git 'fatal: unable to access ...: SSL certificate problem: unable to get local issuer certificate' on clone, fetch or push. How do I fix it without turning off verification?

Cause: Git (through libcurl) could not build a trusted chain from the server certificate to a CA it knows. Typical reasons: a corporate proxy or firewall that re-signs HTTPS with a company root CA, a self-hosted Git server using a private or internal CA, a server that is missing its intermediate certificate, or an outdated or different CA bundle in the Git build (common with Git for Windows using a different TLS backend than expected). Fix (best first): 1. Get the root (and intermediate, if needed) CA certificate in PEM format from IT or the server admin. 2. Point Git at it: git config --global http.sslCAInfo /path/to/company-ca.pem. To limit it to one host use git config --global http.https://git.example.com/.sslCAInfo /path/to/company-ca.pem. The GIT_SSL_CAINFO environment variable overrides the setting. 3. On Windows, if the company CA is already trusted by the OS, switch to the OS store: git config --global http.sslBackend schannel (only works when your Git build offers that backend). 4. If the server admin forgot to send the intermediate certificate, ask them to fix the server chain; that helps every client. 5. Update Git and your OS CA bundle if the failure appeared suddenly on a public host. Do not: set http.sslVerify false or export GIT_SSL_NO_VERIFY. That disables certificate checking and lets anyone on the path read or alter your clone traffic and credentials. If you must test, scope it to one command and revert. Verify: git ls-remote https://git.example.com/org/repo.git succeeds with http.sslVerify still at its default (true). GIT_TRACE=1 and GIT_CURL_VERBOSE=1 can show which certificate is rejected. Sources: https://git-scm.com/docs/git-config https://git-scm.com/docs/git