Git Bash: “Unable to get local issuer certificate”

While cloning a Git repository using Git Bash (Git for Windows), you may get an error as follows:

fatal: unable to access ‘<URL>’: SSL certificate problem: unable to get local issuer certificate

In this short note i will show a fast workaround of this problem and how to resolve it properly.

Cool Tip: Decode SSL certificates using OpenSSL! Read more →

Unable to get local issuer certificate

“Unable to get local issuer certificate” error usually happens when the Git server’s SSL certificate is Self-Signed or it has been issued by the corporate Certificate Authority (CA).

Workaround

As a workaround you can disable SSL certificate validation in Git as follows:

$ git -c http.sslVerify=false clone <URL>

Also you can temporary disable SSL certificate validation globally:

$ git config --global http.sslVerify false

To enable it back again, run:

$ git config --global http.sslVerify true

Resolution

The resolution of the “SSL certificate problem” is to add the Git server’s Self-Signed SSL certificate or the Root and Certificate Authority (CA) SSL certificates (if the Git server’s SSL certificate has been issued by your enterprise) to the trusted certificate store.

If you don’t have them locally, you can download these certificates from the Git server using your web-browser or using the command-line.

Cool Tip: How to get SSL certificate from a server (site’s URL)! Read more →

By default, the certificates store for Git Bash is located in the following directory:

C:\Program Files\Git\mingw64\ssl\certs\

You can also open this directory in File Explorer by executing these commands in Git Bash:

$ cd /mingw64/ssl/certs/
$ explorer .

In this directory you should find a file called ca-bundle.crt.

Open ca-bundle.crt in a text-editor and copy/paste the Git server’s Self-Signed SSL certificate or the Root and Certificate Authority (CA) SSL certificates at the end of the file.

Once the file is saved, you should be able to run the git clone command in Git Bash without getting the “SSL certificate problem: Unable to get local issuer certificate”.