SSL certificate problem: Unable to get local issuer certificate | Bitbucket Data Center (2024)

Problem

The following is seen on the command line when pushing or pulling:

SSL Certificate problem: unable to get local issuer

Cause

There are two potential causes that have been identified for this issue.

1. A Self-signed certificate cannot be verified.
2. Default GIT crypto backend (Windows clients)

Resolution

Resolution #1 - Self Signed certificate

Workaround

Tell git to not perform the validation of the certificate using the global option:

git config --global http.sslVerify false

Please be advised disabling SSL verification globallymight be considered a security riskand should be implemented only temporarily

Resolution - Client Side

There are several ways this issue has been resolved previously. Below we suggest possible solutions that should be run on the client side:

1. Ensure the root cert is added to git.exe's certificate store. The location of this file will depend on how/where GIT was installed. For instance,the trusted certificate store directory for Git Bash isC:\Program Files\Git\mingw64\ssl\certs. This is also discussed on this Microsoft blog.

2. Tell Git where to find the CA bundle, either by running:

   git config --system http.sslCAPath /absolute/path/to/git/certificates

   See Also

   Fix SSL Error - How to Fix ERR_SSL_PROTOCOL_ERROR on Chrome

   where/absolute/path/to/git/certificates is the path to where you placed the file that contains the CA certificate(s).

   or bycopying the CA bundle to the /bindirectory and adding the following to thegitconfig file:

   sslCAinfo = /bin/curl-ca-bundle.crt

3. Reinstall Git.

4. Ensure that the complete certificate chain is present in the CA bundle file, including the root cert.

Resolution - Server Side

This issue can also happen on configurations whereBitbucket Server is secured with an SSL-terminating connector rather than a proxy

1. Ensure that the Java KeyStore has the entire certificate chain (Intermediate CA and Root CA)
   • View the Certificate Chain Details inside the KeyStore using a tool like the KeyStore Explorerto check

Resolution #2 -Default GIT crypto backend

When using Windows, the problem resides that git by default uses the "Linux" crypto backend, so the GIT operation may not complete occasionally. Starting with Git for Windows 2.14, you can configure Git to use SChannel, the built-in Windows networking layer as the crypto backend. To do that, just run the following command in the GIT client:

git config --global http.sslbackend schannel

This means that it will use the Windows certificate storage mechanism and youdon'tneed to explicitly configure the curl CA storage (http.sslCAInfo) mechanism.

Was this helpful?

Yes

Provide feedback about this article