Git server-certificate-verification-failed TLS verification of the remote host failed outright, naming the CA file and CRL file.

dev@local: ~/project — git

dev@local~/project$git status

error: server certificate verification failed

Diagnostics Translation

TLS verification of the remote host failed outright, naming the CA file and CRL file.

waiting for resolution...

MediumVersion Control System

Reviewed for reference consistency: August 11, 2026

Code is Safe

SECURE

Git has paused the operation to protect your code. No data has been lost or corrupted.

What To Know

TLS verification rejected the host while consulting the named CA file: the trust store, the served chain, or an intercepting middlebox failed to line up.

Where Did It Fail?

Working Tree

Your local files

add

Staging Index

Prepared changes

commit

Local Repo

Commit history

push/fetch

Remote Server

GitHub/GitLab

Git halted to protect the uncommitted files in your active working directory.

Commands That Trigger This

An office appliance decrypts and re-signs HTTPS traffic using a private root

An outdated ca-certificates package no longer trusts a rotated hosting certificate

A container image stripped of its CA bundle clones a repository

Technical Background

The message's value is the named files: they identify precisely which trust store was consulted. 'CAfile: none' points at a bundle that was never found; a real path with an old bundle points at staleness; a bundle that lists the issuer anyway points at interception or chain problems.

The remedy ladder starts at the system level — updating ca-certificates, wiring http.sslCAInfo to a complete bundle — and only reaches verification-disabling flags last, which trade the host-identity guarantee for convenience and are not a durable fix.

Underlying Causes

The system CA bundle is missing, stale, or incomplete for the server's chain

A TLS-intercepting middlebox presents a root the bundle does not contain

The certificate chain expired, as happened to many hosts during the 2021 root-certificate rollover

A second Git build uses a different, unconfigured trust store

Frequently Asked Questions

It reports the client's verification inputs, not the server's output; the served chain requires a separate inspection with a TLS client.

The expiry of a widely used root certificate invalidated long-lived bundles; hosts that switched chains left outdated clients failing verification overnight.

Related Git States

could-not-resolve-hostMedium

Your computer's DNS could not find the IP address for the remote repository's domain name.

rpc-failed-curlMedium

The underlying HTTP client (cURL) failed to complete the network request.

ssl-unable-to-get-local-issuer-certificateMedium

The TLS layer found no trusted issuer to complete the server's certificate chain.

ssl-certificate-revokedMedium

The certificate presented by the server was rejected because its issuer revoked it.