-1

I just upgraded to Git 2.18 via EPEL on CentOS 7 and now Git fails on any operations that involve communicating with a remote server with the message

fatal: unable to access 'https://my.repo.git/': Peer's certificate has an invalid signature.

This happens with git clone, git pull, etc. If I run the same commands using sudo they work fine. This makes me think that maybe bad file permissions are preventing Git from accessing certificates or credentials that it needs. However, I have no idea where and which certs to check. Running Git in verbose mode emits no additional information.

  • IIRC they are in /etc/pki/ca-trust/. There may be a bit of magic (the actual ones are links, or exist only after being extracted from something else). – xenoid Mar 19 at 20:39
0

The main issue was that I have two copies of pkcs11.txt: a local one in ~/.pki/nssdb/ and a system one in /etc/pki/nssdb/. Git prefers the system version over the local user version. For a long time I only had the local version, which has the PKCS info needed to access my repository. At some point, a new package (maybe a Git update) created the system version of the file, which did not have the necessary PKCS info. Hence, Git (via NSS) failed when it started pulling authentication from the system version of pkcs11.txt.

The fix was to merge my local copy into the system-wide copy.

Some things that helped figure this out were setting the following environment variables:

GIT_CURL_VERBOSE=1
GIT_TRACE_VERBOSE=2

and these threads:

https://superuser.com/questions/1091521/centos-7-wont-accept-any-ssl-certificates

https://stackoverflow.com/questions/17064601/curl-not-working-error-77-for-ssl-connections-on-centos-for-non-root-users

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.