Certificate error when importing an external repository into Bitbucket
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Description
Upon importing a repository from an external source, a certificate error is seen in the logs.
Environment
Bitbucket version 6.10.0 and above running on Windows
Github
Summary
Getting below error in the application log while importing GitHub repository into Bitbucket.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2020-12-30 10:33:16,915 DEBUG [pool-8-thread-5] c.a.bitbucket.scm.BaseCommand Executed C:\Program Files\Git\bin\git.exe -c gc.auto=0 fetch --force --prune --progress https://github.com/u-boot/u-boot.git +refs/*:refs/*
2020-12-30 10:33:16,915 ERROR [pool-8-thread-5] c.a.b.i.i.repository.RefSyncTask Failed to import repository: RMP/u-boot[1351]
com.atlassian.bitbucket.scm.CommandFailedException: 'C:\Program Files\Git\bin\git.exe -c gc.auto=0 fetch --force --prune --progress https://github.com/u-boot/u-boot.git +refs/*:refs/*' exited with code 128 saying: fatal: unable to access 'https://github.com/u-boot/u-boot.git/': error setting certificate verify locations:
CAfile: C:/Program Files/Git/mingw64/libexec/ssl/certs/ca-bundle.crt
CApath: none
at com.atlassian.bitbucket.scm.DefaultCommandExitHandler.onError(DefaultCommandExitHandler.java:46)
at com.atlassian.bitbucket.scm.git.command.GitCommandExitHandler.evaluateThrowable(GitCommandExitHandler.java:104)
at com.atlassian.bitbucket.scm.git.command.GitCommandExitHandler.onError(GitCommandExitHandler.java:201)
at com.atlassian.bitbucket.scm.DefaultCommandExitHandler.onExit(DefaultCommandExitHandler.java:31)
at com.atlassian.stash.internal.scm.git.command.fetch.FetchExitHandler.onExit(FetchExitHandler.java:39)
at com.atlassian.bitbucket.scm.BaseCommand.callExitHandler(BaseCommand.java:153)
at com.atlassian.bitbucket.scm.BaseCommand$CommandFuture.internalGet(BaseCommand.java:287)
at com.atlassian.bitbucket.scm.BaseCommand$CommandFuture.get(BaseCommand.java:251)
at com.atlassian.bitbucket.scm.BaseCommand.call(BaseCommand.java:87)
at com.atlassian.stash.internal.scm.git.command.SimpleGitCommand.configureAndCall(SimpleGitCommand.java:84)
at com.atlassian.stash.internal.scm.git.command.fetch.MirrorSynchronizeCommand.call(MirrorSynchronizeCommand.java:121)
at com.atlassian.stash.internal.scm.git.command.fetch.MirrorSynchronizeCommand.call(MirrorSynchronizeCommand.java:38)
at com.atlassian.bitbucket.internal.importer.repository.RefSyncTask.syncRefs(RefSyncTask.java:118)
at com.atlassian.bitbucket.internal.importer.repository.RefSyncTask.importRepository(RefSyncTask.java:97)
at com.atlassian.stash.internal.user.DefaultEscalatedSecurityContext.call(DefaultEscalatedSecurityContext.java:58)
at com.atlassian.bitbucket.internal.importer.repository.RefSyncTask.call(RefSyncTask.java:62)
at com.atlassian.bitbucket.internal.importer.repository.RefSyncTask.call(RefSyncTask.java:35)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.lang.Thread.run(Unknown Source)
... 1 frame trimmed
Caused by: com.atlassian.utils.process.ProcessException: Non-zero exit code: 128
at com.atlassian.bitbucket.scm.SummarizingProcessHandler.complete(SummarizingProcessHCause
The above exception occurs because of the incorrect location of the ca-bundle.crt path. As Git is running in Windows, if the http.sslcainfo was not set then it expects to find the certificate store in the following path
1
C:/Program Files/Git/mingw64/libexec/ssl/certs/ca-bundle.crtbut the certificate store is actually installed to an incorrect path as shown below
1
C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crtIn order to fix this one must specify the proper certs path.
Resolution:
There are several ways to fix the issue. Here is the possible resolution that needs to run on the client-side:
A. Tell Git where to find the CA bundle by running the below command:
1
git config --system http.sslCAPath /absolute/path/to/git/certificatesOR
copy the CA bundle to the /bin directory and add the following to the gitconfig file:
1
sslCAinfo = /bin/curl-ca-bundle.crtB. Ensure the root cert is added to git.exe's certificate store.
C. Ensure the complete CA is present, including the root cert.
D. Upgrade Git version.
E. Tell git to not perform the validation of the certificate using the global option:
1
git config --global http.sslVerify falseWas this helpful?