fatal: unable to access '...': SSL certificate problem: unable to get local issuer certificate
Git can't verify the server's certificate
Seen in git over HTTPS (clone, fetch, pull, push), Git for Windows, CI runners
Git's HTTPS client could not build a trusted chain for the remote server's certificate, so it refused to connect.
Common causes
- A corporate proxy or antivirus re-signs HTTPS traffic with a CA that git does not trust.
- A self-hosted Git server (GitLab, Gitea, Bitbucket) is missing its intermediate certificate or uses a private CA.
- The CA bundle git uses is old, or Git for Windows is using its own bundle instead of the Windows store.
How to fix it
- Point git at your CA: git config --global http.sslCAInfo /path/to/corp-ca.pem (or http.<url>.sslCAInfo for one server).
- On Windows, use the system certificate store: git config --global http.sslBackend schannel.
- For a self-hosted server, install the full chain (fullchain.pem) on it.
- Setting http.sslVerify false or GIT_SSL_NO_VERIFY only hides the problem; it is not a fix.
Got a different message? Paste it into the error explainer.
Related errors
- npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY · npm can't verify the registry's certificate
- npm ERR! code SELF_SIGNED_CERT_IN_CHAIN · npm sees an untrusted root certificate
- Error response from daemon: Get "https://registry.example.com/v2/": x509: certificate signed by unknown authority · Docker doesn't trust the registry's certificate
- fatal: unable to access '...': Could not resolve host: github.com · Git can't resolve the remote's hostname
- error: RPC failed; HTTP 413 curl 22 The requested URL returned error: 413 · The push is larger than the server or proxy accepts
- error: RPC failed; curl 18 transfer closed with outstanding read data remaining · The connection dropped during a git transfer
- fatal: the remote end hung up unexpectedly · The Git server closed the connection
- kex_exchange_identification: Connection closed by remote host · The SSH server closed the connection before the handshake
- Permission denied (publickey) · The server rejected every SSH key you offered
- Host key verification failed. · SSH couldn't confirm the server's identity
- WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! · The server's SSH host key is different from last time
- Unable to negotiate with 203.0.113.10 port 22: no matching host key type found. Their offer: ssh-rsa · The server only offers an old host key type