{"action":"created","issue":{"url":"https://api.github.com/repos/msysgit/git/issues/358","labels_url":"https://api.github.com/repos/msysgit/git/issues/358/labels{/name}","comments_url":"https://api.github.com/repos/msysgit/git/issues/358/comments","events_url":"https://api.github.com/repos/msysgit/git/issues/358/events","html_url":"https://github.com/msysgit/git/issues/358","id":87101722,"number":358,"title":"\"Entrust Root Certification Authority - G2\" is not trusted","user":{"login":"killerkalamari","id":5439104,"avatar_url":"https://avatars.githubusercontent.com/u/5439104?v=3","gravatar_id":"","url":"https://api.github.com/users/killerkalamari","html_url":"https://github.com/killerkalamari","followers_url":"https://api.github.com/users/killerkalamari/followers","following_url":"https://api.github.com/users/killerkalamari/following{/other_user}","gists_url":"https://api.github.com/users/killerkalamari/gists{/gist_id}","starred_url":"https://api.github.com/users/killerkalamari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/killerkalamari/subscriptions","organizations_url":"https://api.github.com/users/killerkalamari/orgs","repos_url":"https://api.github.com/users/killerkalamari/repos","events_url":"https://api.github.com/users/killerkalamari/events{/privacy}","received_events_url":"https://api.github.com/users/killerkalamari/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-10T20:47:02Z","updated_at":"2015-07-08T18:42:01Z","closed_at":null,"body":"We set up a git server using Bonobo, and got a real cert (not self signed) from Entrust, for https://git.opusinspection.com/. Despite two Entrust certificates already present in /bin/curl-ca-bundle.crt, curl wasn't accepting our certificate. We checked the cert chain on sslshopper, everything seemed to be in order. I installed Git-1.9.5-preview20150319.exe because my Git was an older version. Still wasn't working.\r\n\r\nHere is the cert (used openssl in cygwin to convert it to pem format):\r\n~/Desktop$ openssl x509 -in EntrustRootCertificationAuthority-G2.pem -inform pem                                      -text -noout\r\nCertificate:\r\n    Data:\r\n        Version: 3 (0x2)\r\n        Serial Number: 1246989352 (0x4a538c28)\r\n    Signature Algorithm: sha256WithRSAEncryption\r\n        Issuer: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c                                     ) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Au                                     thority - G2\r\n        Validity\r\n            Not Before: Jul  7 17:25:54 2009 GMT\r\n            Not After : Dec  7 17:55:54 2030 GMT\r\n        Subject: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(                                     c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification A                                     uthority - G2\r\n        Subject Public Key Info:\r\n            Public Key Algorithm: rsaEncryption\r\n                Public-Key: (2048 bit)\r\n                Modulus:\r\n                    00:ba:84:b6:72:db:9e:0c:6b:e2:99:e9:30:01:a7:\r\n                    76:ea:32:b8:95:41:1a:c9:da:61:4e:58:72:cf:fe:\r\n                    f6:82:79:bf:73:61:06:0a:a5:27:d8:b3:5f:d3:45:\r\n                    4e:1c:72:d6:4e:32:f2:72:8a:0f:f7:83:19:d0:6a:\r\n                    80:80:00:45:1e:b0:c7:e7:9a:bf:12:57:27:1c:a3:\r\n                    68:2f:0a:87:bd:6a:6b:0e:5e:65:f3:1c:77:d5:d4:\r\n                    85:8d:70:21:b4:b3:32:e7:8b:a2:d5:86:39:02:b1:\r\n                    b8:d2:47:ce:e4:c9:49:c4:3b:a7:de:fb:54:7d:57:\r\n                    be:f0:e8:6e:c2:79:b2:3a:0b:55:e2:50:98:16:32:\r\n                    13:5c:2f:78:56:c1:c2:94:b3:f2:5a:e4:27:9a:9f:\r\n                    24:d7:c6:ec:d0:9b:25:82:e3:cc:c2:c4:45:c5:8c:\r\n                    97:7a:06:6b:2a:11:9f:a9:0a:6e:48:3b:6f:db:d4:\r\n                    11:19:42:f7:8f:07:bf:f5:53:5f:9c:3e:f4:17:2c:\r\n                    e6:69:ac:4e:32:4c:62:77:ea:b7:e8:e5:bb:34:bc:\r\n                    19:8b:ae:9c:51:e7:b7:7e:b5:53:b1:33:22:e5:6d:\r\n                    cf:70:3c:1a:fa:e2:9b:67:b6:83:f4:8d:a5:af:62:\r\n                    4c:4d:e0:58:ac:64:34:12:03:f8:b6:8d:94:63:24:\r\n                    a4:71\r\n                Exponent: 65537 (0x10001)\r\n        X509v3 extensions:\r\n            X509v3 Key Usage: critical\r\n                Certificate Sign, CRL Sign\r\n            X509v3 Basic Constraints: critical\r\n                CA:TRUE\r\n            X509v3 Subject Key Identifier:\r\n                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB\r\n    Signature Algorithm: sha256WithRSAEncryption\r\n         79:9f:1d:96:c6:b6:79:3f:22:8d:87:d3:87:03:04:60:6a:6b:\r\n         9a:2e:59:89:73:11:ac:43:d1:f5:13:ff:8d:39:2b:c0:f2:bd:\r\n         4f:70:8c:a9:2f:ea:17:c4:0b:54:9e:d4:1b:96:98:33:3c:a8:\r\n         ad:62:a2:00:76:ab:59:69:6e:06:1d:7e:c4:b9:44:8d:98:af:\r\n         12:d4:61:db:0a:19:46:47:f3:eb:f7:63:c1:40:05:40:a5:d2:\r\n         b7:f4:b5:9a:36:bf:a9:88:76:88:04:55:04:2b:9c:87:7f:1a:\r\n         37:3c:7e:2d:a5:1a:d8:d4:89:5e:ca:bd:ac:3d:6c:d8:6d:af:\r\n         d5:f3:76:0f:cd:3b:88:38:22:9d:6c:93:9a:c4:3d:bf:82:1b:\r\n         65:3f:a6:0f:5d:aa:fc:e5:b2:15:ca:b5:ad:c6:bc:3d:d0:84:\r\n         e8:ea:06:72:b0:4d:39:32:78:bf:3e:11:9c:0b:a4:9d:9a:21:\r\n         f3:f0:9b:0b:30:78:db:c1:dc:87:43:fe:bc:63:9a:ca:c5:c2:\r\n         1c:c9:c7:8d:ff:3b:12:58:08:e6:b6:3d:ec:7a:2c:4e:fb:83:\r\n         96:ce:0c:3c:69:87:54:73:a4:73:c2:93:ff:51:10:ac:15:54:\r\n         01:d8:fc:05:b1:89:a1:7f:74:83:9a:49:d7:dc:4e:7b:8a:48:\r\n         6f:8b:45:f6\r\n\r\nUsing cygwin, I appended the following to curl-ca-bundle.crt, copied it to /bin, and instantly curl (and git) started working:\r\n\r\n    Entrust Root Certification Authority - G2\r\n    =========================================\r\n    -----BEGIN CERTIFICATE-----\r\n    MIIEPjCCAyagAwIBAgIESlOMKDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMC\r\n    VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50\r\n    cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3Qs\r\n    IEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVz\r\n    dCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIwHhcNMDkwNzA3MTcy\r\n    NTU0WhcNMzAxMjA3MTc1NTU0WjCBvjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVu\r\n    dHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwt\r\n    dGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0\r\n    aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmlj\r\n    YXRpb24gQXV0aG9yaXR5IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\r\n    AoIBAQC6hLZy254Ma+KZ6TABp3bqMriVQRrJ2mFOWHLP/vaCeb9zYQYKpSfYs1/T\r\n    RU4cctZOMvJyig/3gxnQaoCAAEUesMfnmr8SVycco2gvCoe9amsOXmXzHHfV1IWN\r\n    cCG0szLni6LVhjkCsbjSR87kyUnEO6fe+1R9V77w6G7CebI6C1XiUJgWMhNcL3hW\r\n    wcKUs/Ja5CeanyTXxuzQmyWC48zCxEXFjJd6BmsqEZ+pCm5IO2/b1BEZQvePB7/1\r\n    U1+cPvQXLOZprE4yTGJ36rfo5bs0vBmLrpxR57d+tVOxMyLlbc9wPBr64ptntoP0\r\n    jaWvYkxN4FisZDQSA/i2jZRjJKRxAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP\r\n    BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqciZ60B7vfec7aVHUbI2fkBJmqzAN\r\n    BgkqhkiG9w0BAQsFAAOCAQEAeZ8dlsa2eT8ijYfThwMEYGprmi5ZiXMRrEPR9RP/\r\n    jTkrwPK9T3CMqS/qF8QLVJ7UG5aYMzyorWKiAHarWWluBh1+xLlEjZivEtRh2woZ\r\n    Rkfz6/djwUAFQKXSt/S1mja/qYh2iARVBCuch38aNzx+LaUa2NSJXsq9rD1s2G2v\r\n    1fN2D807iDginWyTmsQ9v4IbZT+mD12q/OWyFcq1rca8PdCE6OoGcrBNOTJ4vz4R\r\n    nAuknZoh8/CbCzB428Hch0P+vGOaysXCHMnHjf87ElgI5rY97HosTvuDls4MPGmH\r\n    VHOkc8KT/1EQrBVUAdj8BbGJoX90g5pJ19xOe4pIb4tF9g==\r\n    -----END CERTIFICATE-----"},"comment":{"url":"https://api.github.com/repos/msysgit/git/issues/comments/119693218","html_url":"https://github.com/msysgit/git/issues/358#issuecomment-119693218","issue_url":"https://api.github.com/repos/msysgit/git/issues/358","id":119693218,"user":{"login":"dscho","id":127790,"avatar_url":"https://avatars.githubusercontent.com/u/127790?v=3","gravatar_id":"","url":"https://api.github.com/users/dscho","html_url":"https://github.com/dscho","followers_url":"https://api.github.com/users/dscho/followers","following_url":"https://api.github.com/users/dscho/following{/other_user}","gists_url":"https://api.github.com/users/dscho/gists{/gist_id}","starred_url":"https://api.github.com/users/dscho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dscho/subscriptions","organizations_url":"https://api.github.com/users/dscho/orgs","repos_url":"https://api.github.com/users/dscho/repos","events_url":"https://api.github.com/users/dscho/events{/privacy}","received_events_url":"https://api.github.com/users/dscho/received_events","type":"User","site_admin":false},"created_at":"2015-07-08T18:42:01Z","updated_at":"2015-07-08T18:42:01Z","body":"Yes, you can. The first thing to test is whether [Git for Windows 2.x](https://git-for-windows.github.io/)' certificates include the one from Entrust that you need. If that works, I would suggest sticking with that version of Git for Windows (although I have no concrete ETA, it is the Git for Windows that I am working on these days).\r\n\r\nIf that *also* fails, I suspect that the Entrust certificates we have in our certificate bundles are not the same as you expect, and it would be good to figure out with Entrust's help what the status of our certificates is, and whether we should replace them, or augment them, or how to proceed."}}