How can I make git accept a self signed certificate?

It’s not a good practice to set http.sslVerify false. Instead we can use SSL certificate.

So, build agent will use https with SSL certificate and PAT for authentication.

Copy the content of cer file including –begin—and –end--.

git bash on build agent => git config –global http.sslcainfo “C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt” Go to this file and append the .cer content.

Thus, build agent can access the SSL certificate

Check your antivirus and firewall settings.

From one day to the other, git did not work anymore. With what is described above, I found that Kaspersky puts a self-signed Anti-virus personal root certificate in the middle. I did not manage to let Git accept that certificate following the instructions above. I gave up on that. What works for me is to disable the feature to Scan encrypted connections.

1. Open Kaspersky
2. Settings > Additional > Network > Do not scan encrypted connections

After this, git works again with sslVerify enabled.

Note. This is still not satisfying for me, because I would like to have that feature of my Anti-Virus active. In the advanced settings, Kaspersky shows a list of websites that will not work with that feature. Github is not listed as one of them. I will check it at the Kaspersky forum. There seem to be some topics, e.g. https://forum.kaspersky.com/index.php?/topic/395220-kis-interfering-with-git/&tab=comments#comment-2801211

On Windows this worked for me:

Add the content of your self signed certificate to the end of the ca-bundle file. Including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines

The location of the ca-bundle file is usually C:\Program Files\Git\mingw64\ssl\certs

Afterwards, add the path of the ca-bundle file to the global git config. The following command does the trick: git config --global http.sslCAInfo "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt"

Remark: The Path depends on your local path of the ca-bundle file!

A note about the http.sslCAPath option: git will only detect certificate files in the given directory path if the OpenSSL c_rehash command has been run on the directory containing the certificate files. The c_rehash command will create symbolic links for each certificate where the name of the link is the hash value. For example:

$ cd /path/to/ssl/cert/directory

$ ls -al

  total 16
  drwxr-xr-x  3 user  staff    96 Oct 20 13:47 .
  drwxr-xr-x  4 user  staff   128 Oct 20 13:46 ..
  -rw-r--r--  1 user  staff  4832 Oct 20 13:47 google.pem

$ /usr/local/opt/openssl@1.1/bin/c_rehash ./

  Doing ./

$ ls -al

  total 16
  drwxr-xr-x  4 user  staff   128 Oct 20 13:58 .
  drwxr-xr-x  4 user  staff   128 Oct 20 13:46 ..
  lrwxr-xr-x  1 user  staff    10 Oct 20 13:58 f6dbf7a7.0 -> google.pem
  -rw-r--r--  1 user  staff  4832 Oct 20 13:47 google.pem

Notice that the c_rehash command has created the following symbolic link: f6dbf7a7.0 -> google.pem.

You can also substitute the following command for the c_rehash utility, although note that the following command will only process *.pem files, while the c_rehash utility will process .pem, .crt, .cer, or .crl files:

for file in *.pem; do ln -s $file `openssl x509 -hash -noout -in $file`.0; done

If you now configure http.sslCAPath to the directory containing the above symbolic link, git will pick up the certificate file:

# contents of /etc/gitconfig
[http]
        sslCAPath = /path/to/ssl/cert/directory/

You can also configure http.sslCAPath by using an environment variable:

export GIT_SSL_CAPATH=/path/to/ssl/cert/directory/

My answer may be late but it worked for me. It may help somebody.

I tried above mentioned steps and that didn't solved the issue.

try thisgit config --global http.sslVerify false

I use a windows machine and this article helped me. Basically I opened ca-bundle.crt in notepad and added chain certificates in it (all of them). This issue usually happens for company networks where we have middle men sitting between system and git repo. We need to export all of the certs in cert chain except leaf cert in base 64 format and add all of them to ca-bundle.crt and then configure git for this modified crt file.

In the .gitconfig file you can add the below given value to make the self signed cert acceptable

sslCAInfo = /home/XXXX/abc.crt

I do it like this:

git init
git config --global http.sslVerify false
git clone https://myurl/myrepo.git

It works for me just run following command

git config --global http.sslVerify false

it will open a git credentials window give your credentials . for first time only it ask