Arch Linux

bryanhonof

Member

From: Belgium

Registered: 2019-06-13

Posts: 3

Website

[SOLVED] "server certificate verification failed"

I recently started experiencing weird behavior when trying to `git clone` a repo from github or gitlab and even the AUR.
The error I get is the following:

fatal: unable to access 'https://github.com/xxxxxx/yyyyyyyyy/': server certificate verification failed. CAfile: none CRLfile: none

Things that I tried to do to fix this issue include:

Updating:

stat /etc/ssl/certs/ca-certificates.crt
sudo update-ca-trust

Removing and reinstalling the ca-certificates

# pacman -R ca-certificates{,-mozilla,-utils}
# pacman -S ca-certificates{,-mozilla,-utils}

Checking the system time:

[bryan@GLaDOS ~]$ timedatectl
               Local time: Mon 2019-12-02 10:10:20 CET
           Universal time: Mon 2019-12-02 09:10:20 UTC
                 RTC time: Mon 2019-12-02 09:10:21
                Time zone: Europe/Brussels (CET, +0100)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

I belive this is correct.

While writing this post I remembered that I recently installed gnu guix to play with it.
Now I must have installed something that depends on git, since guix installed git.
I think this must have overwritten the default git-exec-path since it did not point at /usr/lib/git-core like it used to.
It instead pointed at /home/bryan/.guix-profile/libexec/... .
Now I do not know why this happend to go wrong, maybe because I had 2 different git versions installed?

I fixed it by removing the git package from guix followed up by a simple log out and log in and everything worked as before.

guix package --remove git

ashneo76

Member

Registered: 2010-11-15

Posts: 9

Re: [SOLVED] "server certificate verification failed"

Thank you for this post. This guided me to implement a fix:

> sudo pacman -S git
> GIT_EXEC_PATH=/usr/lib/git-core git clone <blah>

# You can reproduce it like so:
> GIT_EXEC_PATH=$GUIX_PROFILE/libexec/git-core git clone <blah>

Now to figure out why the Guix git is broken.

---

Btw, I use Arch Linux

ashneo76

Member

Registered: 2010-11-15

Posts: 9

Re: [SOLVED] "server certificate verification failed"

Figured out a workaround.  I added the following to ~/.gitconfig

[http]
    sslCAinfo = ~/usr/local/cacert.pem

I manage my personal CA cert install but the solution would be to:
1. Find where GUIX certs are installed.
2. Get GUIX git to use them.

---

Btw, I use Arch Linux

ashneo76

Member

Registered: 2010-11-15

Posts: 9

Re: [SOLVED] "server certificate verification failed"

Following up on this, since I posted this earlier and was searching for it again yesterday. The solution for Guix is described here.

https://guix.gnu.org/manual/en/html_nod … cates.html

guix install nss-certs

and add the following to your shell init

export SSL_CERT_DIR="$GUIX_PROFILE/etc/ssl/certs"
export SSL_CERT_FILE="$SSL_CERT_DIR/ca-certificates.crt"
export GIT_SSL_CAINFO="$SSL_CERT_FILE"
export CURL_CA_BUNDLE="$SSL_CERT_FILE"

---

Btw, I use Arch Linux