GitKraken CA store fallback when system store lacks intermediate certificate
0 reputation · 22 Apr 2024, 03:21 UTC
Context
GitKraken validates HTTPS repository connections using the operating system's trusted root certificate store by default. Certain releases also ship a bundled CA certificate bundle, but the conditions under which the client switches to or supplements the system store with this bundle are not documented.
Unresolved behavior
When the system store contains a root CA but is missing an intermediate certificate required to complete the chain, it is unclear whether GitKraken automatically falls back to its bundled store to locate the missing intermediate. Observations across versions suggest the fallback logic may differ between releases and between the free Client and Pro/Enterprise editions.
Goal
Determine the exact certificate store selection algorithm GitKraken uses during TLS handshake for Git operations, specifically whether a bundled CA store serves as a fallback for missing intermediates, and whether this behavior is configurable or version-dependent.
Which GitKraken versions exhibit bundled-store fallback for missing intermediate certificates? Does the fallback occur only when the root is present in the system store but the intermediate is absent, or does it require the entire chain to be missing? Is there a configuration flag or environment variable that controls store priority?