Unable to pull/push in git repository

Question

$ git pull origin master
fatal: unable to access 'https://xxxxxxxxxxxxxxx': 
      error setting certificate verify locations:
CAfile: C:/Users/abc/AppData/Local/Programs/Git/usr/bin/curl-ca-bundle.crt
CApath: none

I am getting this error when I pull or push my code.

Please guide me to fix this.

Reveille

does the C:/Users/abc/AppData/Local/Programs/Git/usr/bin/curl-ca-bundle.crt file exists? – Moonset

Possible duplicate of Github: error cloning my private repository – Moonset

@Anthony - No, I just checked it its not there.. Thanks for quick reply – Reveille

@Arvind_Kapse no problem ;) – Moonset

Answer 1

I was also facing this problem in windows and running git using gitbash. I just reinstalled gitbash, And gitbash automatically managed git certificate and its path needed.

Tarragon

Seems legit. This solution worked in my case. This happened to me after messing around with Git-via-SSH stuff. – Wallache

How do you install gitbash alone? – Kenney

@Kenney I am also looking for same. – Hugohugon

Answer 2

When using https you will need to supply password or using a certificate. In your case looks like the certificate is not a valid one.

Try fixing it like this by telling git where to find the certificate:

// Add the certificate to your configuration file
git config --system http.sslcainfo "C:\Program Files (x86)\git\bin\curl-ca-bundle.crt"

---

Alternatively, you could disable SSL checks:

// or switch off SSL checks completely by executing:
git config --system http.sslverify false

Set this in your config to disable it only for the given url and not for all requests

[http "https://weak.example.com"]
    sslVerify = false

---

http.sslVerify

Whether to verify the SSL certificate when fetching or pushing over HTTPS.

---

http.sslCAInfo

File containing the certificates to verify the peer with when fetching or pushing over HTTPS

Pilkington

it's not recommended to disable sslVerify – Moonset

Agree, you can also disable it per url for a specific url as well – Pilkington

Would be much clever solution ^^, i didn't knew that, thanks @codeWizard – Moonset

For anyone coming to this post, you don't need to disable https checks if you can provide git with a correct certificate. Simply running the first command to point to the ca-bundle.crt file should be enough to resolve the issue. If not, then try disabling SSL checks. :) – Bernardinebernardo

I used this for git version 2.12.2.windows.1: git config --system http.sslcainfo "c:\Program Files\Git\mingw64\ssl\certs\ca-bundle.crt" – Fiume

I am running the following: error: could not lock config file C:\Program Files\Git\mingw64/etc/gitconfig: Invalid argument PS D:\angular-pwa-seed> git config --system http.sslcainfo "C:\Program Files\Git\mingw64\ssl\certs\curl-ca-bundle.crt" error: could not lock config file C:\Program Files\Git\mingw64/etc/gitconfig: Permission denied error: could not lock config file C:\Program Files\Git\mingw64/etc/gitconfig: Invalid argument. Any idea what's wrong? – Adama

@Adama Are you using Git 2.16.2? I was having similar issues. Could not set ssl certificate location or disable ssl verify. I switched to Git 2.13 and ssl certificates work fine. – Hardnett

Answer 3

I once had the same problem. My problem occured after re-installing git for windows. I'm using git for windows 64-bit on windows 10.

I found out that the installer did not install git anymore in C:/Users/[USER_NAME]/AppData/Local/Programs/Git. Instead it installed it under C:\Program Files\Git.

Nevertheless the old config file C:\ProgramData\Git\config was not edited by the installer. This file still contains the old path so I edited it manually.

E.g. on my system I used

[http]
     sslCAInfo = C:/Programme/Git/mingw64/ssl/certs/ca-bundle.crt

maybe you will have to use Program Files instead

     sslCAInfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt

EDIT

Like DS said in his comment

C:\ProgramData\Git\config needs to be edited as Administrator.

E.g. right click on notepad and select "Run as Administrator" then open the file.

Jazzman

On systems with another locale, use this: [http] sslCAInfo = C:\\Program Files\\Git\\mingw64\\ssl\\certs\\ca-bundle.crt – Coated

Exactly what happened to me. One more note: C:\ProgramData\Git\config needs to be edited as Administrator. – Venatic

Similar issue for me in Windows 10. "npm install" is not reading the same config file "git" does, seems like it is using the C:\ProgramData\Git\config location. So had to modify that file to add this to it (the workaround solution) [http] sslVerify = false – Marvelmarvella

Answer 4

In version 2.x of git-bash The path to the .crt has changed to ../Git/mingw64/ssl/certs/ca-bundle.crt. I had to update this manually in git-bash with

 git config --global http.sslcainfo "/path/to/Git/mingw64/ssl/certs/ca-bundle.crt"

Coward

Fixed it for me. I did VS2019 updates (LiveShare & Azure Data Lakes), then this broke but maybe coincidence, can't prove it was that. For reference this was my error: Pushing feature/test Error encountered while pushing branch to the remote repository: Git failed with a fatal error. unable to access 'mydomain.visualstudio.com/myproject/_git/myrepo': error setting certificate verify locations: CAfile: c:/program files (x86)/microsoft visual studio/2019/community/common7/ide/commonextensions/microsoft/teamfoundation/team explorer/Git/mingw32/bin/curl-ca-bundle.crt CApath: none – Madaih

Answer 5

Try this

git config --system http.sslcainfo "C:\Program Files (x86)\git\bin\curl-ca-bundle.crt"

or

Switch off your SSL by running this command

git config --system http.sslverify false

Smothers

it's not recommended to disable sslVerify – Moonset

Yes i agree. Its temp solution @AnthonyRaymond for debugging :) – Smothers

Answer 6

This issue might occur when git client is not able to find trusted CA for ssl. If you are in windows, try reinstalling it from https://gitforwindows.org/.

During the installation, select "Use the native Windows Secure Channel library" option. That option will allow you to use your company's internal Root CA certificate instead of default ca-bundle.crt

Singley

Answer 7

 git config --global http.sslverify "false" 

• will solve the problem after that Pop-up window appear to enter your username and password make sure valid .

Stumble

Answer 8

If your git version is 2.8.1.windows.1,this may help you. First , you need to locate your git home directory,mine is D:\SDK\Git.Just in the same directory,you can find folder "usr",open it and goes to \ssl\certs,you can find the certificate:ca-bundle.crt.

Then open console,execute:
git config --system http.sslcainfo "D:\SDK\Git\usr\ssl\certscabundle.crt"

Kathlyn

Answer 9

This will do the work while moving from GIT 2.x clients to 2.5.x:

Looks like after installing a new version of GIT client, it changes the path it looks for certificates from something like this:

C:\Program Files\Git\mingw64

to something like this:

C:\Program Files\Git\mingw64\libexec

To fix this, just copy the 'ssl' folder to the new location and it'll work like a charm!

Gwenora

Answer 10

Go your git directory and move the mingw64/ssl folder to mingw64/libexec/ssl

Additional

the answer is the best for me. – Incurable

Answer 11

I was having this problem after installing devel packages on cygwin.

I tried all of the fixes in this thread but nothing was working.

Then, I ran into this thread on github

I found where CAPATH was being specified in gitconfig, and I deleted that https specification, and it solved my issue.

Bombardier

Answer 12

This thread is a lot of blind-leading-the-blind answers. I'm just one more blind man here, but I just had the same issue and solved it by following this easy article. As I understand the original question, git is trying to find an SSL cert file in order to use the HTTPS protocol, and failing to find the file. Most of the answers here seem to focus on "well, just disable SSL then," rather than replacing the file correctly.

This incantation should generate the cert file and put it in the correct location for git on cygwin:

$ curl -sL http://ca.pdinc.us > /etc/pki/ca-trust/source/anchors/ca.pdinc.us.pem \
&& update-ca-trust

In case you monkeyed with your git config (like I did) and need to set it BACK, this should do it:

$ git config --global http.sslcainfo "/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt"

One other side note which could be impacting many of the people reading this thread: The expected location of the cert file depends on which git executable you're running. Since we're talking about Cygwin, some (most?) of us probably have a Windows-native flavor of git installed too. If your Cygwin paths are set up to find the Windows git executable, your mileage may vary in terms of where to point the http.sslcainfo configuration. To check which executable is getting picked up for you:

$ which git

Mathur

Answer 13

I got the same problem after my latest update of cygwin after installing Windows 10. The command update-ca-trust failed during installation.

The reason seem to be that the group owner for the certificate folder was corrupt. The somewhat drastic solution was to delete /etc/group, it turned out that cygwin is able to ask windows directly about group rights.

Solution found at http://zaunerc.blogspot.se/2016/01/cygwin-mapping-windows-sids-to-posix.html

Saimon

I wanted to keep /etc/passwd since I use a different cygwin user name compared to windows. The workaround was to temporary rename /etc/passwd and restart cygwin (X server). – Saimon

Answer 14

I found the ssl certificate at :

C:\Users\[USERNAME]\AppData\Local\GitHub\PortableGit_[portable code]\usr\ssl\certs

then you can follow solution by CodeWizard i.e. :

// Add the certificate to your configuration file
git config --system http.sslcainfo "[LOCATION_SPECIFIED_ABOVE]/cabundle.crt"

Amora

Answer 15

Current Git for Windows build (2.18.0.windows.1) has a bug -- if the http.sslcainfo is not set it expects to find the certificate store in C:/Program Files/Git/mingw64/libexec/ssl/certs/ca-bundle.crt.

Certificate store is actually installed to C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt so to fix that you must specify the proper path.

Furthermore, the SCHANNEL implementation is also broken in this build.

Finally, Git credential manager is also broken because if you have CI/CO credentials stored from gitlab-runner installation it will fail to clone/push/pull with access denied error instead of prompting for different credentials.

Hannahannah

Answer 16

I had previously installed git, then uninstalled it.

So for me was as simple as reinstalling the correct version of git (for me win x64) from

https://git-scm.com/download/win

Metagenesis

Answer 17

Using Intellij and git-sdk-64, and picked git-sdk-64\mingw64\bin\git.exe at first to be getting this issue, then when switched to git-sdk-64\cmd\git.exe it figured the cert file location alone and no other configuration was needed. (have not used git config --global http.sslcainfo ...)

Bilestone

Answer 18

I have found the following steps useful in fixing the issue at my end for Windows 10:

Doing an uninstall of git.

However, git uninstaller doesn't do a clean job. So you may need to go delete the Git directory at C:\Users[My name]\AppData\Local\Programs\

After this, a fresh install of git should install install it in the C:\Program Files\Git directory where the config file points to in order to read the ssl certificate.

Chronograph

Answer 19

I had the same error and I fixed it reinstalling git in the default path:

C:\Program Files\Git

That's all

Seating

Answer 20

I've got the same error message but in my case it was because I've changed github settings to use ssh instead of https.

And the repository with the problem was cloned with https after removing the remote and re-adding it with ssh it's working as expected.

$git remote remove origin
$git remote add origin [email protected]:UserName/repo.git

Then git remote show origin is correctly showing the remote.

Corlisscorly

This answer ACTUALLY helped and SHOULD be the accepted answer. Its a MUCH simpler and SAFER sequence of steps that ACTUALLY WORKS. DO NOT disable SSL via git config --system http.sslverify false because SSL is the encryption software which keeps your connection and your code secure in transit. Use the answer above my comment for REAL HELP. – Edaedacious

Answer 21

I got the same error in Windows 7. Found that the certificate path referred in the error was not existing. Instead of ...\mingw32\usr\ssl... the cert file was in ...\mingw2\ssl... So I created a usr folder manually and moved the entire ssl tree into usr. This fixed the issue.

Novercal

Answer 22

Thanks to https://github.com/npm/npm/issues/1484
git config --global http.sslverify "false" will solve the problem

Motherly

Answer 23

I ran into the same error message but while cloning a github repository, unfortunately setting the http.sslcainfo didnt quite help. As I happened to be behind a corporate proxy server, setting the http.proxy fixed it for me.

Flesher