7

I would like to use a git repo that is accessigble through https, Https server has self signed certificate. I always get an error while trying to clone the repo with eclipse+egit:

https://host/path: cannot open git-upload-pack sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Is it possible to bypass this problem? I used export GIT_SSL_NO_VERIFY=1 command to skip ssl verification with the console client. This trick doesn't work with eclipse.

Thanks,

Hubi

Hubidubi
  • 850
  • 4
  • 18
  • 34

5 Answers5

9

You can also just set eGit to ignore server verification. In Eclipse go to Window -> Preferences.

From there go to Team -> Git -> Configuration

Click "New Entry"

Key: http.sslVerify Value: false

Click "OK"

Click "OK"

For a more detailed approach to this check out my blog post here: http://www.pur-logic.com/2012/04/21/egit-self-signed-certificate/

ossys
  • 4,157
  • 5
  • 32
  • 35
  • Is this the same problem if IP address is used instead of hostname ? – Chris May 23 '13 at 18:10
  • 6
    As stated in numerous answers related to the topic "self-signed certificates and git" using `http.sslVerify:false` is a **terrible practice from security PoV** and should be an absolute last resort, especially that there are other options. This answer solves the issue and opens up for others, normally considered much more severe. But hey, hackers gotta eat too, right? :) The root problem here is that the self-signed certificate is not trusted by the java used by egit/eclipse. And the solution is simply to enroll it in cacert. – shturec Feb 09 '16 at 15:26
9

You have to import that certificate into your keystore (either the default keystore cacerts in your JDK directory or you specify one with the parameter -Djavax.net.ssl.trustStore).

dunni
  • 43,386
  • 10
  • 104
  • 99
  • 1
    Unlike the answer selected by the author this one doesn't open security vulnerabilities and should be the preferred one as it is a solution for the exact problem here - the java used by egit doesn't recognize the certificate as trusted. – shturec Feb 09 '16 at 15:33
2

The FAQ of CAcert provides the commandline for keytool:

keytool -keystore $/PATH/TO/CACERTS/KEYSTORE -storepass changeit -import -trustcacerts -v -alias cacertclass1 -file root.crt
  • Possibly, you have to omit -trustcacerts to import a normal certificate.
  • -alias might also be unnecessary
koppor
  • 19,079
  • 15
  • 119
  • 161
1

We should use http.sslCAInfo option for this use-case.
However, eclipse JGit development status for this option has been stuck for a very long time.

FYI

hiropon
  • 1,675
  • 2
  • 18
  • 41
0

I had some trouble with this too, but with a different story. The hostname for the Git repo didn't match the cert's hostname. Solution was to change the cert to match the hostname.

siebz0r
  • 18,867
  • 14
  • 64
  • 107