Add documentation for adding trusted root certs

[rcdailey]

Need documentation on recommended method to add trusted certificates to MINGW with regards to Git accessing HTTPS repositories.

[rcdailey]

Any reason why Git for Windows doesn't use the root certificate store in Windows? Maybe that's a solution. Not sure if Git on linux does this, but it just seems unnecessary to me that even though the system has its own cert store, that we can't share that.

This might be specific to MINGW, so I will look more into this.

[calle2010]

@rcdailey Do you know about git config http.sslCAInfo? Beside Git documentation there are plenty of guides on the Internet.

From my point of view the benefits are:

• works the same on any OS (Linux, BSD, Windows, ...)
• allows per repository trust if required
• no need to add trust to complete system if only needed for a single repository

[rcdailey]

When I used http.sslCAInfo, it was able to find my self-signed cert but it was no longer able to find the default, pre-packaged trusted root certificates that were inside of the Git install dir.

This is why I do not use that method.

[dscho]

Why not just imitate https://github.com/git-for-windows/MINGW-packages/blob/master/mingw-w64-ca-certificates/ca-certificates-x86_64.install and simply drop your self-signed certificate into the appropriate directory and then update the ca-trust bundle?

[calle2010]

What @dscho proposes is probably the right thing to do. I made my life easier by just getting one of the converted bundles from Mozilla (see http://curl.haxx.se/docs/caextract.html) and appended the missing certificate to this.

Another alternative, if just one repository is using only one https remote with the self-signed certificate: Put that certificate into the repository's configuration only (git config --local). This way it does not affect other clones.

Coming back to the original question: From my point of view everything is documented already. For most users the issue will be to understand the problem in the first place and to get the right certificates.

[dscho]

From my point of view everything is documented already. For most users the issue will be to understand the problem in the first place and to get the right certificates.

I agree and therefore close this ticket.

[rcdailey]

In hindsight the solution ended up being specific to git configuration, which I prefer anyhow. I like the bundled cert approach, it's very simple. Thanks for the help guys.

[sumitag]

@dscho I am trying to add a custom cert by running update-ca-trust and get the following error:

/mingw64/bin/update-ca-trust: line 14: /mingw64/bin/p11-kit: No such file or directory
/mingw64/bin/update-ca-trust: line 15: /mingw64/bin/p11-kit: No such file or directory
/mingw64/bin/update-ca-trust: line 16: /mingw64/bin/p11-kit: No such file or directory
/mingw64/bin/update-ca-trust: line 17: /mingw64/bin/p11-kit: No such file or directory
/mingw64/bin/update-ca-trust: line 18: /mingw64/bin/p11-kit: No such file or directory
--

Any thoughts? Should I raise a new issue?

[dscho]

/mingw64/bin/update-ca-trust: line 14: /mingw64/bin/p11-kit: No such file or directory

I guess this means that that directory does not exist, which is most likely due to Git for Windows not shipping it ;-)

Any thoughts?

Sorry, no idea. I do not even know how common it would be, nor what price we would pay for supporting this in Git for Windows.