How to fix fatal: unable to access 'https://github.com/': SSL certificate problem: unable to get local issuer certificate in Git

On Windows, Git often uses its own bundled certificate store instead of the Windows system certificates. This is the most common cause of SSL errors on Windows systems, especially in corporate environments.

# Configure Git to use Windows Secure Channel (SChannel)
git config --global http.sslBackend schannel

This tells Git to use the Windows certificate store, which includes certificates installed by your IT department or added via Windows Update.

If you need to revert to the bundled OpenSSL certificates:

git config --global http.sslBackend openssl

For Visual Studio users, you can also configure this in Git settings:
1. Open Visual Studio
2. Go to Git > Settings > Git Global Settings
3. Change "Cryptographic Network Provider" from "Unset" to "Secure Channel"

Outdated CA certificates are a common cause of this error. Update your system's certificate store:

Ubuntu/Debian:

sudo apt update
sudo apt install --reinstall ca-certificates
sudo update-ca-certificates

RHEL/CentOS/Fedora:

sudo yum update ca-certificates
# or on Fedora
sudo dnf update ca-certificates
sudo update-ca-trust

macOS:

# Homebrew users can update OpenSSL
brew update
brew upgrade openssl

Windows:
- Run Windows Update to get the latest root certificates
- Or download updated certificates from Microsoft's Root Certificate Program

You can tell Git exactly which certificate bundle to use for SSL verification:

# Find where Git is looking for certificates
git config --list | grep -i ssl

# Set a specific CA bundle file
git config --global http.sslCAInfo "/path/to/ca-bundle.crt"

Common CA bundle locations:

Git for Windows:

git config --global http.sslCAInfo "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt"

Linux:

git config --global http.sslCAInfo /etc/ssl/certs/ca-certificates.crt

macOS with Homebrew:

git config --global http.sslCAInfo $(brew --prefix)/etc/openssl@3/cert.pem

If you need to trust a specific certificate (like a corporate CA or self-signed certificate), add it to Git's certificate bundle:

Step 1: Export the certificate

# Extract certificate from the server
openssl s_client -showcerts -connect github.com:443 </dev/null 2>/dev/null | \
  openssl x509 -outform PEM > server-cert.pem

# View certificate details
openssl x509 -in server-cert.pem -text -noout | head -20

Step 2: Add to certificate bundle

On Windows, locate Git's ca-bundle.crt (typically in C:\Program Files\Git\mingw64\ssl\certs\ca-bundle.crt) and append the certificate content.

On Linux/macOS:

# Append certificate to the bundle
cat server-cert.pem | sudo tee -a /etc/ssl/certs/ca-certificates.crt

# Or create a dedicated file for custom certificates
sudo cp server-cert.pem /usr/local/share/ca-certificates/custom-ca.crt
sudo update-ca-certificates

If you're behind a corporate proxy that intercepts HTTPS traffic, you need to install your company's root CA certificate:

Step 1: Get the corporate CA certificate
- Contact your IT department for the root CA certificate
- Or export it from your browser's certificate viewer

Step 2: Add to Git's trust store

Windows:
1. Import the certificate into Windows Certificate Store (Local Machine > Trusted Root Certification Authorities)
2. Configure Git to use Windows certificates:

git config --global http.sslBackend schannel

Linux:

# Copy corporate CA to system store
sudo cp corporate-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# Or configure Git directly
git config --global http.sslCAInfo /path/to/corporate-ca-bundle.crt

Verify the proxy is intercepting:

# Check certificate issuer - if it's your company, proxy is intercepting
curl -v https://github.com 2>&1 | grep -i "issuer"

SSL certificates have validity periods. If your system clock is wrong, valid certificates may appear expired or not yet valid:

# Check current system time
date

# On Linux, sync with NTP
sudo timedatectl set-ntp true

# Or manually set the time
sudo timedatectl set-time "2025-01-15 10:30:00"

# On Windows, sync time via Settings > Time & Language > Date & time

After correcting the time, retry your Git operation. This is especially common on virtual machines or systems that have been suspended for long periods.

Warning: This should only be used temporarily for debugging or in isolated development environments. Never use this in production or with sensitive repositories.

# Disable SSL verification for a single command
GIT_SSL_NO_VERIFY=true git clone https://example.com/repo.git

# Or configure Git to skip verification (NOT RECOMMENDED)
git config --global http.sslVerify false

# Disable for a specific repository only
git config http.sslVerify false

# Disable for a specific domain
git config --global http.https://example.com.sslVerify false

Re-enable SSL verification immediately after identifying the issue:

git config --global http.sslVerify true

This bypasses certificate verification entirely, making your connection vulnerable to man-in-the-middle attacks. Use only to confirm the issue is SSL-related, then implement a proper fix.