How to fix fatal: unable to access: SSL certificate problem: certificate has expired in Git

Before investigating certificates, verify your system's date and time are correct. An incorrect clock can make valid certificates appear expired:

# Check current system date
date

# If incorrect on Linux, sync with NTP
sudo timedatectl set-ntp true
sudo timedatectl set-timezone YOUR_TIMEZONE

# On macOS, enable automatic date/time in System Preferences > Date & Time

# On Windows, run in Administrator command prompt
w32tm /resync

If your clock was significantly off, try the git command again after correcting it.

The most reliable fix is to update your operating system's CA certificate bundle. This ensures you have the latest root certificates:

Ubuntu/Debian:

sudo apt update
sudo apt install --reinstall ca-certificates
sudo update-ca-certificates

RHEL/CentOS/Fedora:

sudo yum update ca-certificates
# or on newer systems
sudo dnf update ca-certificates

macOS:

# Update via Homebrew if installed
brew update && brew upgrade openssl

# Or update macOS to get latest certificates
softwareupdate --list

Windows:
- Run Windows Update to get the latest root certificates
- Or manually update via certutil: certutil -generateSSTFromWU roots.sst

Newer versions of Git include updated CA certificate bundles. Updating Git often resolves certificate issues:

Ubuntu/Debian:

# Add official Git PPA for latest version
sudo add-apt-repository ppa:git-core/ppa
sudo apt update
sudo apt install git

# Verify version
git --version

macOS:

# Via Homebrew
brew update && brew upgrade git

Windows:
Download the latest version from https://git-scm.com/download/win and reinstall. The installer will update the bundled CA certificates.

RHEL/CentOS:

sudo yum install https://packages.endpointdev.com/rhel/7/os/x86_64/endpoint-repo.x86_64.rpm
sudo yum install git

On Windows, Git can use either its bundled OpenSSL certificates or the Windows Certificate Store. If the Windows store has updated certificates, configure Git to use it:

# Use Windows Certificate Store instead of OpenSSL bundle
git config --global http.sslBackend schannel

# Verify the setting
git config --global http.sslBackend

This is particularly useful in corporate environments where IT has deployed certificates to the Windows store. To revert to OpenSSL:

git config --global http.sslBackend openssl

On macOS, duplicate certificates with different expiration dates can cause issues. Check for and remove expired duplicates:

# Open Keychain Access
open /Applications/Utilities/Keychain\ Access.app

1. Search for certificates that might have expired (e.g., "DST Root CA X3", "DigiCert")
2. If you find two certificates with the same name but different expiration dates
3. Delete the expired one (check the "Expires" field)
4. Keep the certificate with the future expiration date

Alternatively, from the command line:

# List certificates
security find-certificate -a -p /Library/Keychains/System.keychain | \
  openssl x509 -noout -subject -dates 2>/dev/null

If certificate issues persist, switching to SSH authentication bypasses HTTPS entirely:

# Generate SSH key if you don't have one
ssh-keygen -t ed25519 -C "[email protected]"

# Add key to ssh-agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Copy public key to clipboard
cat ~/.ssh/id_ed25519.pub
# Add this key to your GitHub/GitLab/Bitbucket account settings

Then clone or change remote URL to use SSH:

# Clone via SSH
git clone [email protected]:username/repo.git

# Or change existing remote from HTTPS to SSH
git remote set-url origin [email protected]:username/repo.git

# Verify remote URL
git remote -v

As a last resort for urgent situations, you can disable SSL verification. This is dangerous and should only be used temporarily:

# Disable SSL verification for a single command
git -c http.sslVerify=false clone https://github.com/username/repo.git

# Or disable globally (NOT RECOMMENDED)
git config --global http.sslVerify false

Security Warning: Disabling SSL verification makes you vulnerable to man-in-the-middle attacks. Anyone on your network could intercept and modify your code. Only use this if:
- You understand the security risks
- You're on a trusted private network
- It's a temporary measure while you fix the real issue
- You re-enable verification immediately after: git config --global http.sslVerify true