Resolving SSL Self-Signed Certificate Errors on Bitbucket Datacenter


アトラシアン コミュニティをご利用ください。


プラットフォームについて: Server および Data Center のみ。この記事は、Server および Data Center プラットフォームのアトラシアン製品にのみ適用されます。

Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.

*Fisheye および Crucible は除く


If you're using a self-signed certificate on your Bitbucket Datacenter, you may receive SSL certificate errors when you try to perform certain actions. This page will help you resolve these errors.

When trying to perform a clone using instructions stated in Debug logging for Git operations on the client the following error is reported:


$ git clone
Cloning into 'repository'...
* Couldn't find host in the _netrc file; using defaults

* Adding handle: conn: 0x22a7568
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x22a7568) send_pipe: 1, recv_pipe: 0
* About to connect() to port 443 (#0)
*   Trying
* Connected to ( port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt
  CApath: c:/Users/username/Downloads
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
fatal: unable to access '': SSL certificate problem: self signed certificate in certificate chain


This is caused by Git not trusting the certificate provided by your server.


One possible workaround is to temporarily disable SSL check for your git command in case you only need to perform a one-time clone:

GIT_SSL_NO_VERIFY=true git clone


git remote add origin <gitrepo>
git config --global http.sslVerify false

The workaround is intended to be used for one-time only operations and not to be used frequently. Removing the SSL verification disproves the whole concept of having SSL implemented.


Step 1: Get a self-signed certificate of the remote server

There are multiple ways of exporting the certificate, Either from the Browser or using the OpenSSL command

Get a Certificate using OpenSSL

Get Certificate using OpenSSL
$ echo | openssl s_client -servername NAME -connect HOST:PORT |\
  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > certificate.pem

Get a Certificate using the Web browser

Export Certificate in MAC

Trust Certificate in your browser

To trust a self-signed certificate, you need to add it to your Keychain.

The easiest way to do that is to open the site in question in Safari, upon which you should get this dialog box:

Click 'Show Certificate' to reveal the full details:

Export Certificate in .pem format

Git doesn't use the Mac OS X keychain to resolve this, so you need to trust the certificate explicitly. 

  1. If you haven't done so already, follow the steps in 'Trust certificate in your browser, above
  2. Open Applications > Keychain Access and select 'Certificates' in the lower-left pane
  3. Type the website into the Search field in the top-right
  4. Select the certificate entry for the website, then in the menu click File > Export Items
  5. In the Save dialog, change 'File Format' to 'Privacy Enhanced Mail (.pem)' and save the file somewhere on your drive
Export Certificate From Firefox
  • Access the URL of the remote server
  • Click the Open padlock in the address bar.

  • Click the arrow beside OpenConnection Secure.

  • Click More Information. The OpenPage Info dialog box opens.

  • Click View Certificate.
  • The Certificate page opens.
  • Scroll down to the Miscellaneous section.

  • In the Download row, click the PEM (cert) link.
  • In the dialog box that opens, click OK to save the certificate file to a known location.
  • Navigate to the location for saving the file, and then click Save.

Step 2: Configure Git to trust the Certificate

For MAC/Linux:

Once the certificate is saved on the client you can instruct your git client to use it to trust the remote repository by updating the local git config:

# Initial clone
git clone

# Ensure all future interactions with origin remote also work
cd repository
git config http.sslCAInfo /path/to/certificate.pem

For Windows Client:

Step 1: Import  the certificate into the window trust store
Import a signed certificate into the local machine certificate store
  • Enter Start | Run | MMC.
  • Click File | Add/Remove Snap-in.

  • In the Add or Remove Snap-ins window, select Certificates and click Add.

  • Select the Computer account radio button when prompted and click Next

  • Select Local computer (selected by default) and click Finish.

  • Back in the Add or Remove Snap-ins window, click OK.

  • In the MMC main console, click on the plus (+) symbol to expand the Certificate snap-in.
  • To import the CA certificate, navigate to Trusted Root Certification Authorities | Certificates pane.

  • Right-click within the Certificates panel and click All Tasks | Import to start the Certificate Import wizard.

  • On successfully importing the CA certificate the wizard will bring you back to the MMC main console.

  • Close the MMC console.
Step 2: Configure git to use the certificate in the Windows Trust store

When using Windows, the problem resides that git by default uses the "Linux" crypto backend. Starting with Git for Windows 2.14, you can configure Git to use SChannel, the built-in Windows networking layer as the crypto backend. To do that, just run the following command in the GIT client:

git config --global http.sslbackend schannel

This means that it will use the Windows certificate storage mechanism and you don't need to explicitly configure the curl CA storage (http.sslCAInfo) mechanism. Once you have updated the git config, Git will use the Certificate in the Windows certificate store and should not require http.sslCAInfo setting.

Last modified on Mar 31, 2024


Powered by Confluence and Scroll Viewport.