0

After the upgrade to Fedora 27, I can't clone urls using https anymore, ssh works fine. The error is:

fatal: unable to access 'https://repo-url': SSL certificate problem: unable to get local issuer certificate

I didn't change anything and my /etc/pki directory is almost the same like the one of a friend who's still using F26.

I already tried:

  • reinstalling git (2.14.3-2.fc27)
  • reinstalling ca-certificates (2017.2.16-4.fc27)
  • setting the git option sslCaInfo to /etc/pki/tls/cert.pem

Any other ideas?

  • Can you tell us the actual url instead of repo-url? – dr01 Dec 1 '17 at 12:42
  • Does curl https://repo-url work fine? Also can you provide git config --list? – Patrick Dec 1 '17 at 13:36
  • A shot in the dark: Are the system date and time correct? – Richard Neumann Dec 1 '17 at 13:47
  • Check with a browser the repo-url URL. From the error, it seems that the repo server is miss-configured. (no certificate) – Giacomo Catenazzi Dec 1 '17 at 13:54
  • repo-url is for example any github https url, in the current case: github.com/cppit/jucipp.git - curl and browser work fine with it and system date and time are also correct. – Marius Melzer Dec 1 '17 at 15:45
1

Here are my ideas (I'd suggest to try again after each step so you can stop when your problem is fixed):

  1. Reinstall git-core (because it contains the relevant component: /usr/libexec/git-core/git-remote-https. I used strace and dnf provides to find that out)
  2. Reinstall ca-certificates (Should be Version 2017.2.16)
  3. Go to /etc/pki/ca-trust/extracted/pem and rename the file tls-ca-bundle.pem. (Warning: This will temporarily break most of your SSL stuff, do remember to rename it back to the original name later.) Does the output of your git clone change? For me it reads: fatal: unable to access 'https://github.com/some_git': error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none
  4. Find all packages which git depends on with sudo dnf repoquery --requires --resolve git (this may take some time) and reinstall them.
  • 2
    Thanks! Actually none of the steps helped directly, but I followed your example stracing the git clone and found out that git (installed via the normal fedora repo) used the git-remote-https file installed via the nix package manager that I had on my system but never really used. Removed nix now and it works! :-) – Marius Melzer Dec 8 '17 at 12:21
-1

The error come from the other end (the repo-url). You doesn't need any certificate on your side.

The repo webserver is miss-configured (often wrong order in chain certificates, or just wrong type). It try to get own certificate, in order to initialize the SSL connection, but it fail, and give back such error. The git just write out the error from server, so the confusing *local" is not from your point of view.

  • It's a github-url and it works in curl and browser, just not with git, so I think the problem lies at least somewhere on my machine – Marius Melzer Dec 1 '17 at 15:47
  • This is incorrect. The client needs the trusted CA certs to validate the authenticity of the server cert. This is why the message is "local issuer certificate". – Patrick Dec 1 '17 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.