Can't connect to github.com with ca-certificates certificate.

[superfury]

Description / Steps to reproduce the issue

When I try to connect to github.com repositories, I get the following (example below during vitasdk installation, which runs through a github repository):

--2025-06-25 19:01:00--  https://github.com/vitasdk/vita-headers/raw/master/.travis.d/last_built_toolchain.py
Loaded CA certificate '/usr/ssl/certs/ca-bundle.crt'
Resolving github.com (github.com)... 140.82.121.4
Connecting to github.com (github.com)|140.82.121.4|:443... connected.
ERROR: The certificate of ‘github.com’ is not trusted.
ERROR: The certificate of ‘github.com’ doesn't have a known issuer.

Apparently this /usr/ssl/certs/ca-bundle.crt file is in the ca-certificates package, from what I can gather from pacman and the ca-certificates (sub)repositories and dependencies. This is preventing me from installing anything from github repositories, much less connect to any of those (probably git etc. as wel, as it's a shared certificate).

This happens when I use the official installation instructions found at vitasdk.org (under Installing). Performed under MSYS2 instead of native linux or WSL of course.

Expected behavior

Connecting to the git repository and being able to pull the files it needs from it.

Actual behavior

ERROR: The certificate of ‘github.com’ is not trusted.
ERROR: The certificate of ‘github.com’ doesn't have a known issuer.

Verification

• I have verified that my MSYS2 is up-to-date before submitting the report (see https://www.msys2.org/docs/updating/)

Windows Version

MINGW64_NT-10.0-19045

Are you willing to submit a PR?

No response

[superfury]

Above was when executing the script called by the main toolchain directly.

This is what I get running the official build step:

sh-5.2$ cd vdpm
sh-5.2$ ./bootstrap-vitasdk.sh
==> Installing vitasdk to /usr/local/vitasdk
--2025-06-26 11:07:30--  https://github.com/vitasdk/vita-headers/raw/master/.travis.d/last_built_toolchain.py
Loaded CA certificate '/usr/ssl/cert.pem'
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
ERROR: The certificate of ‘github.com’ is not trusted.
ERROR: The certificate of ‘github.com’ doesn't have a known issuer.
Prepended http:// to ''
http://: Invalid host name.

bzip2.exe: Compressed file ends unexpectedly;
        perhaps it is corrupted?  *Possible* reason follows.
bzip2.exe: No error
        Input file = (stdin), output file = (stdout)

It is possible that the compressed file(s) have become corrupted.
You can use the -tvv option to test integrity of such files.

You can use the `bzip2recover' program to attempt to recover
data from undamaged sections of corrupted files.

tar: Child returned status 2
tar: Error is not recoverable: exiting now

The file from the ca-certificates package used is different, but the end result is the same: it can't open a secure connection to github.com due to it not being trused or having a known issuer.

[lazka]

It works just fine here, so we need a way to reproduce.

curl -I -L --fail https://www.github.com

[superfury]

Pretty simple actually:

1. Install MSYS2 (Tried in my case with Windows 10 x64 (on build 2009 here). Same observed on Windows 11 (up-to-date)).
2. Update using pacman -Syu until up-to-date (also tried -Syuu , but no effect).
3. Run git clone github.com/vitasdk/vdpm.git
4. cd vdpm
5. ./bootstrap-vitasdk.sh

Or run:

export VITASDK=/usr/local/vitasdk
export PATH=$VITASDK/bin:$PATH
wget https://github.com/vitasdk/vita-headers/raw/master/.travis.d/last_built_toolchain.py | python3 - $@

Replace /usr/local/vitasdk with a path for temporary install. Delete afterwards of course to clean up.
From what I see, wget fails to properly use the certificate given by github.com.

[superfury]

OK. Just verified it.
Running a simple:

wget github.com

Causes the certificate error on the latest certificates installed inside the ca-certificates package.

Running your curl command gives me this:

$ curl -I -L --fail https://www.github.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

[lazka]

/usr/ssl/certs/ca-bundle.crt is created via the update-ca-trust script. You can try running it to see if it helps. Otherwise I don't know why it's not working for you.

Are you in a company environment where IT analyzes your traffic? -> https://www.msys2.org/docs/faq/#how-can-i-make-msys2pacman-trust-my-companys-custom-tls-ca-certificate

[meator]

I am experiencing the same problem. Full reinstall of MSYS2 (done by removing C:\msys64\ and rerunning msys2-x86_64-20250221.exe) did not fix the issue.

I am on a personal network, the FAQ therefore doesn't seem to be relevant.

pacman works as expected. Everything else in MSYS2 is broken.

Native web browser, native utilities (in native Powershell) and WSL2 work as expected.

If requested, I can provide diagnostic output of suggested commands to investigate this issue further.

[meator]

@superfury Do you happen to use Avast antivirus (or some other antivirus)? Avast in particular (and possibly other antiviruses) intercept SSL trafic.

This can be verified by going to https://github.com, opening the certificate viewer and looking at the certificate. The correct certificate (at the time of writing this response) should look like this:

Issued to
    Common Name (CN)          github.com
    Organization (O)          <Not Part Of Certificate>
    Organizational Unit (OU)  <Not Part Of Certificate>
Issued by
    Common Name (CN)          Sectigo ECC Domain Validation Secure Server CA
    Organization (O)          Sectigo Limited
    Organizational Unit (OU)  <Not Part Of Certificate>
...

An Avast intercepted certificate will look like this:

Issued to
    Common Name (CN)          github.com
    Organization (O)          <Not Part Of Certificate>
    Organizational Unit (OU)  <Not Part Of Certificate>
Issued by
    Common Name (CN)          Avast Web/Mail Shield Root
    Organization (O)          Avast Web/Mail Shield
    Organizational Unit (OU)  generated by Avast Antivirus for SSL/TLS scanning
...

If you see the second one, there are two ways of fixing this:

1. Follow https://www.msys2.org/docs/faq/#how-can-i-make-msys2pacman-trust-my-companys-custom-tls-ca-certificate (I plan to make a PR to update the wording of this FAQ entry to take this issue into consideration, the steps itself are correct though)
2. Disable Avast's (or whathever antivirus you're using if it is indeed causing your issues) SSL interception. Avast instructions can be found at https://support.avast.com/en-us/article/use-antivirus-https-scan/#pc

[sskras]

@superfury commented 2 weeks ago:

OK. Just verified it. Running a simple:

wget github.com

Causes the certificate error on the latest certificates installed inside the ca-certificates package.

@meator commented yesterday:

I am experiencing the same problem. Full reinstall of MSYS2 (done by removing C:\msys64\ and rerunning msys2-x86_64-20250221.exe) did not fix the issue.

TLS cert of a web-service could be easily checked using curl:

$ curl -vo /dev/null https://github.com

The full output ...

saukrs@DESKTOP-O7JE7JE MSYS /F
$ curl -vo /dev/null https://github.com
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 140.82.121.3:443...
* Connected to github.com (140.82.121.3) port 443
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
*  CAfile: /usr/ssl/certs/ca-bundle.crt
*  CApath: none
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [3135 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [79 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [36 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [36 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=github.com
*  start date: Feb  5 00:00:00 2025 GMT
*  expire date: Feb  5 23:59:59 2026 GMT
*  subjectAltName: host "github.com" matched cert's "github.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo ECC Domain Validation Secure Server CA
*  SSL certificate verify ok.
} [5 bytes data]
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://github.com/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: github.com]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.3.0]
* [HTTP/2] [1] [accept: */*]
} [5 bytes data]
> GET / HTTP/2
> Host: github.com
> User-Agent: curl/8.3.0
> Accept: */*
>
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
< HTTP/2 200
< date: Sat, 12 Jul 2025 16:21:25 GMT
< content-type: text/html; charset=utf-8
< vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, Accept-Language,Accept-Encoding, Accept, X-Requested-With
< content-language: en-US
< etag: W/"65c546baff0896fa2d73522e5fce2d23"
< cache-control: max-age=0, private, must-revalidate
< strict-transport-security: max-age=31536000; includeSubdomains; preload
< x-frame-options: deny
< x-content-type-options: nosniff
< x-xss-protection: 0
< referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
< content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com github.githubassets.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
< server: github.com
< accept-ranges: bytes
< set-cookie: _gh_sess=pxeMGAMwy7aR51FlvZB1Ngz7OdnXNTYPyt%2FBiMnczqC9dad6ueJYkXcUsCORGoEKztjnEQwIg5f0mMbk02dDCl007l6%2FXMoNtG08VYcirYHTjuba2N7huN3STs%2FXfnPi3FL%2Fo5Y2syeRemejrzibwieDPVjGMq0pknuzRDEQajroYwG797hpWBbg6lmjErdqlcCXHEr57pkB%2BWYTZxxFtcrmab%2FwfZYKK6PokKmXetG4O3ucy01BrD3bMbtoI7dS%2FmV%2Fv9xcOzn%2Bz2ZZoIxC3A%3D%3D--Nt14QLRB0cfvkQsD--FfQTjVziv1h4G%2Fj%2FkIBdoQ%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
< set-cookie: _octo=GH1.1.204893469.1752337293; Path=/; Domain=github.com; Expires=Sun, 12 Jul 2026 16:21:33 GMT; Secure; SameSite=Lax
< set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Sun, 12 Jul 2026 16:21:33 GMT; HttpOnly; Secure; SameSite=Lax
< x-github-request-id: 61D0:FEEA9:276EF6B:28CAE8C:68728B8D
<
{ [4101 bytes data]
100  280k    0  280k    0     0   626k      0 --:--:-- --:--:-- --:--:--  626k
* Connection #0 to host github.com left intact

Here is the relevant part:

* Server certificate:
*  subject: CN=github.com
*  start date: Feb  5 00:00:00 2025 GMT
*  expire date: Feb  5 23:59:59 2026 GMT
*  subjectAltName: host "github.com" matched cert's "github.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo ECC Domain Validation Secure Server CA
*  SSL certificate verify ok.

@superfury, in your case it probably will be different, and might indicate who stands in the middle between your MSYS2 and the GitHub web-service.

[superfury]

Ran that curl command and got this:

$ curl -vo /dev/null https://github.com
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Host github.com:443
was resolved.
* IPv6: (none)
* IPv4: 140.82.121.4
*   Trying 140.82.121.4:443...
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1563 bytes data]
*  CAfile: C:/msys64/mingw64/etc/ssl/certs/ca-bundle.crt
*  CApath: none
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [1210 bytes data]
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [15 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [786 bytes data]
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
} [2 bytes data]
* SSL certificate problem: unable to get local issuer certificate
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* closing connection #0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

Temporarily disabled Antivirus too, but it stayed the same.

[meator]

Try specifying the -v flag twice.

[superfury]

Tried with -v -vo and with -vo -v, still the same output.

[meator]

Add in --insecure to let curl resolve the certificates even when curl doesn't trust them. The second -v is likely not necessary.