63

Feel free to skip past this answer if you want to fix the certificates issue. This answer deals with tunneling SSH through the firewall which is IMHO a better solution to dealing with firewall/proxy thingies.

There is a better way than using HTTP access and that is to use the SSH service offered by GitHub on port 443 of the ssh.github.com server.

We use a tool called Corkscrew. This is available for both Cygwin (through setup from the Cygwin homepage) and Linux using your favorite packaging tool. For Mac OS X it is available from MacPorts and Homebrew (executable brew) at least.

The command line is as follows:

corkscrew <proxyhost> <proxyport> <targethost> <targetport> <authfile>

The proxyhost and proxyport are the coordinates of the HTTPS proxy. The targethost and targetport is the location of the host to tunnel to. The authfile is a text file with one line containing your proxy server username/password separated by a colon.

E.g.:

abc:very_secret

Installation for using "normal" ssh protocol for Git communication.

By adding this to the ~/.ssh/config this trick can be used for normal SSH connections.

Host github.com
  HostName ssh.github.com
  Port 443
  User git
  ProxyCommand corkscrew <proxyhost> <proxyport> %h %p ~/.ssh/proxy_auth

Now you can test it works by ssh-ing to gitproxy:

ssh github.com

Output:

PTY allocation request failed on channel 0
Hi ptillemans! You've successfully authenticated, but GitHub does not provide shell access.
       Connection to github.com closed.

(Note: if you never logged into GitHub before, ssh will be asking to add the server key to the known hosts file. If you are paranoid, it is recommended to verify the RSA fingerprint to the one shown on the GitHub site where you uploaded your key).

A slight variant on this method is the case when you need to access a repository with another key, e.g., to separate your private account from your professional account.

# Account dedicated for the ACME private GitHub account
#
Host acme.github.com
  User git
  HostName ssh.github.com
  Port 443
  ProxyCommand corkscrew <proxyhost> <3128> %h %p ~/.ssh/proxy_auth
  IdentityFile ~/.ssh/id_dsa_acme

Enjoy!

We've been using this for years now on both Linux, Macs and Windows.

If you want you can read more about it in this blog post.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Peter Tillemans
  • 34,983
  • 11
  • 83
  • 114
  • I gave up on getting this working, but had another look at it, and got it working. changing .ssh/config to >`Host ssh.github.com >User oharab >Hostname ssh.github.com >Port 443 >PreferredAuthentications publickey >IdentityFile ~/.ssh/id_rsa ` and cloning using git clone `git@ssh.github.com:oharab/log4vba.git` got it up and running in no time. – oharab Jul 14 '11 at 13:39
  • 1
    I'm only downvoting because the answer below is more helpful but unfortunately stackoverflow always puts the accepted answer top, even if it was only an answer for a single circumstance. – mjaggard Dec 19 '12 at 10:01
  • 1
    In any case I updated the answer since I find that SSL tunneling through https proxy is still a better solution than fiddling with HTTPS certificates or disabling them and ending up with a solution which is still less performant, user friendly AND less secure. Well, plenty of upvotes prove me wrong but I stick to my opinion in this matter anyway. – Peter Tillemans Jan 16 '13 at 09:53
  • A proxy is a man in the middle. If you are sure you can trust him it should be ok but the only real solution is "to deal with firewall/proxy thingies". If security doesn't matter using SSL doesn't make any sense... – The incredible Jan Sep 20 '22 at 08:33
42

Note that for me to get this working (RVM install on CentOS 5.6), I had to run the following:

export GIT_SSL_NO_VERIFY=true

and after that, the standard install procedure for curling the RVM installer into Bash worked a treat :)

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
seanp2k
  • 541
  • 4
  • 2
  • 13
    same effect as git config --global http.sslverify false – Dyno Fu Sep 07 '11 at 11:23
  • 23
    ***This is EXTREMELY DANGEROUS!*** The whole point of SSL certificate verification is to protect your code from being tampered with when you're transmitting it over HTTPS! Disabling it means that malicious people can insert vulnerabilities and other nasty things into your code as you push and fetch it! –  Apr 18 '14 at 19:02
  • If i set http.sslVerify false then connection will secure? and it is good path to use ? In between we are using pfsense firewall – Nullpointer Dec 22 '15 at 12:45
  • 1
    @Ravi the connection will **technically** work, yes, but it is unequivocally **not** a good idea. If both your git origin and the local machine are internal and under your organization's control, it might be *passable*, but as per user456814's comment, disabling verification opens you up to MITM attacks. – Doktor J Feb 09 '17 at 20:03
41

A very simple solution: replace https:// with git://

Use git://the.repository instead of https://the.repository and will work.

I've had this problem on Windows with TortoiseGit and this solved it.

klodoma
  • 4,181
  • 1
  • 31
  • 42
  • I guess this works because it doesn't verify ssl for `git://`. As stated out in [this answer above](http://stackoverflow.com/a/8755199/1079110), disabling ssl verification is a security risk. – danijar Feb 17 '14 at 01:03
  • 5
    @danijar the reason why this works is because ***it doesn't even use SSL at all***. The `git://` protocol uses SSH, which uses SSH public and private key pairs for authentication and encryption, instead of an SSL certificate. –  Apr 18 '14 at 19:27
  • 11
    @Cupcake `git://` does **not** use SSH. See [The SSH Protocol](http://git-scm.com/book/ch4-1.html#The-SSH-Protocol) and [The Git Protocol](http://git-scm.com/book/ch4-1.html#The-Git-Protocol). – alexia May 24 '14 at 11:58
  • @nyuszika7h oh, you're right. I keep getting `git://` confused with `git@github.com:user/project.git`, [which is SCP-ish syntax](https://www.kernel.org/pub/software/scm/git/docs/git-fetch.html#_git_urls_a_id_urls_a). –  May 24 '14 at 12:05
  • thanks! this works for me, using msys2 git with tinywall firewall. – sailfish009 Oct 04 '21 at 00:56
33

As the most popular answer (by Alexey Vishentsev) has it:

The problem is that you do not have any of Certification Authority certificates installed on your system. And these certs cannot be installed with cygwin's setup.exe.

However, that last assertion is false (now, or always has been, I don't know).

All you have to do is go to Cygwin setup and include the package 'ca-certificates' (it is under Net). This did the trick for me.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
dirkjot
  • 3,467
  • 1
  • 23
  • 17
  • 1
    cygwin git error shows `CAfile: /etc/ssl/ca-bundle.crt` whereas cygwin ca-certificates package installs `/usr/ssl/certs/ca-bundle.crt`. Therefore, had to edit `~/.gitconfig` to specify the location: `[http]` then `sslCAinfo = /usr/ssl/certs/ca-bundle.crt` – maxpolk Jan 12 '13 at 19:30
  • @maxpolk: I would have made a link but the effect is the same. This is clearly a bug in cygwin git, have you considered raising a ticket? `sudo ln -s /usr/ssl/certs/ca-bundle.crt /etc/ssl/` – dirkjot Jan 28 '13 at 11:48
  • As of today 2013-5-23, cygwin git works fine over https: if you also happen to have/remember to install cygwin's `ca-certificates`. – bobbogo May 23 '13 at 19:41
  • I got here from [this question](http://stackoverflow.com/questions/4652532/ssl-certificate-problem-when-trying-to-clone-git-repository-within-cygwin), which indicated that an answer can be found here. However, neither the linked answer nor this answer work for me; TortoiseSVN keeps outputting `error: SSL certificate problem, verify that the CA cert is OK.` – O. R. Mapper Jun 23 '13 at 16:24
  • Where exactly do we install the cygwin installation files from the package manager? Do the ca-certificates need to be within the bin folder of Git? – 221b Dec 03 '15 at 04:08
  • @user1650978: you should use the cygwin installer (named setup.exe) and install this one extra package. That is all. No need to copy files and or specify destinations. – dirkjot Dec 03 '15 at 05:55
19

To clone on Windows while setting SSL verify to false:

git -c http.sslVerify=false clone http://example.com/e.git

If you want to clone without borfing your global settings.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
FlavorScape
  • 13,301
  • 12
  • 75
  • 117
17

I know the original question lists Cygwin, but here is the solution for CentOS: 

curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt

Source: http://eric.lubow.org/2011/security/fixing-centos-root-certificate-authority-issues/

Anne
  • 26,765
  • 9
  • 65
  • 71
Herman J. Radtke III
  • 1,804
  • 1
  • 24
  • 29
  • This worked great for me; you should probably make a backup of the original first, though, as the OP suggests. It seems like this happens when Github renews their cert, if you are on a system that has an older one. – Evan Donovan Mar 05 '12 at 23:07
  • On CentOS 5 I fixed it by `yum update openssl`, which also updates the ca-bundle. – raarts Jun 21 '16 at 17:14
  • if you are going to follow this option, then you should verify the SHA-256 hash of the file before using it. You can obtain the [sha256sum for the current file](https://curl.haxx.se/ca/cacert.pem.sha256) by *some other means than the curl you're setting up* (like a browser on a different machine that's already set up securely) and then compare it against the output of `sha256sum /etc/pki/tls/certs/ca-bundle.crt` to be sure you got the right file. – kbolino Mar 22 '18 at 18:56
  • The link is broken: *"Hmm. We’re having trouble finding that site. We can’t connect to the server at eric.lubow.org."* – Peter Mortensen Mar 18 '23 at 22:30
15

On CentOS 5.x, a simple yum update openssl updated the OpenSSL package which updated the system ca-bundle.crt file and fixed the problem for me.

The same may be true for other distributions.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Wayne Walker
  • 2,316
  • 3
  • 23
  • 25
14

If all you want to do is just to use the Cygwin Git client with github.com, there is a much simpler way without having to go through the hassle of downloading, extracting, converting, splitting certificate files. Proceed as follows (I'm assuming Windows XP with Cygwin and Firefox)

  1. In Firefox, go to the GitHub page (any)
  2. Click on the GitHub icon on the address bar to display the certificate
  3. Click through "more information" → "display certificate" → "details" and select each node in the hierarchy beginning with the uppermost one; for each of them click on "Export" and select the PEM format:
  • GTECyberTrustGlobalRoot.pem
  • DigiCertHighAssuranceEVRootCA.pem
  • DigiCertHighAssuranceEVCA-1.pem
  • github.com.pem
  1. Save the above files somewhere in your local drive, change the extension to .pem and move them to /usr/ssl/certs in your Cygwin installation (Windows: C:\cygwin\ssl\certs)
  2. (optional) Run c_reshash from Bash.

That's it.

Of course this only installs one certificate hierarchy, the one you need for GitHub. You can of course use this method with any other site without the need to install 200 certs of sites you don't (necessarily) trust.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
esquifit
  • 141
  • 1
  • 4
9

You can try this command in the Terminal:

git config --global http.sslVerify false

reza_khalafi
  • 6,230
  • 7
  • 56
  • 82
8

If you're on Mac OS X, you can install the ca-cert-bundle via homebrew:

brew install curl-ca-bundle
git config --system http.sslcainfo /usr/local/share/ca-bundle.crt

The formula installs the cert bundle to your share via:

share.install 'ca-bundle.crt'

The share method is just an alias to /usr/local/share, and the curl-ca-bundle is provided by Mozilla. It's what you see being referenced in a lot of issues. Hope this helps as it's not very straightforward about how to approach this on Mac OS X. brew install curl isn't going to get you much either as it's keg only and will not be linked (running which curl will always output /usr/bin/curl, which is the default that ships with your OS). This post may also be of some value.

You'll of course need to disable SSL before you install homebrew since it's a git repo. Just do what curl says when it errors out during SSL verification and:

echo insecure >> ~/.curlrc

Once you get homebrew installed along with the curl-ca-bundle, delete .curlrc and try cloning a repo out on GitHub. Ensure that there are no errors and you'll be good to go.

NOTE: If you do resort to .curlrc, please remove it from your system the moment you're done testing. This file can cause major issues, so use it for temporary purposes and with caution. brew doctor will complain in case you forget to purge it from your system).

NOTE: If you update your version of git, you'll need to rerun this command since your system settings will be wiped out (they're stored relative to the Git binary based on version).

So after running:

brew update
brew upgrade

If you get a new version of Git, then just rerun:

git config --system http.sslcainfo /usr/local/share/ca-bundle.crt

And you'll be all set.

Lastly if you have a new version of Git, running:

git config -l --system

should give you an error along the lines of

fatal: unable to read config file '/usr/local/Cellar/git/1.8.2.2/etc/gitconfig'

That's your tip that you need to tell gGit where the Mozilla ca-bundle is.

.curlrc may or may not be the remedy to your problem. In any case, just get the Mozilla ca-bundle installed on your machine whether you have to manually download it or not. That's what's important here. Once you get the ca-bundle, you're good to go. Just run the Git configuration command and point git to the the ca-bundle.

export CURL_CA_BUNDLE=/usr/local/share/ca-bundle.crt to my .zshenv dot file since I'm using zsh. the git config option worked for most cases, but when hitting GitHub over SSL (rvm get stable for example), I still ran into certificate issues. @Maverick pointed this out in his comment, but just in case someone misses it or assumes they don't necessarily need to export this environment variable in addition to running the git config --system.... command. Thanks and hope this helps.

It looks like the curl-ca-bundle was recently removed from homebrew. There is a recommendation here.

You will want to drop some files into:

$(brew --prefix)/etc/openssl/certs

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
A-Dubb
  • 1,670
  • 2
  • 17
  • 22
  • 1
    You can also try the following: ```export CURL_CA_BUNDLE=/usr/local/share/ca-bundle.crt``` – Maverick Aug 15 '13 at 17:11
  • Hi, I am having a similar issue (http://stackoverflow.com/questions/20939105/pod-install-returns-fatal-error-ssl-certificate-issue) and the same issue appears when I try to install home-brew. What can I do in this case? Typing "git config --system http.sslcainfo /usr/local/share/ca-bundle.crt" in my console returns "error: could not lock config file /Applications/Xcode.app/Contents/Developer/usr/etc/gitconfig: No such file or directory". Thank you for your help! – Mathieu Jan 05 '14 at 22:32
  • @Mathieu that's pretty strange. Seems like your system is pointing to a version of git relative to XCode. What is the output of running 'which git' from your terminal? – A-Dubb Jan 11 '14 at 19:06
7

I've been having this same problem for Solaris Express 11. It took me a while, but I managed to find where the certificates needed to be placed. According to /etc/openssl/openssl.cnf, the path for certificates is /etc/openssl/certs. I placed the certificates generated using the previous advice from Alexey.

You can verify that things are working using OpenSSL on the command line:

openssl s_client -connect github.com:443
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Martin Smith
  • 71
  • 1
  • 1
6

I fixed this problem using apt-cyg (a great installer similar to apt-get) to easily download the ca-certificates (including Git and many more):

apt-cyg install ca-certificates

Note: apt-cyg should be first installed. You can do this from Windows command line:

cd c:\cygwin
setup.exe -q -P wget,tar,qawk,bzip2,subversion,vim

Close Windows cmd, and open Cygwin Bash:

wget rawgit.com/transcode-open/apt-cyg/master/apt-cyg
install apt-cyg /bin
Zombo
  • 1
  • 62
  • 391
  • 407
sagunms
  • 8,030
  • 5
  • 41
  • 43
5

On a Raspberry Pi I had:

git clone http://github.com/andreafabrizi/Dropbox-Uploader.git

Output:

Cloning into 'Dropbox-Uploader'...
error: Problem with the SSL CA cert (path? access rights?) while accessing http://  github.com/andreafabrizi/Dropbox-Uploader.git/info/refs
fatal: HTTP request failed

So I did a

sudo apt-get install ca-certificates

And then

git clone http://github.com/andreafabrizi/Dropbox-Uploader.git

worked

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
fred
  • 51
  • 1
  • 1
5

If you used a Debian-based OS, you can simply run:

apt-get install ca-certificates
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Patrick
  • 4,186
  • 9
  • 32
  • 45
5

Generate the access token from GitHub and save it, as it will not appear again.

git -c http.sslVerify=false clone https://<username>:<token>@github.com/repo.git

or,

git config --global http.sslVerify false
git clone https://github.com/repo.git
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Dry_accountant_09
  • 1,371
  • 16
  • 15
4

Check your time.

I absolutely refused to make my Git operations insecure and after trying everything people mentioned here, it struck me that one possible cause why certificates fail to pass verification is that the dates are wrong (either the certificate expiry date, or the local clock).

You can check this easily by typing date in a terminal. In my case (a new Raspberry Pi), the local clock was set to 1970, so a simple ntpdate -u 0.ubuntu.pool.ntp.org fixed everything. For a Raspberry Pi, I would also recommend that you put the following script in a daily cron job (say /etc/cron.daily/ntpdate):

#!/bin/sh
/usr/sbin/ntpdate -u 0.ubuntu.pool.ntp.org 1> /dev/null 2>&1
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Deiu
  • 517
  • 5
  • 4
3

Try using a .netrc file, it will authenticate over https. Create a file call .netrc in your home directory and put this in it:

machine github.com login myusername password mypass

See this post for more info:

https://plus.google.com/u/0/104462765626035447305/posts/WbwD4zcm2fj

Travis Reeder
  • 38,611
  • 12
  • 87
  • 87
  • This is a certificate validation issue, not an authentication issue -- some operating systems (including the one the OP runs) don't have the CA issuing github's new certificate included in the stock list. – Charles Duffy Oct 30 '12 at 19:10
  • The link is broken. [Google+](https://en.wikipedia.org/wiki/Google%2B) was shut down in 2019. – Peter Mortensen Mar 18 '23 at 22:33
3

Improve RouMao's solution by temporarily disabling Git/curl SSL verification in Windows cmd:

set GIT_SSL_NO_VERIFY=true
git config --global http.proxy http://<your-proxy>:443

The good thing about this solution is that it only takes effect in the current cmd window.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Marshal
  • 4,452
  • 1
  • 23
  • 15
  • 4
    ***This is EXTREMELY DANGEROUS!*** The whole point of SSL certificate verification is to protect your code from being tampered with when you're transmitting it over HTTPS! Disabling it means that malicious people can insert vulnerabilities and other nasty things into your code as you push and fetch it! –  Apr 18 '14 at 19:04
  • There isn't anyone by the name "RouMao" here. What answer does it refer to? – Peter Mortensen Mar 18 '23 at 22:50
2

I encountered the same problem to configure Git on a collaborative development platform that I have to manage.

To solve it :

  • I've Updated the release of Curl installed on the server. Download the last version on the website Download page of curland follow the installation proceedings Installation proceedings of curl

  • Get back the certificate of the authority which delivers the certificate for the server.

  • Add this certificate to the CAcert file used by curl. On my server it is located in /etc/pki/tls/certs/ca-bundle.crt.

  • Configure git to use this certificate file by editing the .gitconfig file and set the sslcainfo path. sslcainfo= /etc/pki/tls/certs/ca-bundle.crt

  • On the client machine you must get the certificate and configure the .gitconfig file too.

I hope this will help some of you.

Mrchief
  • 75,126
  • 20
  • 142
  • 189
G. Pfeiffer
  • 21
  • 1
2

Try using command

git config --global http.sslverify false

This command will allow all the certificate from HTTP which are not secured, but use cautiously if using in a professional environment.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Aniket Wavhal
  • 29
  • 1
1

I tried everything, and eventually I looked in the hosts file and there was a random entry there for GitHub. Removing the alias fixed the problem.

%systemroot%\system32\drivers\etc\hosts
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
GenericEventHandler
  • 11
  • 1
1

I simply disabled the SSL certificate authentication and used the simple user name password login as shown below:

Enter image description here

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
0x3bfc
  • 2,715
  • 1
  • 16
  • 20
0

I needed two things:

  1. go to Cygwin setup and include the package 'ca-certificates' (it is under Net) (as indicated elsewhere).

  2. Tell Git where to find the installed certificates:

    **GIT_SSL_CAINFO=/usr/ssl/certs/ca-bundle.crt**  GIT_CURL_VERBOSE=1 git ...

(Verbose option is not needed)

Or storing the option permanently:

   **git config** --global http.sslCAinfo /usr/ssl/certs/ca-bundle.crt

   git ...
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
user2896631
  • 11
  • 1
0

I needed the certificates just for Cygwin and Git, so I did what @esquifit posted. However, I had to run step 5 manually, c_rehash was not available on my system.

I followed this guide: Installing CA Certificates into the OpenSSL framework instead.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Sonata
  • 2,177
  • 25
  • 32
-2

I had the same issue.

Certificate import or command to unset SSL verification didn't work. It turns out to be an expired password for the network proxy. There was an entry of proxy configuration in the .gitconfig file present in my Windows user profile.

I just removed the whole entry, and it started working again.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
sap
  • 331
  • 2
  • 4
  • 16
-2

On a Mac OS X 10.5 (Leopard) system, I was able to get this to work with a simple method. First, run the GitHub procedures and the test, which worked ok for me, showing that my certificate was actually ok.

Connecting to GitHub with SSH

ssh -T git@github.com

Then I finally noticed yet another URL format for remotes. I tried the others, above and they didn't work.

2.5 Git Basics - Working with Remotes

git@github.com:MyGithubUsername/MyRepoName.git

A simple "git push myRemoteName" worked great!

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
AnneTheAgile
  • 9,932
  • 6
  • 52
  • 48
-2

I recently (Jul 2014) had a similar issue and found on OS X (v10.9.4 (Mavericks)) that there was a "DigiCert High Assurance EV Root CA" certificate had expired (although I had another unexpired one as well).

  1. Open Keychain Access
  2. search Certificates for "DigiCert"
  3. View menu → Show Expired Certificates

I found two certificates named "DigiCert High Assurance EV Root CA", one expiring Nov 2031 and the expired one at July 2014 (a few of days previously). Deleting the expired certificate resolved the issue for me.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
craigb
  • 16,827
  • 7
  • 51
  • 62
-3

For those using MSYS/MinGW Git, add this:

export GIT_SSL_CAINFO=/mingw32/ssl/certs/ca-bundle.crt
Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
John Chain
  • 658
  • 4
  • 9