How do I resolve error msg ? SSL certificate problem: self signed certificate in certificate chain
Asked by John_Devron:

When I try to clone a repository using Sourcetree I get an error msg like this ...

Error: fatal: unable to access '<https://www.xyz.com:8443/scm/auvv/auv.git/>':

SSL certificate problem: self signed certificate in certificate chain

![Sourcetree error.png](/t5/image/serverpage/image-id/188901i1FCF82FF9EE73BA1/image-size/large?v=v2&px=999 "Sourcetree error.png")

I found the following command online but I'm not sure if it is applicable to the above error msg, or how to implement it ...

git -c http.sslVerify=false clone \<repository-name\>

I tried pasting that into a DOS command line prompt without success. Not sure how to open the BASH shell. Instructions how to open the BASH could be useful.

Isn't there a way to use HTTPS only without SSH, or is that dependent on how the repository server is configured?


Answers:
author: Daniel Eads
body: Hi John, welcome to the Community!

It looks like you're connecting to the repository with HTTPS (no SSH involved), but the server is using a self-signed certificate.

Rather than disabling certificate validation entirely, I would recommend adding the self-signed certificate to the trust store on your machine. This is a little complicated on Windows. You'll first need to get a copy of the certificate, and there are a few options:

* If the administrator is known, ask them for a copy of the public certificate in .pem format
* You could use the **openssl** command to fetch it, e.g.

      openssl s_client -connect www.xyz.com:8443/scm/

  and then save the lines starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----
* Using Firefox, you could browse to the site and use the **Export** option in **Options -\> Advanced -\> Certificates -\> View Certificates -\> Servers**

Once you have the certificate in its own .pem file, use this command (in the same directory) to add it to git:

    git config --global http.sslCAInfo saved-cert.pem

Restart Sourcetree, and it should no longer complain about that particular server.

Cheers,  
Daniel   

<br />

(*p.s. you did use the right command to disable certificate validation in git, you just need to add the --system or --global flag to get that to push through to Sourcetree*)

comments: author: John_Devron
body: Thanks for the helpful advice Daniel.

I'm having difficulty tracking down the system administrator. So I'm trying your 2nd and 3rd suggestions.

How do I apply this command ? `openssl s_client -connect `[www.xyz.com:8443/scm/](http://www.xyz.com:8443/scm/)

`I assume it would be through a BASH shell, but don't know how to get that started. Do you have a suggestion?`

When you say "browse to the site and use the **Export** option" I assume you are referring to the Bitbucket server site. Is that correct? If so, then where are the menu "**Options**"?

Thank You!

John


author: vinodh kumar subbareddy
body: Hey [John_Devron](https://community.atlassian.com/t5/user/viewprofilepage/user-id/4825582),

Did you get this issue fixed. I got the same issue and I'm looking for fix.

Please help if this issue got fixed for you

Thank You

Vinodh