Git ssl-unable-to-get-local-issuer-certificate The TLS layer found no trusted issuer to complete the server's certificate chain.

dev@local: ~/project — git

dev@local~/project$git status

error: ssl unable to get local issuer certificate

Diagnostics Translation

The TLS layer found no trusted issuer to complete the server's certificate chain.

waiting for resolution...

MediumVersion Control System

Reviewed for reference consistency: August 11, 2026

Code is Safe

SECURE

Git has paused the operation to protect your code. No data has been lost or corrupted.

What To Know

Chain-building stopped for lack of a trusted issuer: the server's chain was incomplete for the client's trust store, so the connection was refused before any Git data moved.

Where Did It Fail?

Working Tree

Your local files

add

Staging Index

Prepared changes

commit

Local Repo

Commit history

push/fetch

Remote Server

GitHub/GitLab

Git halted to protect the uncommitted files in your active working directory.

Commands That Trigger This

Cloning behind a corporate TLS-inspection appliance whose root is not installed

A self-hosted GitLab serving an incomplete chain with a missing intermediate

Docker images or minimal systems shipped without a CA certificate bundle

Technical Background

The phrasing is literal: verification failed while looking for the issuer of one certificate in the presented chain. Either the server should have supplied it, or the local store should already know it — and neither held the answer.

The failure is configuration-shaped rather than content-shaped. Pointing http.sslCAInfo at a complete bundle, updating the distribution's CA package, or installing the inspection appliance's root restores verification. Disabling verification entirely removes the protection and is not an equivalent remedy.

Underlying Causes

The server does not send the full intermediate chain

The local CA bundle is absent, outdated, or incomplete

A corporate proxy re-signs traffic with a private root unknown to the client

The TLS backend cannot locate the system trust store on a minimal install

Frequently Asked Questions

Browsers ship their own trust stores and can fetch missing intermediates on the fly; Git's library relies on the configured bundle and the server's chain alone.

Disabling verification removes the guarantee that the host is who it claims to be; the durable fix is completing the trust chain on either side.

Related Git States

could-not-resolve-hostMedium

Your computer's DNS could not find the IP address for the remote repository's domain name.

rpc-failed-curlMedium

The underlying HTTP client (cURL) failed to complete the network request.

ssl-certificate-revokedMedium

The certificate presented by the server was rejected because its issuer revoked it.

server-certificate-verification-failedMedium

TLS verification of the remote host failed outright, naming the CA file and CRL file.