Configure HTTPS certificate verification for one Git repository

git config --local http.sslVerify false changes HTTPS certificate verification for the current repository. It also removes server-certificate verification, so treat it as a temporary diagnostic setting rather than a fix for certificate errors.

Prefer correcting the trust chain, proxy configuration, or server certificate while leaving verification enabled.

Configure a trusted certificate authority

Obtain your organization's CA certificate bundle through a trusted channel and verify its source. In the affected repository:

git config --local http.sslCAInfo /absolute/path/company-ca.pem
git config --local http.sslVerify true

Use the real absolute path to the approved PEM bundle. Git's TLS backend matters: for example, Windows builds using Schannel normally use the Windows certificate store, and CA-file handling can depend on additional configuration. Follow your organization's supported trust setup for that backend.

If the server omits an intermediate certificate, fix the server's certificate chain. If a corporate proxy terminates TLS, ensure the approved proxy CA is trusted. An expired certificate or a hostname mismatch needs its own correction; adding an arbitrary CA file does not solve every TLS error.

Limit a diagnostic exception

If you need to test whether verification is the source of a failure, a command-scoped override avoids leaving the repository with a persistent exception:

git -c http.sslVerify=false ls-remote origin

This command still contacts the server and may use credentials, so disabling verification is not harmless simply because the operation is read-only. Use it only on a known diagnostic path when you accept that exposure.

If a repository-local exception is necessary, set and then restore it explicitly:

git config --local http.sslVerify false
# After the diagnostic, restore verification.
git config --local http.sslVerify true

A local setting applies to HTTP remotes in that repository, not exclusively to origin.

Check settings that can override your change

git config --show-origin --get-regexp 'http\..*(sslverify|sslcainfo)'

Configuration names in this output are normalized, so the regular expression uses lowercase names. Inspect URL-specific HTTP settings as well as the general setting. Environment variables such as GIT_SSL_NO_VERIFY or GIT_SSL_CAINFO can also affect behavior. In a POSIX shell, remove a previous verification bypass with:

unset GIT_SSL_NO_VERIFY

Avoid a global http.sslVerify=false setting, which extends the exception to unrelated repositories.

Consider SSH when the host supports it

An SSH remote uses SSH host-key verification instead of HTTPS certificate validation. Verify the server's host key through a trusted source and configure the appropriate user key. Changing protocols does not remove the need to authenticate the server.

See Git HTTP configuration for http.sslVerify, http.sslCAInfo, URL-specific settings, and TLS-backend options.