Why is git not trusting a trusted cert?

Question

My git server is Gitlab and it's locally (private) hosted and it has a trusted cert from comodo that browsers trust without issue.

If I'm in a situation that I need to use HTTPS instead of SSH (From an Ubuntu 16 box in this case), then I always have to bypass SSL verification by using http.sslVerify=false on my git commands.

If I don't disable the verification, then I get:

fatal: unable to access 'https://gitlab.mysite.cloud/myrepo/somerepo.git/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

I feel like I've pulled down from other git servers using HTTPS without having to do anything special so I'm not sure what's up in this case.

From my workstation, I use SSH so I never run into this, but I just tested HTTPS from my Mac workstation and I get the same message.

Does anyone know why git is not trusting my trusted cert?

Answer 1

I needed to inject my intermediary certs. I used https://certificatechain.io/ to easily perform this.

It can also be done manually by concatenating the certs together to form the chain, but the above tool does it quick and easy.

After the chain was installed as the new cert, it's showing as fully trusted.

Answer 2

To check if at least the clone works without checking said certificate, you can set:

export GIT_SSL_NO_VERIFY=1
#or
git config --global http.sslverify false