无法解决“无法获得本地颁发者证书"在带有自签名证书的 Windows 上使用 git [英] Unable to resolve "unable to get local issuer certificate" using git on Windows with self-signed certificate

问题描述

我在 Windows 上使用 Git.我安装了 msysGit 包.我的测试存储库在服务器上有一个自签名证书.我可以毫无问题地使用 HTTP 访问和使用存储库.移动到 HTTPS 会出现错误:

I am using Git on Windows. I installed the msysGit package. My test repository has a self signed certificate at the server. I can access and use the repository using HTTP without problems. Moving to HTTPS gives the error:

SSL 证书问题:无法获取本地颁发者证书.

SSL Certificate problem: unable to get local issuer certificate.

我在 Windows 7 客户端计算机的受信任根证书颁发机构中安装了自签名证书.我可以在 Internet Explorer 中浏览到 HTTPS 存储库 URL，没有错误消息.

I have the self signed certificate installed in the Trusted Root Certification Authorities of my Windows 7 - client machine. I can browse to the HTTPS repository URL in Internet Explorer with no error messages.

Philip Kelley 的这篇博文 解释了 cURL 不使用客户端计算机的证书存储.我按照博客文章的建议创建了 curl-ca-bundle.crt 的私有副本并配置 Git 以使用它.我确信 Git 正在使用我的副本.如果我重命名副本；Git 抱怨文件丢失.

This blog post by Philip Kelley explained that cURL does not use the client machine's certificate store. I followed the blog post's advice to create a private copy of curl-ca-bundle.crt and configure Git to use it. I am sure Git is using my copy. If I rename the copy; Git complains the file is missing.

我粘贴了我的证书，如博客文章中所述，我仍然收到消息无法获得本地颁发者证书".

I pasted in my certificate, as mentioned in the blog post, I still get the message "unable to get local issuer certificate".

我通过 HTTPS 克隆 GitHub 存储库来验证 Git 仍在工作.

I verified that Git was still working by cloning a GitHub Repository via HTTPS.

我看到的唯一与博客文章不同的是我的证书是根 - 没有链可以到达它.我的证书最初来自单击 IIS8 IIS 管理器链接创建自签名证书".也许这会使证书在某些方面与 cURL 所期望的有所不同.

The only thing I see that's different to the blog post is that my certificate is the root - there is no chain to reach it. My certificate originally came from clicking the IIS8 IIS Manager link 'Create Self Signed Certificate'. Maybe that makes a certificate different in some way to what cURL expects.

如何让 Git/cURL 接受自签名证书?

How can I get Git/cURL to accept the self signed certificate?

推荐答案

An answer to 使用 makecert 进行开发 SSL 为我解决了这个问题.

An answer to Using makecert for Development SSL fixed this for me.

我不知道为什么，但是通过 IIS 管理器中简单的创建自签名证书"链接创建的证书并没有起到作用.我遵循了创建和安装自签名 CA 根的链接问题中的方法；然后使用它为我的服务器颁发服务器身份验证证书.我在 IIS 中安装了它们.

I do not know why, but the certificate created by the simple 'Create Self Signed Certificate' link in IIS Manager does not do the trick. I followed the approach in the linked question of creating and installing a self-signed CA Root; then using that to issue a Server Authentication Certificate for my server. I installed both of them in IIS.

这使我的情况与原始问题中引用的博客文章相同.一旦根证书被复制/粘贴到 curl-ca-bundle.crt 中，git/curl 组合就得到满足.

That gets my situation the same as the blog post referenced in the original question. Once the root certificate was copy/pasted into curl-ca-bundle.crt the git/curl combo were satisfied.

这篇关于无法解决“无法获得本地颁发者证书"在带有自签名证书的 Windows 上使用 git的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！