Banging my head against Git, Visual Studio 15 and SSL

Recently the hard drive in my trusty old laptop failed. Annoying, but ultimately it was just an excuse to go shopping, ignore most of my backup of the old machine and re-install all my programs from scratch. As part of that I decided that I'd try experimenting with the latest pre-release version of Visual Studio 15, to see if it was stable enough for me to use for my personal projects and blog coding now.

So having worked out how you re-install a "free upgrade from Win7" copy of Windows 10 and gone through through Visual Studio's new installer, I tried to clone some code from my private git server. Having been greeted with some cryptic errors, I've spent some time working out how to resolve the issue. So as ever, I'm writing it all down in case it's of help to others...

The unexpected error url copied!

The clone failed, with this classy bit of UI:

No problem, I thought, just look at the output window and... Oh...

Another spectacularly unhelpful error message. Thanks Microsoft.

Trying to clone a repository from GitHub worked fine, so it was clearly not a problem with connectivity or basic Git functionality. So having looked in the Event Logs (finding nothing) and tried to see if there was some sort of private log file being stored by Visual Studio without success, I wondered if I might get some help from the stand-alone Windows Git UI. It was a bit more helpful:

The full error on the screen there was:

fatal: unable to access 'https://SomeDomain/SomeRepo.git/': SSL certificate problem: unable to get local issuer certificate

					

Finally, a clue!

My private Git server is a copy of Bonobo running on a small machine that sits with my broadband kit. That box hosts a series of publicly accessible domains and they all have SSL certificates generated by a certification authority which runs on that server. (I set this up before Let's Encrypt existed, and I've not managed to work out how to migrate yet – a job for another day) Since I've never paid for a certificate, none of these are trusted by Windows by default...

I had already imported the root certificate from my server into the "Trusted Certificates" store on my rebuilt laptop, and I knew this was working OK because I browse to my Bonobo site and Chrome said it trusted the certificate being used for HTTPS:

Cue some head-scratching, since with my previous laptop install (and my work laptop – all using Visual Studio 2015) trusting that certificate was all I had needed to do to work with my Bonobo server in Visual Studio.

An explanation url copied!

So off to Google I went. Turns out the error message is something that's been debated a bit on Stack Overflow. The common refrain of "just tell Git to skip validating SSL certificates" didn't seem like a good idea to me – but there are some answers pointing out that Git doesn't use the normal Windows trust chain. That seemed to explain why the standard Git tools were unhappy – and perhaps suggests that VS15 has changed how it handles the HTTPS requests for Git operations.

So the answer seemed to be that I needed to manually add my root certificate's public key to Git's "trusted certficates" file.

Sounds easy, huh?

Alas, looking through the \Program Files\Git\ folder, I came across a collection of folders containing a ca-bundle.crt file that was referred to in the various posts about fixing this issue. So which one should I edit?

I tossed a coin, and initially I tried the one under \Program Files\Git\usr\ssl\certs. That had no effect when I tried the Git for Windows app again. Though it did remind me that being an app that originates on Unix, Git would rather you didn't edit its config files with Notepad as that tends to break the Unix-style line endings in the files... 😉

Having reverted the config that I'd changed, I had an idea: Git's command line tools can show you config settings, and the Stack Overflow post above suggested that the config setting for "where is my trusted certificates file" was named http.sslcainfo. So opening a command prompt and running git config --list told me that the setting was:

http.sslcainfo=C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt

					

So, firing up TextPad, I opened the base64 .cer file for my root certificate, and pasted it into the end of this file.

Success! Git for Windows was now able to clone a repository from Bonobo without error.

But still fail! Visual Studio still gave it's cryptic error...

Turns out it's not quite that easy... url copied!

After another half-hour of messing about in Google it dawned on me that Git can have multiple configuration files. Perhaps Visual Studio was looking at something different to the Git command line tools?

Google pointed me at the .gitconfig file that lives at the root of your user directory. When I looked at that it contained not much at all - just a reference to the recently cloned repository I had tested with above. So I added the setting necessary to tell Git to find it's trusted certificates in the same place that the command line tools had reported:

[http]
	sslcainfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt

					

And remarkably that fixed Visual Studio...

Whether this whole issue will make it into the release version of Visual Studio or not, I don't know. But at least I've worked out how I can make my private git server work for now.

↑ Back to top