Trusting SSL Certificates with Git

Secure Communication with Git and SSL Certificates

Git relies on the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols to establish secure connections when interacting with remote repositories over HTTPS. This ensures the integrity and confidentiality of your code and data. However, when a remote server uses a self-signed certificate – a certificate not issued by a trusted Certificate Authority (CA) – Git will, by default, refuse the connection. This tutorial explains how to configure Git to trust these self-signed certificates, along with important security considerations.

Understanding the Problem

When you clone, fetch, or push to a repository over HTTPS, Git verifies the server’s SSL/TLS certificate. This verification process confirms that the server is who it claims to be and protects against man-in-the-middle (MitM) attacks. A self-signed certificate doesn’t have this inherent trust because it hasn’t been validated by a recognized CA. Git rightfully flags this as a potential security risk.

Configuring Git to Trust a Self-Signed Certificate

There are several ways to configure Git to trust a self-signed certificate. The most secure and recommended approach is to explicitly tell Git where to find the certificate.

1. Using http.sslCAInfo (Recommended)

This method involves configuring Git to trust a specific certificate file.

• Obtain the Certificate: Download the self-signed certificate from the server administrator. This certificate is typically in .pem or .crt format.

• Configure Git: Use the http.sslCAInfo configuration option. You can set this globally for all repositories or locally for a specific repository.

  • Globally (affects all repositories):

    git config --global http.sslCAInfo /path/to/your/certificate.pem
    

  • Locally (affects only the current repository):

    git config http.sslCAInfo /path/to/your/certificate.pem
    

2. Using http.sslCAPath

If you have a directory containing multiple CA certificates, you can use http.sslCAPath.

git config --global http.sslCAPath /path/to/your/certificate/directory

Git will search this directory for the necessary certificates to verify the server.

3. Using Environment Variables

You can temporarily override Git’s configuration using environment variables. This is useful for one-off commands or scripting.

• GIT_SSL_CAINFO: Specifies a single certificate file.
• GIT_SSL_CAPATH: Specifies a directory containing certificate files.

For example:

GIT_SSL_CAINFO=/path/to/your/certificate.pem git clone https://your-server/repo.git

Disabling SSL Verification (Not Recommended)

While possible, disabling SSL verification entirely is strongly discouraged due to significant security risks. This makes your connection vulnerable to MitM attacks, where an attacker could intercept and modify your data.

• Globally (Do NOT use unless absolutely necessary):

  git config --global http.sslVerify false
  

• Using Environment Variables (Use with caution):

  GIT_SSL_NO_VERIFY=true git clone https://your-server/repo.git
  

• Command Line (Use with caution):

  git -c http.sslVerify=false clone https://your-server/repo.git
  

If you must disable verification, do so only temporarily for testing or specific, controlled environments. Always re-enable it as soon as possible.

Security Considerations

• Trust, but Verify: Before trusting a self-signed certificate, ensure you’ve obtained it from a legitimate source and verified its authenticity.
• Minimize Scope: Whenever possible, configure trust on a per-repository basis using local configuration rather than globally.
• Avoid Disabling Verification: Disabling SSL verification should be the last resort. Always prefer configuring Git to trust the specific certificate.
• Keep Certificates Updated: If the server’s certificate is updated, make sure to update your Git configuration accordingly.

By following these guidelines, you can securely interact with Git repositories that use self-signed certificates while maintaining a strong security posture.