Error -17: the SSL certificate is invalid

[okhmedd]

---

Bugsquad note: This issue has been confirmed several times already. No need to confirm it further.

---

Using Garuda Linux with openssl-3.0.7-4, libxcrypt-4.4.33-1, git-2.39.0-1, and libgit2-1:1.5.0-2, Godot 4 beta 10. Using the repo with CLI works just fine.

The server is running Gitea 1.17.3, SSL by Let's encrypt. Apache acts as reverse proxy with a subpath. Server's git version is 2.30.2. The same repo was successfully tested on Windows 10, so that shouldn't be a server issue.

Git LFS is used in the target repo, configured properly both on the server and locally.

Trying to pull using HTTP:
GitPlugin: Performing fetch from origin core/variant/variant_utility.cpp:880 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -17: the SSL certificate is invalid in godot-git-plugin/src/git_plugin.cpp:_fetch#L411

SSH doesn't work, too:
GitPlugin: Performing fetch from origin core/variant/variant_utility.cpp:880 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -16: Failed to retrieve list of SSH authentication methods: Failed getting response in godot-git-plugin/src/git_plugin.cpp:_fetch#L411

[yayito-dev]

I'm having the same issue on Mac

[Jcodefox]

Same here with Void linux and Godot stable 4.0 release.

[soopermodel]

same issue here on Mac and godot4

[soopermodel]

any update?

[Calinou]

@karl-jansky @Jcodefox @chaeyan Which Git server are you reproducing this issue with? If it's self-hosted, can you post the address here if it's publicly reachable?

Can you post the link to a report from SSL Labs when using the Git server address you're trying to pull/push from? I wonder if the SSL library godot-git-plugin links against lacks support for TLS 1.3 or certain cipher suites that your server requires.

[okhmedd]

Also, Godot 3 version of this plugin works out of the box with the same server and client setup.

[delcake]

I'm observing the same issue on a self-hosted Gitea (v1.19.0) Docker container behind a Caddy reverse proxy. Godot version is 4.0.1.stable. I have confirmed that authentication to Gitea works as expected outside of Godot when tried on CLI via SSH using the configured public key.

When attempting to push via the HTTPS endpoint:
core/variant/variant_utility.cpp:894 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -17: the SSL certificate is invalid in godot-git-plugin/src/git_plugin.cpp:_push#L532

Push via SSH endpoint:
core/variant/variant_utility.cpp:894 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -16: Failed to retrieve list of SSH authentication methods: Failed getting response in godot-git-plugin/src/git_plugin.cpp:_push#L532

The domain I'm testing with is https://git.vgari.es/ and an SSL Labs report is available here.

[akasakakona]

Same issue on MacOS as well.
I tried compiling the plugin myself and I think this error is the problem:

Text version:

/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(auth_negotiate.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(auth_ntlm.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(winhttp.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(openssl_dynamic.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(openssl_legacy.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(stransport.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(pcre_string_utils.macos.editor.universal.o) has no symbols

[drakonicguy]

Having the same issue, (arch) linux and repo hosted on codeberg

[singlerider]

Same issue:

Remotes:

• Codeberg (SSH)
• GitHub (PAT)

Godot Git Plugin (4.0+)

• v3.0.0

[delcake]

As an aside to the main issue, I might suggest that these error codes could be updated to only append the suggestion about PAT tokens in the case that the plugin observes that GitHub is the destination and an actual authentication failure occurs. Just to keep the errors themselves more focused on where the process actually failed.