1

Recently my workplace has updated the internet usage policies and imposed a Sophos security layer to monitor the traffic.

I am trying to clone a git repo (using git clone command) but getting this following error

fatal: unable to access 'https://github.com/openssl/openssl.git/': SSL certificate problem: self signed certificate in certificate chain

This is "as implied" the Certificate problem. How can I get this working?

UPDATE1: Certificates are correct as they successfully work with browser(firefox) the question is to how to use these certificates to enable git SSL verification.

UPDATE2:

Copied the certificates taken from Firefox (export from Firefox > Preference > Privacy & Security > Certificates > View Certificates) to /etc/ssl/certs.

Executed as root c_rehash /etc/ssl/certs and git config --system http.sslCAPath /etc/ssl/certs.

Produces following response. the cloning starts and dies mid-way

Cloning into 'openssl'...

remote: Enumerating objects: 9, done.

remote: Counting objects: 100% (9/9), done.

remote: Compressing objects: 100% (8/8), done.

fatal: The remote end hung up unexpectedly.89 MiB | 16.11 MiB/s   

fatal: early EOF

fatal: index-pack failed
1

Seems like Sophos security act as MITM so you should disable check of SSL/TLS for this repo. Using the answer from Stackoverflow:

To disable TLS/SSL verification for a single git command try passing -c to git with the proper config variable, or use Flow's answer:

git -c http.sslVerify=false clone https://example.com/path/to/git 

To disable SSL verification for a specific repository If the repository is completely under your control, you can try:

git config http.sslVerify false

The problem is not in to the certificate because this certificate (self-signed) is on your machine (in Sophos security software). You can prove it by stopping Sophos software (if you have permissions) and try again (the same will be with browser)

To install this certificate (if browser accept it) open browser, point it to SSL/TLS site, click on the left site and download the certificate (in PEM format). Then copy the file in /etc/ssl/certs and exec (eventually) c_rehash /etc/ssl/certs

You can try also to exec

git config http.sslCAInfo /etc/ssl/certs/<self-signed certificate>.pem

or

git config --system http.sslCAPath /etc/ssl/certs

to make git to accept this certificate

You can also do some things by hand. Search for config file in .git directory. And add in section [http] those lines:

[http]
sslCAInfo = /etc/ssl/certs/<certificate>.pem
sslCAPath = /etc/ssl/certs/<certificate>.pem
sslCert = /etc/ssl/certs/<certificate>.pem
  • 1
    The answer was most obviously MITM...what I used to say to my trainees, was, more important than using the tools, is knowing what they do. The answer does have the correction, but does not explains very well why it affected the operation and that contrary to the OPs question, there is not really "a certificate" problem per se. +1 – Rui F Ribeiro Jan 28 at 18:22
  • 1
    @RuiFRibeiro, you are correct. But if I explain all, where is the place for OP to think? Nevertheless will add few words about why this is not certificate problem :) – Romeo Ninov Jan 28 at 18:44
  • Hi @RomeoNinov. I have seen this answer and it does work. And I agree that Certificates are not the problem. Though I am looking for an answer how to put the Sophos provided certificates instead of default certificates. I believe the "IT team" of the organisation only knows to fix the browser SSL problem (which they did on my PC). but apart from this no other handshakes are going through. – RC0993 Jan 28 at 19:50
  • @RomeoNinov I have updated the question. – RC0993 Jan 29 at 5:56
  • 1
    AFTER our chat discussion - Observations: the [http] sslCAInfo = /etc/ssl/certs/<certificate>.pem sslCAPath = /etc/ssl/certs/<certificate>.pem sslCert = /etc/ssl/certs/<certificate>.pem doesnot have influence on the working. but before git config --system http.sslCAPath /etc/ssl/certs command , need to run git init once in the folder where you want to clone the repo. – RC0993 Jan 30 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.