How to fix fatal: unable to access: SSL certificate problem: unable to get local issuer certificate (corporate proxy) in Git

# Check who issued the certificate for github.com
openssl s_client -connect github.com:443 </dev/null 2>/dev/null | openssl x509 -noout -issuer

# Expected output from home network:
# issuer=C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1

# Output if corporate proxy is intercepting:
# issuer=C = US, O = Your Company Name, CN = Company Proxy Root CA

# Configure Git to use Windows Secure Channel
git config --global http.sslBackend schannel

# Extract the certificate chain
openssl s_client -showcerts -connect github.com:443 </dev/null 2>/dev/null | \
  sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' > chain.pem

# Extract just the root CA (last certificate in chain)
openssl s_client -showcerts -connect github.com:443 </dev/null 2>/dev/null | \
  awk '/-----BEGIN CERTIFICATE-----/{cert=""} {cert=cert $0 "\n"} /-----END CERTIFICATE-----/{last=cert} END{print last}' > corporate-ca.crt

# Windows - check if IT deployed it here
dir "C:\ProgramData\Company\Certificates\"

# Linux - check system certificate store
ls /usr/local/share/ca-certificates/
ls /etc/pki/ca-trust/source/anchors/

# Linux/macOS
git config --global http.sslCAInfo /path/to/corporate-ca.crt

# Windows (use forward slashes)
git config --global http.sslCAInfo C:/Users/YourName/certs/corporate-ca.crt

# Find Git's certificate bundle
# Usually at: C:\Program Files\Git\mingw64\ssl\certs\ca-bundle.crt

# Append corporate CA to the bundle (run as Administrator)
type corporate-ca.crt >> "C:\Program Files\Git\mingw64\ssl\certs\ca-bundle.crt"

# Copy existing bundle and append corporate CA
cp /etc/ssl/certs/ca-certificates.crt ~/my-ca-bundle.crt
cat corporate-ca.crt >> ~/my-ca-bundle.crt

# Configure Git to use the combined bundle
git config --global http.sslCAInfo ~/my-ca-bundle.crt

git config --global --get http.sslCAInfo

# Copy certificate to system store
sudo cp corporate-ca.crt /usr/local/share/ca-certificates/

# Update the certificate store
sudo update-ca-certificates

# Verify it was added
ls /etc/ssl/certs/ | grep -i corporate

# Copy to the anchors directory
sudo cp corporate-ca.crt /etc/pki/ca-trust/source/anchors/

# Update the trust store
sudo update-ca-trust

# Verify
trust list | grep -i "company name"

# Add to system keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain corporate-ca.crt

# Or add to user keychain (no sudo required)
security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain corporate-ca.crt

# Configure HTTP proxy
git config --global http.proxy http://proxy.company.com:8080

# If authentication is required
git config --global http.proxy http://username:[email protected]:8080

# Configure HTTPS proxy (often same as HTTP)
git config --global https.proxy http://proxy.company.com:8080

# Use cntlm proxy as an intermediary
# Install cntlm, configure with your domain credentials
# Then point Git to the local cntlm instance
git config --global http.proxy http://localhost:3128

# Set in your shell profile (.bashrc, .zshrc, etc.)
export HTTP_PROXY=http://proxy.company.com:8080
export HTTPS_PROXY=http://proxy.company.com:8080
export NO_PROXY=localhost,127.0.0.1,.company.com

# Don't use proxy for internal Git server
git config --global http.https://git.internal.company.com.proxy ""

FROM ubuntu:22.04

# Copy corporate CA certificate
COPY corporate-ca.crt /usr/local/share/ca-certificates/

# Update certificate store
RUN apt-get update && apt-get install -y ca-certificates git && \
    update-ca-certificates

# Configure Git to use system certificates
RUN git config --global http.sslCAInfo /etc/ssl/certs/ca-certificates.crt

FROM alpine:3.18

COPY corporate-ca.crt /usr/local/share/ca-certificates/
RUN apk add --no-cache ca-certificates git && \
    update-ca-certificates

- name: Install corporate CA
  run: |
    echo "${{ secrets.CORPORATE_CA_CERT }}" | sudo tee /usr/local/share/ca-certificates/corporate-ca.crt
    sudo update-ca-certificates

before_script:
  - cp $CORPORATE_CA_CERT /usr/local/share/ca-certificates/
  - update-ca-certificates

pipeline {
    agent any
    environment {
        GIT_SSL_CAINFO = '/path/to/corporate-ca-bundle.crt'
    }
    stages {
        stage('Checkout') {
            steps {
                git url: 'https://github.com/org/repo.git'
            }
        }
    }
}

# Disable SSL verification for a single command
GIT_SSL_NO_VERIFY=true git clone https://github.com/org/repo.git

# Disable for current repository only
git config http.sslVerify false

# Disable globally (NOT RECOMMENDED)
git config --global http.sslVerify false

# Disable for specific domain only
git config --global http.https://github.com.sslVerify false

git config --global http.sslVerify true
git config --unset http.sslVerify