Error -17: the SSL certificate is invalid

Bugsquad note: This issue has been confirmed several times already. No need to confirm it further.

Using Garuda Linux with openssl-3.0.7-4, libxcrypt-4.4.33-1, git-2.39.0-1, and libgit2-1:1.5.0-2, Godot 4 beta 10. Using the repo with CLI works just fine.

The server is running Gitea 1.17.3, SSL by Let's encrypt. Apache acts as reverse proxy with a subpath. Server's git version is 2.30.2. The same repo was successfully tested on Windows 10, so that shouldn't be a server issue.

Git LFS is used in the target repo, configured properly both on the server and locally.

Trying to pull using HTTP:
GitPlugin: Performing fetch from origin core/variant/variant_utility.cpp:880 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -17: the SSL certificate is invalid in godot-git-plugin/src/git_plugin.cpp:_fetch#L411

SSH doesn't work, too:
GitPlugin: Performing fetch from origin core/variant/variant_utility.cpp:880 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -16: Failed to retrieve list of SSH authentication methods: Failed getting response in godot-git-plugin/src/git_plugin.cpp:_fetch#L411

I'm having the same issue on Mac

Same here with Void linux and Godot stable 4.0 release.

same issue here on Mac and godot4

@Jcodefox

@karl-jansky @Jcodefox @chaeyan Which Git server are you reproducing this issue with? If it's self-hosted, can you post the address here if it's publicly reachable?

Can you post the link to a report from SSL Labs when using the Git server address you're trying to pull/push from? I wonder if the SSL library godot-git-plugin links against lacks support for TLS 1.3 or certain cipher suites that your server requires.

Also, Godot 3 version of this plugin works out of the box with the same server and client setup.

I'm observing the same issue on a self-hosted Gitea (v1.19.0) Docker container behind a Caddy reverse proxy. Godot version is 4.0.1.stable. I have confirmed that authentication to Gitea works as expected outside of Godot when tried on CLI via SSH using the configured public key.

When attempting to push via the HTTPS endpoint:
core/variant/variant_utility.cpp:894 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -17: the SSL certificate is invalid in godot-git-plugin/src/git_plugin.cpp:_push#L532

Push via SSH endpoint:
core/variant/variant_utility.cpp:894 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -16: Failed to retrieve list of SSH authentication methods: Failed getting response in godot-git-plugin/src/git_plugin.cpp:_push#L532

The domain I'm testing with is https://git.vgari.es/ and an SSL Labs report is available here.

Same issue on MacOS as well.
I tried compiling the plugin myself and I think this error is the problem:

Text version:

/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(auth_negotiate.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(auth_ntlm.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(winhttp.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(openssl_dynamic.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(openssl_legacy.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(stransport.macos.editor.universal.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: for architecture: x86_64 file: thirdparty/bin/libgit2.a(pcre_string_utils.macos.editor.universal.o) has no symbols

Having the same issue, (arch) linux and repo hosted on codeberg

Same issue:

Remotes:

Codeberg (SSH)
GitHub (PAT)

Godot Git Plugin (4.0+)

v3.0.0

As an aside to the main issue, I might suggest that these error codes could be updated to only append the suggestion about PAT tokens in the case that the plugin observes that GitHub is the destination and an actual authentication failure occurs. Just to keep the errors themselves more focused on where the process actually failed.

Same issue with PAT on windows 11, godot 4.5.1 and godot git plugin 3.2.1

Do we know what causes this, and maybe some work around to get it working for a project?

I've found a workaround by setting SSL environment variables before launching Godot:

#!/bin/sh
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
exec /path/to/Godot

Tested on:

Pop!_OS 24.04 and Ubuntu 24.04
Godot v4.5.1 stable
Git plugin v3.2.1
Self-hosted GitLab CE 18.8.1 (with self-signed certificates)
HTTPS auth with PAT (SSH not tested)

The issue appears to be that libgit2's TLS backend (likely OpenSSL) doesn't find the system CA bundle at runtime. By setting these environment variables before Godot launches, OpenSSL reads them during initialization.
You can verify curl uses the same CA bundle:

curl -v https://example.com 2>&1 | grep "CAfile"
CAfile: /etc/ssl/certs/ca-certificates.crt

This suggests the bundled libgit2 was either:

Compiled with hardcoded certificate paths that don't match Ubuntu/Debian systems
Built without proper runtime certificate path detection
Using a TLS backend configuration that doesn't check standard Linux certificate locations

The plugin works fine on the same system when these environment variables are set, confirming it's a certificate path detection issue rather than a fundamental SSL problem.

Potential solutions:

Rebuild libgit2 with correct certificate paths for target distributions
Add runtime configuration option for users to specify CA bundle path (I'm working on a PR for this)
Have the plugin set these environment variables internally on Linux at startup

Have tested my PR (#316) on a Windows 10 and can confirm it resolves the SSL certificate issue.

Test Environment:

Windows 10 VM
Godot v4.6
Git plugin v3.2.1
Self-hosted GitLab CE 18.8.1 (with self-signed certificates)
HTTPS auth with PAT (SSH not tested)

Working Certificate Paths:
The following paths were tested and confirmed working:

C:/Program Files/Git/mingw64/etc/ssl/certs/ca-bundle.crt
C:/Program Files/Git/usr/ssl/certs/ca-bundle.crt

Path Format:
The PR now normalizes backslashes to forward slashes, so both formats work:

C:/Program Files/Git/usr/ssl/certs/ca-bundle.crt
C:\Program Files\Git\usr\ssl\certs\ca-bundle.crt

Git Backend Compatibility:
Tested with both Git for Windows installation options:

OpenSSL backend
Native Windows Secure Channel backend (default)

Both configurations work with the patched plugin, confirming the plugin uses its own bundled libgit2 with OpenSSL regardless of the system Git installation.

Additional Testing:
Also re-tested on Linux (Pop!_OS 24.04 and Ubuntu 24.04) with Godot 4.6 (upgraded from 4.5.1) - no issues found. This confirms the issue is within the plugin itself and independent of the Godot version.

Note: Other Windows certificate files/stores may work but have not been tested. The Git for Windows ca-bundle is the most reliable option as it's included with Git installation.

Have tested my PR (#316) on a Windows 10 and can confirm it resolves the SSL certificate issue...

I downloaded the plugin today and got the error. I had not gotten this error on my previous projects. Opening an old project (started about 1 month ago) that pushes to github with no error. After finding this thread and reviewing PR (#316) I noticed it was a change made a couple days ago. I deleted the most recent version and copied the month old version into my new project and the error is gone. I wasn't able to find the version number for the month old Godot Git Plugin, but today's version shows 3.2.1.

System info from Godot: Godot v4.5.stable - Windows 10 (build 19045) - Multi-window, 2 monitors - OpenGL 3 (Compatibility) - NVIDIA GeForce RTX 2060 (NVIDIA; 32.0.15.6636) - AMD Ryzen 7 3700X 8-Core Processor (16 threads) - 15.94 GiB memory

I appreciate the work the community does, and I hope this information helps moving forward.

Can confirm that v3.2.1 results in

GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -17: the SSL certificate is invalid in godot-git-plugin\src\git_plugin.cpp:GitPlugin::_fetch#L411

but using v3.1.1 of the plugin (thanks #317 (comment)) works with PAT just fine. Godot 4.6.1.

Same issue here. Self hosted git tea with a public address and valid SSL certs.

ERROR: core/variant/variant_utility.cpp:1024 - GitPlugin: Could not connect to remote "origin". Are your credentials correct? Try using a PAT token (in case you are using Github) as your password. Error -17: the SSL certificate is invalid in godot-git-plugin/src/git_plugin.cpp:_push#L533

I'm using Godot 4.6 on a windows machine.

I've seen the same issue with Git Plugin 3.2.1 and 3.2.0. I was unable to solve it.

When I reverted to 3.1.1, the issue was instantly resolved.

thanks to the persons* before me, yes guys anyone coming from the future going back to 3.1.1 of the godot git plugin instantly solves the problem, you wont be able to install it from AssetLib you need to download the zip file from the releases and export the folder to godot, note: it will look like "res://addons/godot-git-plugin"

Do we have a work around yet or fix for it on GitPlugin 3.2.1 ? im using MacOS

am also experiencing similar problems on windows 11

So is this plugin completely abandoned after pulling my teeth and my hair, not understanding why I was getting this error I find the plugin has been broken for 3 years, and it's still mentioned in the official docs as the way to do version control

So is this plugin completely abandoned after pulling my teeth and my hair

It's not abandoned. I plan to look into tagging a new release with all the recent fixes, then upload it to the Asset Store. I can't give a precise ETA, but hopefully, this should be done before 4.8.stable is out.

Navigation Menu

Repository navigation

Error -17: the SSL certificate is invalid #146

35 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Error -17: the SSL certificate is invalid #146

Description

Activity

yayito-dev commented on Mar 1, 2023

Jcodefox commented on Mar 11, 2023

soopermodel commented on Mar 22, 2023

soopermodel commented on Mar 29, 2023

Calinou commented on Mar 29, 2023

okhmedd commented on Mar 29, 2023

delcake commented on Apr 4, 2023

akasakakona commented on Apr 15, 2023

drakonicguy commented on Apr 27, 2023

singlerider commented on May 3, 2023

delcake commented on May 24, 2023

35 remaining items

Fluiding commented on Jan 1, 2026

oninoshiko commented on Jan 8, 2026

bananna-droid commented on Jan 26, 2026

bananna-droid commented on Jan 28, 2026

nightbat13131 commented on Jan 31, 2026

Amonimus commented on Mar 22, 2026

Shimo commented on Mar 25, 2026

DamienBlack commented on Apr 3, 2026

safithetomato commented on Apr 8, 2026

wedkemail commented on Aug 10, 2026

tinytachyon commented on Sep 3, 2026

dravpin commented on Oct 2, 2026

Calinou commented on Oct 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions