GitKraken CA store fallback when system store lacks intermediate certificate

Short answer

There is no documented, confirmed store-selection algorithm for GitKraken, so the honest answer to the exact question is: it is not publicly established which versions (if any) fall back to a bundled CA store for missing intermediates, what triggers such a fallback, or whether a configuration flag controls it. Anyone claiming a specific version exhibits a specific fallback trigger without packet-level or source-level evidence is speculating. What follows separates what is well-established from what remains open, and gives you a way to answer the question for your own installation.

What is well-established

GitKraken is an Electron/Node.js application that performs Git operations through libgit2 (historically via NodeGit). TLS validation for fetch, push, and clone therefore goes through libgit2's transport backend, not through a GitKraken-specific certificate layer. Which trust store gets consulted depends on the backend the build uses:

• Windows: libgit2 builds commonly use Schannel, which does its own chain building and can fetch missing intermediates automatically via the certificate's AIA (Authority Information Access) URL. On such a build, a "missing intermediate" can resolve with no bundled-store involvement at all.
• macOS: Secure Transport similarly performs its own chain evaluation against the system keychain.
• Linux: OpenSSL against the distribution's CA bundle is typical.

A bundled CA bundle, when a client ships one, normally serves as the default set of trust anchors — not as a per-handshake fallback consulted only when an intermediate is absent. Intermediates are expected to be delivered by the server during the TLS handshake. A server that omits its intermediate is misconfigured, and the robust fix is correcting the server chain or installing the intermediate into the OS store — not relying on undocumented client behavior.

What remains unconfirmed

• Whether any GitKraken release supplements the system store with a bundled bundle mid-handshake.
• Whether behavior differs between the free Client and Pro/Enterprise editions — there is no confirmed evidence of edition-specific TLS internals, so treat that hypothesis as unproven.
• Whether GitKraken surfaces equivalents of Git's http.sslCAInfo or http.sslBackend settings. Check your version's preferences and config files rather than assuming.

How to determine the behavior on your installation

1. Reproduce against an incomplete-chain endpoint. Point GitKraken at a host that serves its leaf certificate without the intermediate (public incomplete-chain test endpoints exist, or stage one internally). Independently verify the chain gap with:

   openssl s_client -connect host:443 -servername host -showcerts

   If OpenSSL reports an inability to verify the chain but GitKraken connects, something beyond a strict system-store check is happening — Schannel AIA fetching or a bundled store are the candidates.
2. Identify the TLS backend. Inspect the bundled libgit2/NodeGit binaries in the installation directory, or ask GitKraken support which backend your platform build uses. On Windows, if it is Schannel, "fallback" observations are most likely AIA retrieval, not a bundled store.
3. Diff across versions. Repeat the same test on the two versions you observed differing. Identical server, identical network — only the client version changes.
4. Ask support directly. Because the algorithm is undocumented, GitKraken support is the only authoritative source for whether a bundled store exists and how it is prioritized.

What not to do

Do not disable SSL verification to work around chain errors — that removes protection against man-in-the-middle attacks. If you are blocked today, install the missing intermediate into the OS trust store or fix the server to send the full chain; both are safe, scoped, and version-independent.

Bottom line

The version-specific fallback matrix you are asking for does not exist in public documentation, and platform TLS backends (especially Schannel's AIA fetching) can mimic fallback behavior. Run the incomplete-chain test on your exact versions and confirm the backend before attributing anything to a bundled store — and treat this draft's open points as requiring verification against your environment.