git error "unable to get local issuer certificate" with "User Trust" certificate-CodePudding

The

I do understand that git by default uses openssl and the certificate list via the file ca-bundle.trust for validating certificates.

The strange thing is that git actually contains the root certificate, but it's not exactly the same. The certificate which is part of the ca-bundle.trust file has some additional content (Marked in green)

When i compare the properties of the two certificates, i don't see any difference, but i assume this is the reason why git does reject the certificate.

Certificates in case someone wants to have a look at it:

Official User Trust root certificate

-----BEGIN CERTIFICATE----- MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B 3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR OJv0OwWIJAJPuLodMkY tJHUYmTbf6MG8YgYapAiPLz E/CHFHv25B O1ORRxhFnRghRy4YUVD 8M/5 bJz/ Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O T23LLb2 VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S UzeQc0PzMsNT 79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni 49Vv4M0GkPGw/zJSZrM233bkf6 c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p tdOmw1XNtB1xLaqUkL39iAigmT Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs 1b/97l c6wjOy0AvzVVdAlJ2ElYGn SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee UB9XVKg /XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6 eLf8ZxXhyVeE Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y CDwIDAQABo0IwQDAd BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF Up/L M ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3 ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I 8jRRa8YFWSQEg9zKC7F4iRO/Fjs 8PRF/iKz6y O0tlFYQXBl2 odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR iQycE0xyNN 81XHfqnHd4blsjDwSXWXavVcStkNr/ XeTWYRUc ZruwXtuhxkYze Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr yDZ4XUmFF0sbmZgIn/f3gZ XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/ qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB 4ALtRZh8tSQZXq9EfX7mRB VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ 6IHdfG jjxDah2nGN59PRbxYvnKkKj9 -----END CERTIFICATE-----

Root certificate which is part of the ca-bundle.trust file from git

-----BEGIN TRUSTED CERTIFICATE----- MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B 3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR OJv0OwWIJAJPuLodMkY tJHUYmTbf6MG8YgYapAiPLz E/CHFHv25B O1ORRxhFnRghRy4YUVD 8M/5 bJz/ Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O T23LLb2 VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S UzeQc0PzMsNT 79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni 49Vv4M0GkPGw/zJSZrM233bkf6 c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p tdOmw1XNtB1xLaqUkL39iAigmT Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs 1b/97l c6wjOy0AvzVVdAlJ2ElYGn SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee UB9XVKg /XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6 eLf8ZxXhyVeE Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y CDwIDAQABo0IwQDAd BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF Up/L M ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3 ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I 8jRRa8YFWSQEg9zKC7F4iRO/Fjs 8PRF/iKz6y O0tlFYQXBl2 odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR iQycE0xyNN 81XHfqnHd4blsjDwSXWXavVcStkNr/ XeTWYRUc ZruwXtuhxkYze Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr yDZ4XUmFF0sbmZgIn/f3gZ XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/ qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB 4ALtRZh8tSQZXq9EfX7mRB VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ 6IHdfG jjxDah2nGN59PRbxYvnKkKj9MD0wFAYIKwYBBQUHAwQGCCsGAQUFBwMBDCVVU0VS VHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5 -----END TRUSTED CERTIFICATE-----

Question

Why does git not have the exact same root certificate as the one from User Trust?

What is in the additional content in the certificate file?

CodePudding user response：

I opened these certs with git's builtin openssl (enter this in git command line):

openssl x509 -inform pem -noout -text -in '1.cer' > first_cert.txt openssl x509 -inform pem -noout -text -in '2.cer' > second_cert.txt

Then compared those outputs and got this: compared files So, basically that are use cases.

What about making it work I think here is the answer Looks similar to your problem. If not working try this (In short it says that you should add your certs at the end of ca-bundle.cert)

CodePudding user response：

I'd like to understand why the ca-bundle.cert doesn't contain the same root certificate as provided by the actual CA

Because your server could not use the original certificate to sign a key without first adding a Trust use extension.

As documented in x509:

A trusted certificate is an ordinary certificate which has several additional pieces of information attached to it such as the permitted and prohibited uses of the certificate and an "alias".

(That is the extra bit you see in your certificate)

Normally when a certificate is being verified at least one certificate must be "trusted".
By default a trusted certificate must be stored locally and must be a root CA: any certificate chain ending in this CA is then usable for any purpose.

Trust settings currently are only used with a root CA.
They allow a finer control over the purposes the root CA can be used for.
For example a CA may be trusted for SSL client but not SSL server use.

Using a git config --global http."https://your.domain.com/".sslCAInfo <your_certificate>.pem is the right way to instruct Git to use that trusted certificate.