How can I configure Git to use a custom DNS resolver and a specific CA certificate for HTTPS remotes behind an intercepting proxy?
0 reputation · 12 Dec 2025, 05:22 UTC
When cloning or fetching from an HTTPS repository through a corporate proxy that performs SSL interception, Git sometimes fails to verify the server’s certificate because the proxy presents its own CA‑signed certificate. At the same time, the internal DNS used to resolve the repository host differs from the system DNS, causing Git to connect to the wrong address or to experience intermittent resolution failures. I need a way to tell Git to use a specific DNS resolver (e.g., a local forwarding proxy or a custom /etc/hosts‑like mapping) for a particular remote while also supplying the proxy’s root CA so that SSL verification succeeds, without altering global system settings.
Which configuration variables control Git’s DNS lookup process for HTTPS remotes, and how can they be combined with http.sslCAInfo or related SSL options to achieve per‑remote DNS and certificate handling? Is it possible to specify a custom DNS resolver via core.gitProxy or http.proxy, and if so, what format should the proxy command take?
git