基于VonC给出的非常好的答案，我刚刚创建了一个bash脚本，将缺失的x509证书安装到证书包中。它适用于基于debian的linux发行版。

#!/bin/bash

CERTIFICATE_PEM=certificate.pem
CERTIFICATE_CRT=certificate.crt

# get certificate
echo -n | openssl s_client -showcerts -connect gitlab.sehlat.io:443 \
  2>/dev/null  | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' \
  > $CERTIFICATE_PEM

# format certificate from PEM (human-readable) to CRT
openssl x509 -in $CERTIFICATE_PEM -out $CERTIFICATE_CRT

# move it to ca-certificates folder & update the bundle file
sudo mv ./$CERTIFICATE_CRT /usr/local/share/ca-certificates/
sudo update-ca-certificates

# configuring git
git config --global http.sslCAinfo /etc/ssl/certs/ca-certificates.crt

当我试图在Dockerfile中克隆git时，我的工作是获取SSL证书并将其添加到本地证书列表:

openssl s_client -showcerts -servername git.mycompany.com -connect git.mycompany.com:443 </dev/null 2>/dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p'  > git-mycompany-com.pem

cat git-mycompany-com.pem | sudo tee -a /etc/ssl/certs/ca-certificates.crt

学分:https://fabianlee.org/2019/01/28/git-client-error-server-certificate-verification-failed/

我刚刚遇到了非常相同的问题，一个git存储库，这总是为我工作。问题是我通过公共WiFi访问它，它会在第一次连接时重定向到专用门户(例如显示广告并同意tos)。

注意:这具有重大的安全影响。

如果您在专用网络中使用git服务器，并使用自签名证书或IP地址证书;你也可以简单地使用git全局配置来禁用SSL检查:

git config --global http.sslverify "false"

或者简单地运行这个注释来添加服务器证书到你的数据库:

echo $(echo -n | openssl s_client -showcerts -connect yourserver.com:YourHttpGilabPort 2>/dev/null  | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p') >> /etc/ssl/certs/ca-certificates.crt

然后再做git克隆。

我知道已经有很多答案了。对于那些使用专用网络(如Zscaler等)的用户来说，如果需要更新rootcert，则可能会出现此错误。如果在Windows机器上使用WSL，这里有一个关于如何实现此更新的解决方案:

#!/usr/bin/bash

# I exported the Zscaler certifcate out of Microsoft Cert Manager.  It was located under 'Trusted Root Certification > Certificates' as zscaler_cert.cer.
# Though the extension is '.cer' it really is a DER formatted file.
# I then copied that file into Ubuntu running in WSL.

# Convert DER encoded file to CRT.
openssl x509 -inform DER -in zscaler_cert.cer -out zscaler_cert.crt

# Move the CRT file to /usr/local/share/ca-certificates
sudo mv zscaler_cert.crt /usr/local/share/ca-certificates

# Inform Ubuntu of new cert.
sudo update-ca-certificates