Jenkins 管道脚本由于错误“SSL 证书问题：无法获取本地颁发者证书”而阻止 git pull (Bitbucket)

Question

my jenkins pipeline script is extremely simple (so far), see below

node{
    stage('Scm Checkout'){
        git credentialsId: 'git-creds', url: 'https://xx@xx/xx.git'
    }
}

Error im getting is SSL certificate problem: unable to get local issuer certificate - im pulling from a bitbucket repo.

Interestingly its failing at the following line:

git.exe fetch --tags --force --progress -- https://xx@xx/xx.git +refs/heads/*:refs/remotes/origin/* # timeout=10

however I can run this fine from git bash if I just run the following command first:

git config --global http.sslVerify false

I saw a post elsewhere where someone was suffering from same issue and his comment was: "Adding following to gitconfig file resolved the issue"

{{[http] }}

sslVerify = false

This may be the solution, but Im not sure what exact steps I need to follow to achieve this

Answer 1

Disabling ssl verification is rarely a good solution, and would only be considered for testing (to check for instance if the network connection works)

It is better to define a dummy job which does git config --list , and take note of the http.sslcainfo path for the ca-bundle.crt.

You can add in that bundle the certificates from bitbucket.org (using openssl s_client -showcerts -connect ).

Answer 2

If you want to disable ssl verification in git, and don't want to execute the git config ... command in your pipeline, you can edit the git configuration file and add at the end of it

[http]
sslVerify = false

you can do this in different files, depending on whether you want this change to apply only to the current repo, or to all the repos in the same node. I recommend you to take a look at git-config man page

FILES
... there are three files where git config will search for configuration options:

$GIT_DIR/config
Repository specific configuration file. (The filename is of course relative to the repository root, not the working directory.)

~/.gitconfig
User-specific configuration file. Also called "global" configuration file.

$(prefix)/etc/gitconfig
System-wide configuration file.

Adding a step prior to the checkout that inserts this config in the active repo will do the trick, and only impact current repo. Something in the lines of the below code should work

node {
    stages {
        stage('Pre-Checkout') {
            steps {
                sh "git config http.sslVerify false"
            }
        }
        stage('Scm Checkout'){
            git credentialsId: 'git-creds', url: 'https://xx@xx/xx.git'
        }
    }
}