Fix Git Self Signed Certificate in Certificate Chain on Windows
You are in the right place if you're trying to usegit clone on a computer and running into one of the following errors:
SSL certificate problem: self signed certificate in certificate chain
SSL certificate problem: unable to get local issuer certificate
A popular workaround is to disable SSL Verification usinggit config --global http.sslVerify false but that creates large security risks. SSL is a good thing & we should use it, even in cases where your company makes it difficult. The solution is to add the certificates to Git's trusted certificates.
I ran into a popular enterprise tool named Palo Alto that does a man in the middle on untrusted web traffic. While Palo Alto is great for securing your company's network, it can make using secure code repositories like GitHub more difficult if it intercepts the traffic. Let's look at an example using GitHub.
Using Google Chrome I see that GitHub has an SSL on it. I can view more information by clicking theSecure tab in the address bar.
On the drop down menu, clickValid
In my example, you will notice two certification paths above GitHub.
We'll need to do the following steps for both certification paths.
Click the first PaloAltoTrust (or your equivalent) certificate.
On the same window click the View Certificate button.
Click the Details tab on the new window & then the copy to file button.
On the next window click Next on the Export Wizard
Choose Base 64 Encoded
Store the file temporarily somewhere & click Next & then Finish. You can delete the file after everything works.
Important: Repeat these steps if you had more than one level of certificates listed above GitHub.
Git uses a file namedca-bundle.crt to list all the trusted certificates. We can find that file by typing the following in a terminal window:
git config --list --show-originThis tells me myca-bundle.crt file is listed inC:\Program Files (x86)\Git\mingw32\ssl\certs\ca-bundle.crt. Let's copy this to a new location. I'm going to copy mine toC:\Users\Matt\ca-bundle.crt. You can do this through the GUI or with a terminal like below:
copy"C:\Program Files (x86)\Git\mingw32\ssl\certs\ca-bundle.crt" c:\Users\Matt\ca-bundle.crtChangeMatt to your Windows user directory.
Your favorite text editor can open up theca-bundle.crt file that you copied & the.cer files you exported from the browser. Copy the entire.cer text including the----BEGIN CERTIFICATE--- and----END CERTIFICATE--- to the bottom of yourca-bundle.crt file. Do this for all the.cer files you exported.
One last step to complete! Back in your terminal add the copiedca-bundle.crt to Git's config.
git config --global http.sslCAInfo C:/Users/Matt/ca-bundle.crtYou should now be able to access GitHub usinggit clone without compromising security. Give it a shot.
One Last Thing...
If you have a question or see a mistake, please comment below.
If you found this post helpful, please share it with others. It's the best thanks I can ask for & it gives me momentum to keep writing!
On occassion I do link to a product available on Amazon. As an Amazon Associate I earn from qualifying purchases.