Cant clone from GitHub : SSL certificate problem: unable to get local issuer certificate

[dineshdixitgit]

Describe the feature or problem you’d like to solve

DINESH.DIXIT@LP-B1NY0Z2 MINGW64 /c/code/GitHub2
$ git clone https://github.com/dineshdixitgit/meta-api.git
Cloning into 'meta-api'...
fatal: unable to access 'https://github.com/dineshdixitgit/meta-api.git/': SSL certificate problem: unable to get local issuer certificate

A clear and concise description of what the feature or problem is.

Proposed solution

How will it benefit Desktop and its users?

Additional context

Add any other context like screenshots or mockups are helpful, if applicable.

[steveward]

@dineshdixitgit this error can be caused by a few things -- are you running any security software on your machine that could be interfering with your connection to GitHub? Some security software will man-in-the-middle your connection.

You can also check out this issue thread #3684 for some specific steps to debug this issue. To check if there are any configuration issues on your machine it would be helpful if you could open up Git for Windows and run the following command:

git config -l --show-origin

Let me know the output of that.

[dineshdixitgit]

Hi GitHub Team, Please find trace as below- DINESH.DIXIT@LP-B1NY0Z2 MINGW64 /c/code/GitHub/gcdm (GCDM_CORE_152.00_MISC) $ git config -l --show-origin file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig diff.astextplain.textconv=astextplain file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig filter.lfs.clean=git-lfs clean -- %f file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig filter.lfs.smudge=git-lfs smudge -- %f file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig filter.lfs.process=git-lfs filter-process file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig filter.lfs.required=true file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig http.sslbackend=openssl file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig http.sslcainfo=C:/Users/dinesh.dixit/AppData/Local/Programs/Git/mingw64/ssl/certs/ca-bundle.crt file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig core.autocrlf=true file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig core.fscache=true file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig core.symlinks=false file:C:/Users/dinesh.dixit/AppData/Local/Programs/Git/etc/gitconfig credential.helper=manager file:C:/Users/dinesh.dixit/.gitconfig filter.lfs.required=true file:C:/Users/dinesh.dixit/.gitconfig filter.lfs.clean=git-lfs clean -- %f file:C:/Users/dinesh.dixit/.gitconfig filter.lfs.smudge=git-lfs smudge -- %f file:C:/Users/dinesh.dixit/.gitconfig filter.lfs.process=git-lfs filter-process file:C:/Users/dinesh.dixit/.gitconfig user.name=dineshdixitgit file:C:/Users/dinesh.dixit/.gitconfig user.email=42814589+dineshdixitgit@users.noreply.github.com file:.git/config core.repositoryformatversion=0 file:.git/config core.filemode=false file:.git/config core.bare=false file:.git/config core.logallrefupdates=true file:.git/config core.symlinks=false file:.git/config core.ignorecase=true file:.git/config submodule.active=. file:.git/config remote.origin.url=https://github.com/wmgdsp/gcdm.git file:.git/config remote.origin.fetch=+refs/heads/*:refs/remotes/origin/* file:.git/config branch.master.remote=origin file:.git/config branch.master.merge=refs/heads/master file:.git/config branch.GCDM_CORE_151.00_S1.remote=origin file:.git/config branch.GCDM_CORE_151.00_S1.merge=refs/heads/GCDM_CORE_151.00_S1 file:.git/config branch.GCDM_CORE_141.00_API.remote=origin file:.git/config branch.GCDM_CORE_141.00_API.merge=refs/heads/GCDM_CORE_141.00_API file:.git/config branch.GCDM_CORE_152.00_MISC.remote=origin file:.git/config branch.GCDM_CORE_152.00_MISC.merge=refs/heads/GCDM_CORE_152.00_MISC DINESH.DIXIT@LP-B1NY0Z2 MINGW64 /c/code/GitHub/gcdm (GCDM_CORE_152.00_MISC) $ git status On branch GCDM_CORE_152.00_MISC Your branch is up to date with 'origin/GCDM_CORE_152.00_MISC'. nothing to commit, working tree clean DINESH.DIXIT@LP-B1NY0Z2 MINGW64 /c/code/GitHub/gcdm (GCDM_CORE_152.00_MISC) Thanks, Dinesh Dixit WMG-GCDM HCL Team Cell: +91-80760-53933

[steveward]

@dineshdixitgit it looks like you have http.sslbackend set to openssl, which means GitHub Desktop isn't using the Windows certificate store. Running the command git config --global http.sslBackend schannel should resolve this issue and allow your stored certificate to be picked up. Let me know if that doesn't get things working.

[dineshdixitgit]

Hi Steve,
Both openchannel and schannel gave me errors as below. Please suggest-

$ git config --global http.sslBackend "openssl"
$ git clone https://github.com/wmgdsp/gcdm-api.git gcdm-api-test
Cloning into 'gcdm-api-test'...
fatal: unable to access 'https://github.com/wmgdsp/gcdm-api.git/': SSL certificate problem: unable to get local issuer certificate

$ git config --global http.sslBackend "schannel"
$ git clone https://github.com/wmgdsp/gcdm-api.git gcdm-api-test
Cloning into 'gcdm-api-test'...
fatal: unable to access 'https://github.com/wmgdsp/gcdm-api.git/': schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.

[steveward]

The 'revocation' error is usually caused by your network blocking the attempt by Windows to check the revocation status of a certificate, which then causes the whole operation to error. You can find a workaround for this issue here:

https://github.com/desktop/desktop/blob/development/docs/known-issues.md#certificate-revocation-check-fails---3326

Let me know if that doesn't get things working for you.

[rajivsharma2022]

D:\Rajiv\microservice>git config -l --show-origin
file:"C:\ProgramData/Git/config" core.symlinks=false
file:"C:\ProgramData/Git/config" core.autocrlf=true
file:"C:\ProgramData/Git/config" core.fscache=true
file:"C:\ProgramData/Git/config" color.diff=auto
file:"C:\ProgramData/Git/config" color.status=auto
file:"C:\ProgramData/Git/config" color.branch=auto
file:"C:\ProgramData/Git/config" color.interactive=true
file:"C:\ProgramData/Git/config" help.format=html
file:"C:\ProgramData/Git/config" http.sslcainfo=C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
file:"C:\ProgramData/Git/config" diff.astextplain.textconv=astextplain
file:"C:\ProgramData/Git/config" rebase.autosquash=true
file:"C:\Program Files\Git\mingw64/etc/gitconfig" credential.helper=manager
file:C:/Users/RA346186/.gitconfig user.name=Rajiv
file:C:/Users/RA346186/.gitconfig user.email=rajiv.sharma8@wipro.com

[rajivsharma2022]

I have the above settings and not able to clone too

[steveward]

@rajivsharma2022 are you encountering the unable to get local issuer certificate error? It'd be helpful if you could open a new issue and upload your log file from GitHub Desktop.

[KDS717]

HI @steveward,
I tried : git config --global http.sslBackend schannel
after this I tried cloning, and got this error
fatal: unable to access 'https://github.com/KDS717/Python.git/': schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.

[steveward]

@KDS717 are you running any antivirus software on your system that could be causing this? We've seen specific antivirus software like Kaspersky cause this as well.

You can also skip the revocation check by running this command:

git config --global http.schannelCheckRevoke false

See this section of our known issues doc for reference.

[xavierluz]

I solved the error, follow the link
(https://stackoverflow.com/questions/16668508/how-do-i-configure-git-to-trust-certificates-from-the-windows-certificate-store/48212753#48212753)

[narendermann]

My issues resolved by applying git config --global http.sslBackend schannel

on git bash

[geologyrocks]

@KDS717 are you running any antivirus software on your system that could be causing this? We've seen specific antivirus software like Kaspersky cause this as well.

You can also skip the revocation check by running this command:

git config --global http.schannelCheckRevoke false

See this section of our known issues doc for reference.

This worked for me on my corporate machine - I was cloning from my own GitHub repo. I made sure to revert it to git config --global http.schannelCheckRevoke true once I was done, however :)

Edit: I would instead now recommend adding the -c http.sslVerify=false argument to your git command, e.g. git -c http.sslVerify=false pull or git -c http.sslVerify=false clone <some external Git repo> as the SSL permissions are only overridden temporarily, therefore eliminating the possibility of forgetting to re-enable http.schannelCheckRevoke true.