Turn SSL verification off for JGit clone command

Question

I am trying to a clone of a Git Repository via the CloneCommand. With this piece of code

`Git.cloneRepository().setDirectory(new File(path)).setURI(url).call();`

The remote repository is on a GitBlit Instance which uses self signed certificates. Because of these self signed certificates I get the below exception when the Fetch Part of the Clone is executing:

Caused by: java.security.cert.CertificateException: No name matching <hostName> found
    at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:221)
    at sun.security.util.HostnameChecker.match(HostnameChecker.java:95)

While I could create a new TrustManager, register a dummy HostnameVerifier and create and init a SSLContext that uses this dummy TrustManager. And after the clone is done revert all of this.

However this would mean that any other SSL connection that is initiated during the same time would expose them to unsecured connections.

On a already cloned repo you can set the http.sslVerify to false and JGit works perfectly fine.

Is there a cleaner way in which I could tell JGit to set this http.sslVerify to false for Clone action, like I can do for a already cloned repo.

Answer 1

Another workaround is to create a .gitconfig file in the home of the current user before calling Git.cloneRepository():

File file = new File(System.getProperty("user.home")+"/.gitconfig");
if(!file.exists()) {
    PrintWriter writer = new PrintWriter(file);
    writer.println("[http]");
    writer.println("sslverify = false");
    writer.close();
}

This will make JGit skip SSL certificate verification.