SSL

Resolve SSL issues

Problem:

Interacting with the remote repository (for example git pull) using a secure HTTP connection (for example https://github.com) on a Windows machine using Git for Windows leads to this error message:

Git on Windows: unable to get local issuer certificate
Cause:

The defined SSL backend to validate the remote’s SSL certificate is not able to find the local trusted root CA certificate.

Either no or an improper tool is specified, or the certificate is missing.

Solution:

Check the git config for the specified tool:

C:\> git config --global --get http.sslbackend

which should print schannel (refers to Secured Channel). If not, run

C:\> git config --global http.sslbackend schannel

If that does not resolve the issue, check the root CA certificate:

  1. Open the webpage of the remote git service (for example https://github.com).

  2. Find out the ROOT CA certificate used by the website.

  3. Open the certificate manager (Win+R, type certmgr.msc and confirm).

  4. Under Trusted Root Certification Authorities / Certificates, check if if the certificate of the website is listed (it shouldn’t).

  5. Search the web for a download to the root CA certificate in *.crt or *.cer format.

  6. Right-click Trusted Root Certification Authorities –> Certificate and select All Tasks –> Import… and follow the instructions to add the certificate.