Resolving SSL Certificate Issues with Git over HTTPS

When working with Git over HTTPS, you may encounter issues related to SSL certificate verification. This tutorial will guide you through understanding and resolving these issues.

Understanding SSL Certificate Verification

SSL (Secure Sockets Layer) certificates are used to establish secure connections between your system and a remote server, such as GitHub. When you access a repository over HTTPS, Git checks the server’s SSL certificate to ensure it is valid and trusted. If the certificate is not verified, you will encounter an error.

Common Errors

One common error is "SSL certificate problem, verify that the CA cert is OK." This error occurs when your system does not have the necessary Certificate Authority (CA) certificates installed to verify the server’s SSL certificate.

Solution 1: Install CA Certificates

To resolve this issue, you need to install the CA certificates on your system. You can download the cacert.pem file from the curl website, which contains a collection of trusted CA certificates.

Here are the steps to install CA certificates on Cygwin:

Install the curl and openssl packages using Cygwin’s setup.exe.
Download the cacert.pem file using the following command:

curl http://curl.haxx.se/ca/cacert.pem -o /usr/ssl/certs/cacert.pem

Split the cacert.pem file into individual certificates and index them using the following commands:

cd /usr/ssl/certs
awk '{print > "cert" (1+n) ".pem"} /-----END CERTIFICATE-----/ {n++}' cacert.pem
c_rehash

Note: You need to install the openssl-perl package to use the c_rehash command.

Solution 2: Ignore SSL Certificate Verification

Alternatively, you can ignore SSL certificate verification by setting the GIT_SSL_NO_VERIFY environment variable to true. However, this solution has security implications and should be used with caution.

You can set the environment variable using the following command:

export GIT_SSL_NO_VERIFY=true

Or, you can configure Git to ignore SSL certificate verification for a specific repository or globally using the following commands:

git config http.sslVerify false
git config --global http.sslVerify false

Solution 3: Use a Specific CA Certificate File

If you want to use a specific CA certificate file, you can configure Git to use it by setting the sslCAinfo option in your .gitconfig file.

Here’s an example:

[http]
sslCAinfo = /path/to/cacert.pem

You can also set the GIT_SSL_CAINFO environment variable to specify the path to the CA certificate file.

Tunneling SSH through a Firewall

If you are behind a firewall, you may need to tunnel SSH connections through a proxy server. One way to do this is by using the corkscrew tool.

Here’s an example of how to use corkscrew to tunnel SSH connections:

Host github.com
  HostName ssh.github.com
  Port 443
  User git
  ProxyCommand corkscrew <proxyhost> <proxyport> %h %p ~/.ssh/proxy_auth

This configuration tells Git to use the corkscrew tool to tunnel SSH connections through a proxy server.

In conclusion, resolving SSL certificate issues with Git over HTTPS requires understanding the underlying causes and using one of the solutions outlined in this tutorial. By installing CA certificates, ignoring SSL certificate verification, or using a specific CA certificate file, you can ensure secure and reliable access to your repositories.