Fixing depth_zero_self_signed_cert Error in SSL/TLS

What Does depth_zero_self_signed_cert Mean?

The error occurs when a server presents a self-signed certificate, and the client does not trust it because there is no certificate authority (CA) verifying it.

For the git-specific variant and related certificate topics, see depth_zero_self_signed_cert in cPanel for Git Operations and What is _globalsign-domain-verification?.

Common Causes:

• The server uses a self-signed SSL certificate.
• The certificate is missing in the trusted certificate store.
• Wrong certificate configuration on the server.
• The client is not set to trust self-signed certificates.

Verify the SSL Certificate

Run:

openssl s_client -connect yourdomain.com:443 -showcerts

Expected output (if self-signed):

verify error:num=18:self-signed certificate
verify return:1
verify error:num=19:self-signed certificate in certificate chain
verify return:1

If you see depth=0, it means the certificate is not trusted.

Fixing the Issue Based on Your Use Case

If Using a Self-Signed Certificate on a Server

Solution: Add the certificate to the system's trusted store.

For Debian/Ubuntu

sudo cp your_certificate.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

For CentOS/RHEL

sudo cp your_certificate.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Restart your server:

sudo systemctl restart apache2

or

sudo systemctl restart nginx

If You Want to Ignore Self-Signed Certificate in a Client

For curl

Run:

curl -k https://yourdomain.com

-k or --insecure tells curl to ignore SSL verification.

For Node.js

Set:

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Not recommended for production (security risk).

For Git

If you see:

fatal: unable to access 'https://yourdomain.com/repo.git/': SSL certificate problem: self signed certificate

Run:

git config --global http.sslVerify false

or add the certificate manually:

git config --global http.sslCAInfo /path/to/certificate.crt

If You Need a Valid SSL Certificate

Instead of using a self-signed certificate, get a free SSL certificate from Let's Encrypt.

For Apache

sudo apt install certbot python3-certbot-apache
sudo certbot --apache

For Nginx

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx

Summary of Fixes

Now you know how to fix depth_zero_self_signed_cert for different scenarios!