fatal: unable to access 'https://git.example.com/team/app.git/': SSL: certificate subject name (www.example.com) does not match target hostname 'git.example.com'

The names in parentheses and quotes come from your certificate and your remote URL. libcurl 7.x printed "target host name", libcurl 8.x prints "target hostname". OpenSSL builds of git (Git for Windows, Alpine) print "SSL: no alternative certificate subject name matches target hostname '…'".

What it means

The Git server's certificate is trusted, but it is issued for a different name than the host in the remote URL. libcurl-gnutls quotes the certificate's subject name in parentheses and the host git connected to at the end. Credentials were not sent: the connection stops before any HTTP request.

Why it happens

• The certificate does not list the Git host's name

  common

  A Git server moved to a new name (git.example.com instead of gitlab.example.com) or added a second name without reissuing the certificate.

• The remote URL uses an alias or IP address

  common

  Clones made with an internal alias, an IP address or an old hostname keep that URL in .git/config long after the certificate was issued for the canonical name.

• The proxy in front of the Git server sends its default certificate

  occasional

  A reverse proxy or ingress without a rule for the requested name presents the certificate of another virtual host.

How to fix it

1. 1.

   Compare the remote URL with the certificate

   Print the remote URL and the certificate's subject and SAN list; the mismatch is usually obvious.

   git remote get-url origin
   echo | openssl s_client -connect git.example.com:443 -servername git.example.com 2>/dev/null \
     | openssl x509 -noout -subject -ext subjectAltName

2. 2.

   Point the remote at a name the certificate covers

   git remote set-url changes the URL stored in the repository's configuration without re-cloning.

   # Use the name the certificate was issued for
   git remote set-url origin https://gitlab.example.com/team/app.git

3. 3.

   Server owners: issue the certificate for the advertised name

   Make the certificate's SAN list match the URL the Git server advertises for clones (GitLab's external_url, Gitea's ROOT_URL), so users copy URLs that verify.

   # GitLab Omnibus: the external URL decides the certificate name and the clone URLs
   external_url "https://git.example.com"
   # then: sudo gitlab-ctl reconfigure

← Browse the full signature error database