How to fix fatal: unable to access: error setting certificate verify locations in CI in Git

GitINTERMEDIATEHIGH

The 'fatal: unable to access: error setting certificate verify locations' error occurs when Git cannot find or access SSL/TLS certificate authority (CA) files during HTTPS operations. This commonly affects CI/CD pipelines, Docker containers, and minimal Linux distributions where certificate bundles are missing or incorrectly configured.

What this error means

The "fatal: unable to access" error with "error setting certificate verify locations" indicates that Git's underlying SSL/TLS library (typically OpenSSL or LibreSSL) cannot locate the certificate authority (CA) bundle needed to verify HTTPS connections. Without these certificates, Git cannot establish secure connections to remote repositories. This error is particularly common in CI/CD environments because: - CI runners often use minimal Docker images that lack pre-installed CA certificates - Custom build environments may not include standard certificate paths - Self-signed or enterprise certificates require additional configuration - Some container images override default certificate locations The SSL certificate verification system relies on a bundle of trusted root CA certificates stored on the system. When Git (via libcurl and OpenSSL) cannot find this bundle at expected paths like `/etc/ssl/certs/ca-certificates.crt` or `/etc/pki/tls/certs/ca-bundle.crt`, it fails with this error rather than proceeding with an insecure connection.

How to fix "fatal: unable to access: error setting certificate verify locations in CI"

1Install CA certificates package in your CI environment

The most common fix is to install the CA certificates package in your Docker image or CI environment:

For Debian/Ubuntu-based images:

dockerfile

FROM ubuntu:22.04
RUN apt-get update && apt-get install -y ca-certificates git && rm -rf /var/lib/apt/lists/*

For Alpine Linux:

dockerfile

FROM alpine:3.18
RUN apk add --no-cache ca-certificates git

For RHEL/CentOS/Fedora:

dockerfile

FROM fedora:38
RUN dnf install -y ca-certificates git

In GitLab CI (before_script):

yaml

before_script:
  - apt-get update && apt-get install -y ca-certificates
  # Or for Alpine runners:
  - apk add --no-cache ca-certificates

2Set correct certificate paths with environment variables

If certificates are installed but Git cannot find them, set the path explicitly:

bash

# Find where certificates are installed
find /etc -name "*.crt" -o -name "*.pem" 2>/dev/null | head -20

# Common locations:
# - /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu)
# - /etc/pki/tls/certs/ca-bundle.crt (RHEL/CentOS)
# - /etc/ssl/cert.pem (Alpine/macOS)
# - /etc/ssl/certs/ca-bundle.crt (OpenSUSE)

Set Git to use the correct path:

bash

# Using environment variable (recommended)
export GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt

# Or configure Git directly
git config --global http.sslCAInfo /etc/ssl/certs/ca-certificates.crt

# For custom CA path directory
export GIT_SSL_CAPATH=/etc/ssl/certs/
git config --global http.sslCAPath /etc/ssl/certs/

In GitLab CI:

yaml

variables:
  GIT_SSL_CAINFO: /etc/ssl/certs/ca-certificates.crt

# Or per-job
job_name:
  variables:
    GIT_SSL_CAINFO: /etc/ssl/certs/ca-certificates.crt

In GitHub Actions:

yaml

env:
  GIT_SSL_CAINFO: /etc/ssl/certs/ca-certificates.crt

3Update certificate store for Alpine and minimal images

Alpine and other minimal images require additional steps to set up certificates properly:

Alpine Linux:

dockerfile

FROM alpine:3.18

# Install certificates and update the certificate store
RUN apk add --no-cache ca-certificates \
    && update-ca-certificates

# Set environment variable for OpenSSL
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_DIR=/etc/ssl/certs

For multi-stage builds, copy certificates:

dockerfile

FROM golang:alpine AS builder
RUN apk add --no-cache git ca-certificates
# ... build steps ...

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
# ... rest of minimal image ...

Distroless images:

dockerfile

FROM gcr.io/distroless/static-debian11
# Distroless includes CA certificates by default
# But if you need custom certs, use a multi-stage build

4Add enterprise or self-signed certificates

If your organization uses internal CA or self-signed certificates:

Add certificate to system trust store:

bash

# Debian/Ubuntu
sudo cp my-enterprise-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# RHEL/CentOS
sudo cp my-enterprise-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# Alpine
sudo cp my-enterprise-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

In Dockerfile:

dockerfile

FROM ubuntu:22.04
COPY my-enterprise-ca.crt /usr/local/share/ca-certificates/
RUN apt-get update \
    && apt-get install -y ca-certificates \
    && update-ca-certificates \
    && rm -rf /var/lib/apt/lists/*

In GitLab CI:

yaml

before_script:
  - echo "$CUSTOM_CA_CERT" > /usr/local/share/ca-certificates/custom-ca.crt
  - update-ca-certificates

Point Git to specific certificate:

bash

git config --global http."https://gitlab.mycompany.com/".sslCAInfo /path/to/custom-ca.crt

5Fix GitLab Runner certificate issues

GitLab Runner may need specific configuration for certificate handling:

Using GitLab Runner's built-in certificate handling:

toml

# /etc/gitlab-runner/config.toml
[[runners]]
  name = "my-runner"
  url = "https://gitlab.example.com/"
  tls-ca-file = "/etc/gitlab-runner/certs/ca.crt"

  [runners.docker]
    volumes = ["/etc/ssl/certs:/etc/ssl/certs:ro"]

Mount certificates into Docker executor:

toml

[[runners]]
  [runners.docker]
    volumes = [
      "/etc/ssl/certs:/etc/ssl/certs:ro",
      "/etc/pki:/etc/pki:ro"
    ]

GitLab CI configuration for certificate issues:

yaml

variables:
  # Disable certificate verification (NOT recommended for production)
  # GIT_SSL_NO_VERIFY: "true"

  # Use custom certificate
  GIT_SSL_CAINFO: /etc/gitlab-runner/certs/ca.crt

# Or use FF_NETWORK_PER_BUILD for network isolation
variables:
  FF_NETWORK_PER_BUILD: "true"

For Kubernetes executor:

yaml

# values.yaml for GitLab Runner Helm chart
certsSecretName: gitlab-runner-certs

6Handle proxy-related certificate issues

Corporate proxies often intercept HTTPS traffic, requiring their CA certificate:

Identify if proxy is the issue:

bash

# Check if proxy is set
echo $HTTP_PROXY $HTTPS_PROXY

# Test direct connection
curl -v https://github.com 2>&1 | grep -i certificate

# Test with proxy certificate
curl --cacert /path/to/proxy-ca.crt https://github.com

Configure Git for proxy with certificate:

bash

# Set proxy
git config --global http.proxy http://proxy.company.com:8080

# Add proxy's CA certificate
git config --global http.sslCAInfo /path/to/proxy-ca-bundle.crt

# Or add proxy CA to system bundle
cat proxy-ca.crt >> /etc/ssl/certs/ca-certificates.crt

In CI environment:

yaml

variables:
  HTTP_PROXY: http://proxy.company.com:8080
  HTTPS_PROXY: http://proxy.company.com:8080
  NO_PROXY: localhost,127.0.0.1,.company.com
  GIT_SSL_CAINFO: /etc/ssl/certs/ca-bundle-with-proxy.crt

7Debug certificate verification issues

To diagnose the exact cause of certificate failures:

bash

# Verbose Git output
GIT_CURL_VERBOSE=1 git clone https://github.com/user/repo.git 2>&1

# Check OpenSSL configuration
openssl version -d

# Test SSL connection directly
openssl s_client -connect github.com:443 -CApath /etc/ssl/certs

# Verify certificate chain
openssl s_client -connect github.com:443 -showcerts

# Check which CA bundle is being used
curl -v https://github.com 2>&1 | grep CAfile

# List certificates in bundle
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | \
  openssl pkcs7 -print_certs -noout | grep subject

Check file permissions:

bash

ls -la /etc/ssl/certs/ca-certificates.crt
# Should be readable: -rw-r--r--

# Fix permissions if needed
chmod 644 /etc/ssl/certs/ca-certificates.crt

Verify Git SSL configuration:

bash

git config --list | grep -i ssl
# Should show sslCAInfo and/or sslCAPath if configured

8Temporary workaround: disable SSL verification (not recommended)

WARNING: Disabling SSL verification removes protection against man-in-the-middle attacks. Only use this for debugging or in isolated, trusted environments.

bash

# For a single command
GIT_SSL_NO_VERIFY=1 git clone https://github.com/user/repo.git

# Global configuration (avoid in production)
git config --global http.sslVerify false

# Per-repository
git config http.sslVerify false

# For specific host only
git config --global http."https://trusted-internal-server.com/".sslVerify false

In CI (temporary debugging only):

yaml

variables:
  GIT_SSL_NO_VERIFY: "true"  # REMOVE after debugging!

Better alternative - trust specific certificate:

bash

# Instead of disabling verification, add the specific certificate
git config --global http."https://gitlab.internal/".sslCAInfo /path/to/internal-ca.crt

Always revert this workaround after identifying the root cause and implementing a proper certificate solution.

Advanced notes

### Understanding Certificate Verification in Git

Git uses libcurl for HTTPS operations, which relies on OpenSSL (or other SSL libraries) for certificate verification. The verification process:

1. Git connects to the remote server over HTTPS
2. Server presents its SSL certificate
3. OpenSSL checks if a trusted CA signed the certificate
4. OpenSSL searches for CA certificates in configured paths
5. If CA bundle is missing or inaccessible, the "error setting certificate verify locations" occurs

### Default Certificate Paths by Distribution

| Distribution | CA Bundle Path | CA Directory |
|--------------|----------------|--------------|
| Debian/Ubuntu | /etc/ssl/certs/ca-certificates.crt | /etc/ssl/certs/ |
| RHEL/CentOS | /etc/pki/tls/certs/ca-bundle.crt | /etc/pki/tls/certs/ |
| Fedora | /etc/pki/tls/certs/ca-bundle.crt | /etc/pki/tls/certs/ |
| Alpine | /etc/ssl/cert.pem | /etc/ssl/certs/ |
| OpenSUSE | /etc/ssl/ca-bundle.pem | /etc/ssl/certs/ |
| macOS | /etc/ssl/cert.pem | System Keychain |

### Environment Variables Reference

| Variable | Purpose |
|----------|---------|
| GIT_SSL_CAINFO | Path to CA bundle file |
| GIT_SSL_CAPATH | Path to directory with individual CA certs |
| GIT_SSL_NO_VERIFY | Disable verification (dangerous) |
| SSL_CERT_FILE | OpenSSL CA bundle (affects curl too) |
| SSL_CERT_DIR | OpenSSL CA directory |
| CURL_CA_BUNDLE | curl-specific CA bundle |
| REQUESTS_CA_BUNDLE | Python requests library CA bundle |

### GitLab-Specific Considerations

GitLab CI has several certificate-related features:

1. Pre-clone script: Execute commands before Git operations

yaml

variables:
  GIT_STRATEGY: clone
  PRE_CLONE_SCRIPT: |
    apt-get update && apt-get install -y ca-certificates

2. Custom CA for self-managed GitLab:

yaml

variables:
  CI_SERVER_TLS_CA_FILE: /path/to/gitlab-ca.crt

3. Runner-level configuration: Managed in runner's config.toml

### Docker Best Practices

For reliable certificate handling in Docker:

dockerfile

# Use official images that include certificates
FROM python:3.11-slim  # Includes CA certs

# Or explicitly install and configure
FROM debian:bookworm-slim
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && update-ca-certificates

# Set environment variables for various tools
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_DIR=/etc/ssl/certs
ENV GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt
ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

### Troubleshooting Checklist

1. Verify certificates are installed: ls -la /etc/ssl/certs/
2. Check environment variables: env | grep -i ssl
3. Test with curl: curl -v https://github.com
4. Check Git config: git config --list | grep ssl
5. Verify permissions: Ensure cert files are readable
6. Check OpenSSL paths: openssl version -d
7. Test direct SSL: openssl s_client -connect github.com:443

How to fix fatal: unable to access: error setting certificate verify locations in CI in Git

What this error means

Typical symptoms

Common causes

How to fix "fatal: unable to access: error setting certificate verify locations in CI"

Advanced notes

Related errors

Official resources & further reading