Git ssl error on windows

Question

I keep getting the following error when attempting to clone a git repository using ssl on windows:

error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

The ssl certificate hierarchy is trusted (the issuer certificate is added to Trusted Root Certificate Authorities) and I can browse to the hosting site (a private instance of Gitorious) without ssl errors. I've tried cloning on Windows 7 and on Windows Server 2008 and it's failed both times.

Anyone got any ideas?

Berezina

Possible duplicate of Invalid SSL certificate when pushing to Git server – Weathertight

f15ijp.com/2012/08/… one of the best solution which I found – Olympia

Answer 1

Git Apparently not take certificates saved in windows, you have to specify what editing the path to the certificate file .gitconfig

gitconfig location:

C:\Program Files (x86)\Git\etc

Add the line (replace with the path to file and yourCertificate.ctr with the name to your certificate):

.
.
.
[help]
    format = html
[http]
    sslVerify = true
    sslCAinfo = C:/Program Files (x86)/Git/bin/curl-ca-bundle.crt
    sslCAinfo = [route]/yourCertificate.crt
[sendemail]
    smtpserver = /bin/msmtp.exe

[diff "astextplain"]
.
.
.

and try again..

Teakwood

I was having the same problem with Stash installed on my server. I had to save the certificate as rfc, only then did it work. So, on the server, where I have my keystore I ran this: "%JAVA_HOME%\bin\keytool" -export -keystore .keystore -rfc -alias tomcat -file yourCertificate.crt – Apomorphine

Git on Windows no longer uses a .gitconfig file or a curl-ca-bundle.crt in those locations and I'm having trouble finding the right way of doing this now. – Masquerade

@Masquerade C:\Program Files\Git\mingw64\ssl\certs? – Maunder

Answer 2

The location of http.sslcainfo is stored in "C:\ProgramData\Git\config". It is not altered when uninstalling/reinstalling git.

I recently had to change it from

sslCAInfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt

to

sslCAInfo = C:/Users/kristof/AppData/Local/Programs/Git/mingw64/ssl/certs/ca-bundle.crt

Also see issue:
Configure http.sslcainfo in Git for Windows' own system-wide config #531
https://github.com/git-for-windows/git/issues/531

Rojo

Answer 3

Make sure to add to your Git global config file:

 http.sslcainfo=/bin/curl-ca-bundle.crt

Your msysgit instance needs to know where to look for the CA certificates in order to validate them.

See more settings in this SO answer or in "Cannot get Http on git to work".

Hither

If I run git clone from Git Bash it works. Only issue in eclipse. – Ormolu

@JigarShah that could be a question in its own, describing the problem and adding a lot of specific details (what OS, what version of Java, Eclipse, Egit? what version of git?) – Hither

Sorry comment at wrong place. Win8-64Bit, Eclipse Luna, (No special plugin for git but m2eclipse) JDK8. #24551242 – Ormolu

@JigarShah you are using an ssh url: you don't need a proxy for that. – Hither

Answer 4

If all else fails, you can set the environment variable GIT_SSL_NO_VERIFY to true. However, it is hopefully possible to resolve the issue in another way. WARNING: This exposes you to SECURITY RISKS, as you can no longer trust that you're talking to the server you think you're talking to.

Nader

I did the same. same error. In eclipse > git > Configuration > User settings added sslVerify = false. But it seems its not able to connect on ssl itself. – Ormolu