# Git "SSL certificate problem: self-signed certificate" in CI

> Fix Git "SSL certificate problem: self signed certificate in certificate chain" in CI - a missing CA bundle or a proxy doing TLS interception on HTTPS clones.

Source: https://latchkey.dev/learn/git/git-ssl-certificate-problem-self-signed  
Updated: 2026-06-25

Git could not verify the TLS certificate of the Git host over HTTPS. Either the runner is missing CA certificates, or a corporate proxy is presenting its own self-signed certificate the runner does not trust.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git "SSL certificate problem: self-signed certificate" in CI?

There are 2 common causes: missing or stale ca certificates and a proxy intercepting tls. A minimal runner image without ca-certificates has no trust store, so Git cannot validate the host’s certificate chain.

### How do I fix Git "SSL certificate problem: self-signed certificate" in CI?

There are 2 fixes depending on which cause you have: install ca certificates and trust the proxy/internal root ca. Work through them in order, since the first is the most common.

### What does Git "SSL certificate problem: self-signed certificate" in CI actually mean?

An HTTPS clone/fetch fails during the TLS handshake with SSL certificate problem: self signed certificate in certificate chain (or unable to get local issuer certificate).

### How do I stop Git "SSL certificate problem: self-signed certificate" in CI happening again?

Use a runner image with ca-certificates preinstalled. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt