git error "unable to get local issuer certificate" with "User Trust" certificate

Question

I do host a gitea server and access git via https. The certificate is not self-signed, but from a proper CA, User Trust (https://www.tbs-certificates.co.uk/FAQ/en/racine-USERTrustRSACertificationAuthority.html). I'm using the latest git client for windows (2.38.1, 64bit)

When i do a git pull, the error unable to get local issuer certificate is shown.

I do understand that git by default uses openssl and the certificate list via the file ca-bundle.trust for validating certificates.

The strange thing is that git actually contains the root certificate, but it's not exactly the same. The certificate which is part of the ca-bundle.trust file has some additional content (Marked in green)

When i compare the properties of the two certificates, i don't see any difference, but i assume this is the reason why git does reject the certificate.

Certificates in case someone wants to have a look at it:

Official User Trust root certificate

Root certificate which is part of the ca-bundle.trust file from git

-----BEGIN TRUSTED CERTIFICATE-----
MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
jjxDah2nGN59PRbxYvnKkKj9MD0wFAYIKwYBBQUHAwQGCCsGAQUFBwMBDCVVU0VS
VHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5
-----END TRUSTED CERTIFICATE-----

Question

Why does git not have the exact same root certificate as the one from User Trust?
What is in the additional content in the certificate file?

Answer

As mentioned in a comment by user "qwerty 1999", the command git config --global http.sslbackend schannel can be used to force git to use the windows certificate store which solves my problem since the "User Trust" root certificate is part of the certificate store by default. I still don't understand why git doesn't use the root certificate provided by "User Trust CA". This would avoid having to apply this workaround.

qwerty 1999 · Answer 1 · 2022-11-11T17:48:02.343

1

I opened these certs with git's builtin openssl (enter this in git command line):

  openssl x509 -inform pem -noout -text -in '1.cer' > first_cert.txt
  openssl x509 -inform pem -noout -text -in '2.cer' > second_cert.txt

Then compared those outputs and got this: compared files So, basically that are use cases.

What about making it work I think here is the answer Looks similar to your problem. If not working try this (In short it says that you should add your certs at the end of ca-bundle.cert)

edited Nov 11 '22 at 17:48

answered Nov 11 '22 at 17:30

qwerty 1999

121
7

I do understand that i can either add the certificates to the ca-bundle.cert, or even just configure git to use the windows cert store. In both cases, the problem is fixed. But i'd like to understand why the ca-bundle.cert doesn't contain the same root certificate as provided by the actual CA – Manuel Nov 11 '22 at 20:23
As I read here: https://confluence.atlassian.com/bitbucketserverkb/ssl-certificate-problem-unable-to-get-local-issuer-certificate-816521128.html When using Windows, the problem resides that git by default uses the "Linux" crypto backend, so the GIT operation may not complete occasionally. Starting with Git for Windows 2.14, you can configure Git to use SChannel, the built-in Windows networking layer as the crypto backend. To do that, just run the following command in the GIT client: git config --global http.sslbackend schannel – qwerty 1999 Nov 11 '22 at 20:34
I still do not understand why a valid CA root certificate which is part of the ca-bundle.cert doesn't work, but the command "git config --global http.sslbackend schannel" which forces git to use the windows certificate store does solve/workaround the issue. Sad thing is that this now has to be done for all users which are using the git server. – Manuel Nov 14 '22 at 07:17
It's misunderstanding between windows and linux tools, they can't talk in some reason. – qwerty 1999 Nov 14 '22 at 14:36

score 1 · Answer 2 · answered Nov 11 '22 at 21:54

I'd like to understand why the ca-bundle.cert doesn't contain the same root certificate as provided by the actual CA

Because your server could not use the original certificate to sign a key without first adding a Trust use extension.

As documented in x509:

A trusted certificate is an ordinary certificate which has several additional pieces of information attached to it such as the permitted and prohibited uses of the certificate and an "alias".

(That is the extra bit you see in your certificate)

Normally when a certificate is being verified at least one certificate must be "trusted".
By default a trusted certificate must be stored locally and must be a root CA: any certificate chain ending in this CA is then usable for any purpose.

Trust settings currently are only used with a root CA.
They allow a finer control over the purposes the root CA can be used for.
For example a CA may be trusted for SSL client but not SSL server use.

Using a git config --global http."https://your.domain.com/".sslCAInfo <your_certificate>.pem is the right way to instruct Git to use that trusted certificate.

git error "unable to get local issuer certificate" with "User Trust" certificate

Official User Trust root certificate

Root certificate which is part of the ca-bundle.trust file from git

Question

Answer

2 Answers2