1

I'm currently using RedHat Enterprise 6. Git had issues cloning Github repos using HTTPS. After some investigation (e.g. enabling GIT_CURL_VERBOSE and GIT_TRACE) the problem was narrowed to a certificate validation issue, which was solved updating the certificate DB, i.e.:

curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt

Things worked fine for a while. However, after a system upgrade now I'm getting a different error:

Couldn't find host github.com in the .netrc file; using defaults
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.252.128... * Connected to github.com (192.30.252.128) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* NSS error -5978
* Expire cleared

Unfortunately I can't find that error code description on the documentation. It seems that the updated CURL system lib defaults to NSS and relies exclusively on the certificates on /etc/pki/nssdb I've been trying to solve this issue trying different commands to add the certificates to NSS, but failed.

Can you recommend a solution? Is it possible to force Git and/or CURL to use the ca-bundle DB, or even disable certificate validation?

Any solution that could allow Git commands to be run using Github's repos wil be welcome.

Notes:

Curl version curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

1 Answer 1

2

I believe you can override the .crt file that git uses like this:

$ git config --system http.sslcainfo "/etc/pki/tls/certs/ca-bundle.crt"

You can disable SSL checks all together (not recommended):

$ git config --system http.sslverify false
1
  • Worked as expected, thank you (note: used sslverify=false in my user config file, not the system-wide )
    – Sebastian
    Jan 6, 2014 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .