Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm currently using RedHat Enterprise 6. Git had issues cloning Github repos using HTTPS. After some investigation (e.g. enabling GIT_CURL_VERBOSE and GIT_TRACE) the problem was narrowed to a certificate validation issue, which was solved updating the certificate DB, i.e.:

curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt

Things worked fine for a while. However, after a system upgrade now I'm getting a different error:

Couldn't find host github.com in the .netrc file; using defaults
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.252.128... * Connected to github.com (192.30.252.128) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* NSS error -5978
* Expire cleared

Unfortunately I can't find that error code description on the documentation. It seems that the updated CURL system lib defaults to NSS and relies exclusively on the certificates on /etc/pki/nssdb I've been trying to solve this issue trying different commands to add the certificates to NSS, but failed.

Can you recommend a solution? Is it possible to force Git and/or CURL to use the ca-bundle DB, or even disable certificate validation?

Any solution that could allow Git commands to be run using Github's repos wil be welcome.

Notes:

Curl version curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I believe you can override the .crt file that git uses like this:

$ git config --system http.sslcainfo "/etc/pki/tls/certs/ca-bundle.crt"

You can disable SSL checks all together (not recommended):

$ git config --system http.sslverify false
share|improve this answer
    
Worked as expected, thank you (note: used sslverify=false in my user config file, not the system-wide ) –  Sebastian Jan 6 at 16:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.