How to Fix Git SSL Certificate Problem [7 Tested Solutions]

If you just received an SSL error while running a git clone or pushing code to a remote repository, you’re not alone. The git ssl certificate problem is very common for developers working with remote servers.

But… the good thing is that these errors are very easy to fix, once you figure out what is actually broken.

In this guide, I’ll walk you through some simple steps to get rid of this error. And in case you’re considering hosting your web apps on Cloudways, I’ll tell you how it prevents these issues from occurring in the first place.

Let’s get started.

What Are Git SSL Certificate Issues?

When you connect to a remote repository on GitHub or GitLab, Git uses what’s called SSL/TLS certificates to keep the connection encrypted. It does this to ensure only an authorized user is communicating with the server to keep your code safe.

But sometimes, this security mechanism fails. And when something breaks the chain, Git simply breaks the connection to protect your data. Now, this can happen due to things like expired or self-signed certificates and a few other reasons which I’ll get into in the next section.

Anyway, when this happens, your terminal will throw an error, like the ones mentioned below:

• fatal: unable to access: SSL certificate problem: unable to get local issuer certificate
• fatal: unable to access: SSL certificate problem: self-signed certificate
• fatal: unable to access: SSL certificate problem: certificate has expired

Next, I’ll walk you through the exact troubleshooting steps to help you fix the Git SSL Certificate issue.

How to Fix the Git SSL Certificate Problem

There are a few common culprits behind this error. Most of the time, the issue is related to an outdated certificate store on your local computer.

Other times, it might be due to a strict corporate firewall that’s filtering your web traffic. It could also be due to a simple typo in your remote URL. Or maybe you’re using a self-signed certificate on a private server.

Whatever the root cause may be, go through the list of solutions below and you should be able to resolve the error. I’ll walk you through the easiest fixes first and then move on to more advanced fixes.

Step 1: Verify the Remote URL Syntax

Before you start changing any system settings on your computer, check for any rookie mistakes. By that I mean check the URL of the repository you’re typing.

If there is a typo in your repository’s web address, Git will fail to connect. To verify, open terminal and run this command to see where your local repository is trying to push and pull data from:

git remote -v

Look at the output and check for a typo in the domain name. Maybe a colon is missing or there’s an extra slash. If you spot a mistake, update the link using this command:

git remote set-url origin <correct-repo-url>

Make sure your target address is correct.

If the error is still there even after verifying or updating the address, this means the syntax is fine and we’d need to look at the network or system settings next.

Step 2: Switch from HTTPS to SSH

If you are on a work laptop like I am, and can’t change your system settings due to restrictions, an easy way to bypass the git clone ssl certificate problem is to stop using HTTPS and instead switch to SSH.

When you use SSH, Git doesn’t need to rely on web certificates. It uses a different secure protocol to authenticate your connection. After making the switch, the SSL error should go away.

To do this, you’ll need to change your remote repository URL. Go to your GitHub or GitLab repository page and click the green “Code” button. Then click on the SSH tab and copy the link. It should look something like this: [email protected]:username/repo.git.

Then, go back to your terminal and run this command to update your link:

git remote set-url origin [email protected]:username/repo.git

Now try to push or pull your code again.

If you don’t have an SSH key set up on your machine yet, you will need to generate one and add it to your GitHub account first. But once that is done, you won’t have to worry about a Git SSL certificate problem again.

We have a guide on how to generate SSH keys and use Git via command line on Cloudways that you’d find useful here.

Step 3: Check Your Antivirus or Corporate VPN

Sometimes, the issue might not be due to Git or your operating system at all. Instead, the culprit could be your security software.

If you’re using a work laptop like I am , your company might be routing all your traffic through a corporate VPN or a firewall. The way these security tools work is by inspecting your web traffic, intercepting it, decrypting it, and then re-encrypting it with their own corporate certificate.

Now the problem with this is that Git doesn’t trust corporate certificates. It sees the interception and triggers the SSL certificate problem we’ve been talking about.

The same thing happens with aggressive antivirus programs. These tools often use a “Web Shield” feature that scans your HTTPS traffic and accidentally breaks the Git connection.

To fix this issue, try temporarily pausing your antivirus Web Shield. Or, if you are on a company VPN, disconnect from it and run your Git command again.

If the command works, you know exactly what is blocking your connection. For a permanent fix, you’ll likely need to ask your IT department to add GitHub or GitLab to their bypass list so your terminal can connect freely.

Step 4: Update Your System’s CA Certificates

If your network is fine but you are still coming across the unable to get local issuer certificate git error, the issue might be due to an outdated Certificate Authority (CA) bundle on your local machine.

Git uses this bundle to verify external SSL certificates. In case your local bundle is outdated, it will fail to validate modern web certificates.

The way you fix this error depends entirely on which operating system you’re running.

For Windows Users

By default, Git for Windows uses its own bundled certificate file. So, rather than manually downloading and then configuring a newer certificate bundle, the easiest fix is to have Git use the Windows Certificate Store instead.

Windows keeps its own certificates up to date automatically, so switching Git to the Windows Certificate Store solves the problem easily.

To do this, open your terminal and run this command:

git config --global http.sslBackend schannel

Once you have run this, go ahead and close your current terminal window. Open a new terminal, and try your Git command again. Hopefully, this time you won’t run into the error.

For Linux Users

If you are running an older version of Linux, you can manually update your system’s CA certificate package using your distribution’s package manager.

So for Ubuntu or Debian, you can run these commands:

sudo apt-get update
sudo apt-get install --only-upgrade ca-certificates

For CentOS, RHEL, or Fedora, you can run these commands:

sudo yum update ca-certificates

Git will start using your updated package. To check, if this resolved the issues, go ahead and run the Git clone or push commands that failed earlier.

For macOS Users

Mac users can resolve this by updating the central certificate store managed by Homebrew. You can refresh and rebuild your local CA certificates by running the command below in your terminal:

brew postinstall ca-certificates

After Homebrew finishes rebuilding your certificate paths, run your original Git command again to confirm the connection is secure.

Step 5: Manually Trust Self-Signed Certificates

If you are working with a private server like an on-premises GitLab instance hosted by your company, the server might be using a self-signed SSL certificate.

Since a self-signed certificate isn’t issued by any official authority, Git would block the connection and show you the SSL certificate problem: self-signed certificate error.

The simple way to fix this is to tell your local Git client to explicitly trust self-signed certificates.

To do this, first, download your server’s root certificate file from your hosting provider or internal server settings. These files usually have .crt or .pem extensions.

Once you have that file saved, you tell Git where to find it on your computer by running this command in your terminal:

git config --global http.sslCAInfo "C:/path/to/your/custom-certificate.crt"

Git will now use your self-signed certificate alongside the default ones, without throwing an error.

After making the changes, run your Git command, and the self-signed error should be gone now.

Step 6: Temporarily Disable SSL Verification inside the Local Repo

Sometimes you feel tempted to force Git to ignore the certificate problem. But before you run the global command that you may have seen on forums, let me tell you about the risks.

This is the command I’m talking about: git config –global http.sslVerify false.

This command disables SSL verification globally. And when you do this, you’re basically telling Git to stop checking who it’s communicating to for every project on your machine.

If you absolutely need to pull or clone a repository without getting stuck with the error, you can use a safer alternative. Instead of turning off security for your whole computer, you can disable it for just one single command using an inline flag:

git -c http.sslVerify=false clone <correct-repo-url>

Doing this keeps the security risk completely isolated to that specific clone command.

Alternatively, if you already have your repo on your machine and only want to disable verification for one specific project folder, you can go to your project directory and run this command:

git config http.sslVerify false

Step 7: Fix an Outdated System Clock

Sometimes, the issue might not be due to the certificates or your network at all. Instead, it could be due to your computer’s internal clock.

SSL certificates have a start and expiration date. If your local system clock is out by even a few minutes, Git might think your valid certificate is either expired or hasn’t been activated yet. This will result in triggering the SSL error.

The fix for this is simple and involves forcing your operating system to resync its time with global time servers.

For Windows Users

Right-click the time display in your bottom taskbar and select “Adjust date/time“.

In the settings window, scroll down and click the “Sync now” button.

For Linux Users

If you look at older tutorials, they’ll tell you to use the ntpdate utility. But this tool has been deprecated on modern Linux distributions. So, you should use the built-in timedatectl command to enable automatic time synchronization.

Open your terminal and run this command:

sudo timedatectl set-ntp true

For macOS Users

On a mac, open your System Settings, click “General“, then “Date & Time“. Toggle the “Set time and date automatically” switch off and then turn it back on to do a force sync.

Once your clock is showing the correct time, go ahead and try running your Git command one more time.

How Cloudways Prevents the Git SSL Certificate Problem

If you manually manage your servers, maintaining SSL certificates can become too much work too quickly when you constantly have to track renewal timelines and manually configure server handshakes.

But if you host your applications on Cloudways, a lot of the server management and SSL configuration is handled for you. This reduces the chances of running into these Git certificate issues in the first place.

Here is how:.

Automated Let’s Encrypt Integration

Cloudways comes with built-in SSL management, which makes it easy to install free SSL certificates from Let’s Encrypt in just a few clicks. It also takes care of certificate renewals automatically.

This means your remote server certificates won’t expire on you unexpectedly and break your Git connections.

Pre-Configured Git Environments

Our servers come ready for standard development workflows, with Git already installed and configured to work with standard certificate authorities. As a result, most common Git operations work without requiring additional certificate configuration or manual trust-store updates.

Simple SSH Key Management

Instead of dealing with complex server-side firewall rules that can sometimes block HTTPS traffic, Cloudways makes this easy and you can just use SSH instead. You can generate and add your SSH keys directly through the platform dashboard.

This makes it simpler to adopt the SSH cloning method I talked about in Step 2, completely avoiding web certificate issues.

Basically, by keeping the server-side infrastructure updated and properly configured, Cloudways makes sure your remote environment is always ready to talk to Git without encountering a terminal error.

Wrapping Up!

Speaking from experience, the Git SSL certificate problem can disrupt any developer’s workflow. But as I showed you in this guide, it’s not too difficult to fix this issue. You just need to figure out where the secure connection is failing.

Most of the time, the cause of the error is on your local machine. Things like an outdated certificate store, a strict firewall, or incorrect system time settings are some of the things to check.

If you want to avoid manual server-side certificate management entirely, hosting your applications on Cloudways simplifies the process. By automating SSL deployments and providing pre-configured environments, you won’t have to worry about troubleshooting terminal errors.

If I’ve missed anything or you need help with something specific, let me know in the comments.

Abdul Rehman

Abdul is a tech-savvy, coffee-fueled, and creatively driven marketer who loves keeping up with the latest software updates and tech gadgets. He's also a skilled technical writer who can explain complex concepts simply for a broad audience. Abdul enjoys sharing his knowledge of the Cloud industry through user manuals, documentation, and blog posts.

Get Connected on: Twitter Community Forum