Julia certificate error

Question

I'm trying to get Julia 0.6.0 working from behind our corporate firewall which uses a self signed certificate to authenticate. So far I have been unable to find the correct incantation to convince julia/gitlib2 that the certificate is OK even though it is self signed. I'm on CentOS if that makes a difference.

The following error occurs no matter what I've tried.

INFO: Initializing package repository /home/tannerww/.julia/v0.6
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, SSL error: ffffd900[10008] - X509 - Certificate verification failed, e.g. CRL, CA or signature check failed)
Stacktrace:
 [1] macro expansion at ./libgit2/error.jl:99 [inlined]
 [2] clone(::String, ::String, ::Base.LibGit2.CloneOptions) at ./libgit2/repository.jl:276
 [3] #clone#100(::String, ::Bool, ::Ptr{Void}, ::Nullable{Base.LibGit2.AbstractCredentials}, ::Function, ::String, ::String) at ./libgit2/libgit2.jl:562
 [4] (::Base.LibGit2.#kw##clone)(::Array{Any,1}, ::Base.LibGit2.#clone, ::String, ::String) at ./<missing>:0
 [5] (::Base.Pkg.Dir.##8#10{String,String})() at ./pkg/dir.jl:55
 [6] cd(::Base.Pkg.Dir.##8#10{String,String}, ::String) at ./file.jl:70
 [7] init(::String, ::String) at ./pkg/dir.jl:53
 [8] #cd#1(::Array{Any,1}, ::Function, ::Function, ::String, ::Vararg{String,N} where N) at ./pkg/dir.jl:28
 [9] add(::String) at ./pkg/pkg.jl:117

I've tried a few other things but so far nothing has had any affect. I've set sslCert and sslCAInfo in gitconfig to point the certs file with our corporate cert added in. I've set sslVerify=false in gitconfig also but that seems to be ignored by GitLib2.

On the julia side, I found the GitLib2.ProxyOptions struct which contains a certificate_cb function which is called when validation fails. I haven't yet figured out how to set the callback so it is globally used. If I can do that, I can at least work around the problem (maybe).

At this point I'm lost as to what to try next.

Answer 1

LibGit2.set_ssl_cert_locations didn't work for me, but I was able to get it working by setting the environment variable SSL_CERT_FILE, eg, adding the following to my .bashrc:

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt