服务器证书验证失败。cafile：/etc/ssl/certs/ca-certificates.crt crlfile：none

Question

server certificate verification failed. CAfile: /etc/ssl/certs/cacertificates.crt CRLfile: none

Answer 1

TLDR：

hostname=XXX
port=443
trust_cert_file_location=`curl-config --ca`

sudo bash -c "echo -n | openssl s_client -showcerts -connect $hostname:$port -servername $hostname \
    2>/dev/null  | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'  \
    >> $trust_cert_file_location"

警告：正如GarethThered出色的回答所指出的，这将添加所有证书，而不是只添加根CAS。
未经尽职调查就盲目地将所有（任何）证书添加到您的信任商店不是最好的做法。

冗长的回答

export GIT_SSL_NO_VERIFY=1
#or
git config --global http.sslverify false

要获得该证书（您需要将其添加到curl-ca-bundle.crt文件中），请键入A：

echo -n | openssl s_client -showcerts -connect yourserver.com:YourHttpsGitlabPort \
  2>/dev/null  | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'

('yourserver.com'是您的GitLab服务器名称，yourhttpsgitlabport是https端口，通常是443)

若要检查CA（证书颁发机构颁发者），请键入A：

echo -n | openssl s_client -showcerts -connect yourserver.com:YourHttpsGilabPort \
  2>/dev/null  | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' \
  | openssl x509 -noout -text | grep "CA Issuers" | head -1

注意：Valeriy Katkov在注释中建议将-servername选项添加到openssl命令中，否则在Valeriy的情况下，该命令不会显示www.github.com的证书。

openssl s_client -showcerts -servername www.github.com -connect www.github.com:443

Findekano在评论中补充道：

curl-config --ca

sudo apt-get install --reinstall ca-certificates
sudo mkdir /usr/local/share/ca-certificates/cacert.org
sudo wget -P /usr/local/share/ca-certificates/cacert.org http://www.cacert.org/certs/root.crt http://www.cacert.org/certs/class3.crt
sudo update-ca-certificates
git config --global http.sslCAinfo /etc/ssl/certs/ca-certificates.crt