Fix: server certificate verification failed in Git

✨ Quick Answer

The error fatal: unable to access 'https://github.com/...': server certificate verification failed. CAfile: none CRLfile: none occurs when the local Git client cannot validate the remote SSL/TLS certificate chain against its local trusted Certificate Authority bundle.

Quick Diagnostics

Cause

Outdated Certificate Authority (CA) root store on the host operating system

Solution

Update ca-certificates package on Linux via sudo update-ca-certificates

Cause

Enterprise proxy SSL inspection or untrusted internal CA certificate bundle

Solution

Register certificate bundle with git config --global http.sslCAInfo /path/ca.crt

The error fatal: unable to access 'https://github.com/...': server certificate verification failed. CAfile: none CRLfile: none occurs when the local Git client cannot validate the remote SSL/TLS certificate chain against its local trusted Certificate Authority bundle.

Step-by-Step Solution

1. 1

   Step 1: Update Operating System Root Certificates

   Expired intermediate or root certificates trigger validation rejections across network endpoints:

   BASH Copy

   # On Debian / Ubuntu:
   sudo apt-get update
   sudo apt-get install --reinstall ca-certificates -y
   sudo update-ca-certificates
   
   # On Arch Linux / CachyOS:
   sudo pacman -Sy ca-certificates --noconfirm
   
   # On RHEL / Fedora / Rocky Linux:
   sudo dnf reinstall ca-certificates -y
   sudo update-ca-trust
   

2. 2

   Step 2: Declare Explicit CA Bundle in Git Config

   If operating behind a corporate intercepting firewall:

   BASH Copy

   # Define global CA certificate path in Linux:
   git config --global http.sslCAInfo /etc/ssl/certs/ca-certificates.crt
   
   # In Windows Git Bash:
   git config --global http.sslCAInfo "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt"
   

3. 3

   Step 3: Synchronize System Clock with NTP

   Clock skew invalidates valid certificates:

   BASH Copy

   # Enforce system time synchronization on Linux
   sudo timedatectl set-ntp true
   timedatectl status
   

4. 4

   Step 4: Configure Windows Native Certificate Backend (Schannel)

   On Windows workstations, instruct Git to leverage the native Windows Certificate Manager:

   BASH Copy

   git config --global http.sslBackend schannel
   

❓ Frequently Asked Questions (FAQ)

How do I bypass sslVerify for a single emergency command?

Pass the configuration inline without mutating global defaults: git -c http.sslVerify=false clone https://....

Why does GitHub load in Chrome but fail in Git CLI?

Web browsers leverage the operating system native certificate store, while Git CLI may depend on a distinct OpenSSL bundle.