When using Git on Windows, especially in environments with stringent security policies, you might encounter errors related to SSL certificates. One common error is "unable to get local issuer certificate," which occurs when Git tries to verify an SSL certificate for a remote server but fails to do so because it cannot trace back to a trusted certificate authority (CA).

Understanding SSL Certificates and Trust Chains

SSL certificates are used to secure communications between a client and a server. These certificates are issued by trusted certificate authorities (CAs). When a client (like Git) connects to a server, it will check the server's SSL certificate to ensure it is valid and signed by a trusted CA.

A self-signed certificate will not automatically be trusted by a client because it is not signed by a recognized CA. In corporate environments, self-signed certificates are common for internal services, so you may need to manually configure your system to trust them.

Troubleshooting the "unable to get local issuer certificate" Error

Step 1: Locate the Self-signed Certificate

First, ensure you have access to the self-signed certificate used by the server. This certificate will typically be a .crt or .pem file.

Step 2: Add the Certificate to the Local Certificate Store

1. Open the Windows Run dialog (Win + R), and type mmc .
2. In the Microsoft Management Console, go to File -> Add/Remove Snap-in .
3. Select Certificates , then click Add .
4. Choose Computer account , click Next , and finish the wizard by clicking OK .
5. Expand Certificates (Local Computer) in the console root.
6. Right-click on Trusted Root Certification Authorities and select Import .
7. Follow the import wizard to add your self-signed certificate to the store.

Step 3: Configure Git to Use the Certificate

Git on Windows uses the SSL backend provided by the curl library, which leverages the Windows certificate store when compiled correctly.

1. Open a terminal or Git Bash.
2. Configure Git to trust the added certificate by setting the following global configuration variable: