Git "SSL certificate problem": unable to get local issuer certificate

Git over HTTPS uses libcurl or the platform TLS library to verify the server's certificate. This error means verification failed, so Git refused to talk to the server. The message wording after "SSL certificate problem" tells you what failed.

fatal: unable to access 'https://git.example.com/team/app.git/': SSL certificate problem: unable to get local issuer certificate
fatal: unable to access '...': SSL certificate problem: self-signed certificate
fatal: unable to access '...': SSL certificate problem: self-signed certificate in certificate chain
fatal: unable to access '...': SSL certificate problem: certificate has expired
fatal: unable to access '...': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Check in this order

1. Is the server certificate valid and complete? Test the server with the SSL Checker and SSL Chain Debugger.
2. Is a corporate proxy intercepting TLS and re-signing with a company CA?
3. Is the client's CA bundle missing or old (containers, minimal images, old OS)?
4. Is the system clock wrong?
5. Is Git using a different CA store than you expect (Windows, macOS)?

1. Inspect the server

openssl s_client -connect git.example.com:443 -servername git.example.com -showcerts </dev/null 2>/dev/null | grep -E "s:|i:|Verify return"

The most common server-side fault is a missing intermediate certificate. Browsers sometimes repair that themselves, while Git does not, so the site works in Chrome but fails in Git. Fix it by serving the full chain (leaf plus intermediates) on the server. The SSL Chain Debugger shows exactly what is missing, and the SSL certificate errors guide explains each state. If the message says expired, renew it; see Let's Encrypt renewal failures.

2. Corporate TLS inspection or a private CA

If you are on a company network or use an internal Git server with an internal CA, the issuer is not in your trust store. Get the CA certificate in PEM form from your IT team and tell Git about it:

git config --global http.sslCAInfo /path/to/company-ca.pem
git config --global http."https://git.example.com/".sslCAInfo /path/to/company-ca.pem

Alternatively add the CA to the operating system trust store:

sudo cp company-ca.crt /usr/local/share/ca-certificates/company-ca.crt
sudo update-ca-certificates

sudo cp company-ca.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

For the self-signed variants of this problem, see self signed certificate in certificate chain.

3. Missing CA bundle

Slim containers and CI images often lack root certificates, which makes every HTTPS call fail:

apt-get update && apt-get install -y ca-certificates     # Debian/Ubuntu
apk add --no-cache ca-certificates                       # Alpine

See CA certificates missing in a container for the full set of fixes. On very old systems, the bundle may predate current roots; update the OS packages instead of overriding them.

4. Windows and macOS specifics

Git for Windows ships its own CA bundle and may use OpenSSL by default, so a corporate root installed in the Windows store is ignored. Tell Git to use the Windows certificate store:

git config --global http.sslBackend schannel

(Or choose "Use the native Windows Secure Channel library" in the installer.) Reinstalling or switching the backend is cleaner than editing bundle files, which an update overwrites. Check git config --list --show-origin | grep -i ssl to see which settings apply.

5. Clock

A system clock far from real time makes valid certificates look expired or not yet valid. Compare date -u with a trusted source and enable NTP time sync.

Do not disable verification

You will find advice to run git config --global http.sslVerify false or export GIT_SSL_NO_VERIFY=true. That turns off the check that protects your credentials and code from interception. If you must unblock yourself for a minute against a known internal host, scope it to a single command and remove it afterward:

git -c http.sslVerify=false clone https://git.example.com/team/app.git

Verify

git ls-remote https://git.example.com/team/app.git
GIT_CURL_VERBOSE=1 git ls-remote https://git.example.com/team/app.git 2>&1 | head -40

If the server is yours, monitor the certificate so renewal never surprises you; the Uptime Monitor alerts on SSL expiry, and the TLS Version Checker confirms the server supports modern protocol versions that current clients require.

Next steps

• Inspect the chain with the SSL Chain Debugger.
• Compare with the curl 60 SSL certificate problem.
• Read SSL/TLS certificate errors explained.
• Set up expiry alerts for your own Git host.

FAQ

Why does the site open in my browser but Git fails?

Browsers can fetch missing intermediate certificates and use their own trust stores. Git uses the CA bundle configured in its TLS library, which may not include a corporate root or may be missing the intermediate.

Is http.sslVerify false ever acceptable?

Only as a temporary, one-command workaround against a host you control. Never as a global or committed setting.

Does SSH have the same problem?

No. SSH does not use X.509 certificates by default; it uses host keys. See Host key verification failed.

Which message means an expired certificate?

"certificate has expired". Renew the server certificate; no client setting will fix that correctly.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.