How can I make git accept a self signed certificate?

Learn how can i make git accept a self signed certificate? with practical examples, diagrams, and best practices. Covers git, version-control, https development techniques with visual explanations.
Tags:
Categories:

Making Git Accept Self-Signed Certificates

Hero image for How can I make git accept a self signed certificate?

Learn how to configure Git to work seamlessly with repositories protected by self-signed SSL certificates, ensuring secure communication without compromising development workflows.

When working in enterprise environments or with internal development servers, it's common to encounter Git repositories secured with self-signed SSL certificates. By default, Git, like most clients, will reject connections to servers using certificates it cannot verify against a trusted Certificate Authority (CA). This article provides comprehensive methods to configure Git to trust these self-signed certificates, allowing you to clone, push, and pull from your repositories securely.

Understanding the Problem: Untrusted Certificates

Git relies on a chain of trust for HTTPS connections. When you connect to a remote repository over HTTPS, Git checks the server's SSL certificate. If the certificate is signed by a CA that Git's underlying SSL library (usually OpenSSL or Secure Channel on Windows) trusts, the connection proceeds. However, if the certificate is self-signed or signed by an internal CA not present in your system's trust store, Git will report an error like SSL certificate problem: self signed certificate or SSL certificate problem: unable to get local issuer certificate.

flowchart TD
    A[Git Client] --> B{Connect to Remote Repo (HTTPS)}
    B --> C{Server Presents SSL Certificate}
    C --> D{Git Verifies Certificate}
    D -- Untrusted CA / Self-Signed --> E[Error: SSL Certificate Problem]
    D -- Trusted CA --> F[Connection Established]
    E -- User Action (e.g., add trust) --> D

Git SSL Certificate Verification Flow

The most secure and recommended approach is to explicitly tell Git (or your operating system) to trust the self-signed certificate. This involves obtaining the public key of the self-signed certificate and adding it to Git's or your system's trust store. This way, Git will verify the certificate against your explicitly trusted list.

1. Step 1: Obtain the Certificate

You need to get the .pem or .crt file for the self-signed certificate. You can often download this from your browser when visiting the repository URL, or your system administrator can provide it. If you have openssl installed, you can extract it directly from the server:

openssl s_client -showcerts -connect your-git-server.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > ~/self-signed-cert.pem

Replace your-git-server.com:443 with your Git server's hostname and port.

2. Step 2: Configure Git to Trust the Certificate

Once you have the .pem file, you can configure Git to use it as an extra CA bundle. This can be done globally for all Git operations:

git config --global http.sslCAInfo ~/self-signed-cert.pem

Alternatively, you can add it to your system's CA bundle. The location varies by OS:

  • Linux (Debian/Ubuntu): Copy the .pem file to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
  • Linux (RHEL/CentOS): Copy the .pem file to /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust extract.
  • Windows: Import the .crt file into the 'Trusted Root Certification Authorities' store using the Certificate Manager (certmgr.msc). Git for Windows often uses its own curl CA bundle, so http.sslCAInfo is usually the most direct method.

Method 2: Disabling SSL Verification (Less Secure, Use with Caution)

While not recommended for production environments or public networks, you can disable SSL verification entirely. This should only be used in controlled, isolated environments where the risk of man-in-the-middle attacks is negligible, or for temporary debugging purposes. Disabling verification means Git will not check the authenticity of the server's certificate at all.

git config --global http.sslVerify false

Globally disable SSL verification for Git.

You can also disable verification for a specific repository only, which is slightly better than a global disable:

git config http.sslVerify false

This command should be run inside the repository's directory. To revert this, simply set it back to true:

git config --global http.sslVerify true

Method 3: Using a Custom CA Bundle for Specific Repositories

If you only need to trust a self-signed certificate for a particular repository and don't want to affect your global Git configuration, you can specify the CA bundle per-repository. This is a good compromise between security and flexibility.

cd /path/to/your/repo
git config http.sslCAInfo /path/to/your/self-signed-cert.pem

Configure a custom CA bundle for a single Git repository.

This setting will be stored in the .git/config file of that specific repository and will override any global http.sslCAInfo setting for that repository.