Git push on Windows: safe.directory "not absolute" warnings and OpenSSL certificate errors – Support | JetBrains

Problem

Git push from a JetBrains IDE (PhpStorm, IntelliJ IDEA, GoLand, WebStorm, etc.) on Windows produces one or both of the following outputs, sometimes on the same push:

warning: safe.directory ''%(prefix)///192.0.2.2/share/other-project'' not absolute
warning: safe.directory ''%(prefix)///192.0.2.2/share/other-project/subdir'' not absolute
...
fatal: unable to access 'https://git.example.com/repo.git/': SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)

The safe.directory warnings reference paths from a different project than the one being pushed, often a project on the same SMB / UNC share. The OpenSSL error appears against a remote whose certificate validates correctly in the browser and via openssl s_client.

These are two independent Git-level problems. The warnings are noise from stale .gitconfig entries and do not block the push; the fatal: OpenSSL error is what actually stops it.

Cause

safe.directory ... not absolute warnings. After Git introduced the "dubious ownership" check (Git 2.35+), it prints a suggested fix such as git config --global --add safe.directory '%(prefix)///host/share/path'. When that command is pasted verbatim into PowerShell, the single quotes are preserved as part of the value rather than being stripped by the shell. The literal quotes end up stored inside the value in %USERPROFILE%\.gitconfig, so subsequent Git commands can no longer parse the entries and report each of them as "not absolute". The entries remain in the global config even after moving to a different project on the same share, so they surface as noise on unrelated push operations.

OpenSSL "unable to get local issuer certificate (20)". Git for Windows uses its own CA bundle (mingw64/ssl/certs/ca-bundle.crt) independent of the Windows certificate store used by Chrome and most other applications. A working chain in Chrome or in system openssl therefore does not guarantee that Git can verify the same server. Typical triggers on a machine where the push previously worked:

A Git for Windows upgrade replaced the CA bundle with one that does not include the current chain (common for Let's Encrypt after root rotations).
http.sslCAInfo in a Git config points at a moved or missing file.
http.sslBackend has been switched to schannel, and the Windows store the backend consults does not include the issuer.

Resolution

Clean up the safe.directory warnings

Open %USERPROFILE%\.gitconfig in a text editor.
In the [safe] section, locate directory = '...' lines that reference paths from unrelated projects.
Either delete the stale lines, or remove the outer single quotes from each directory = '<value>' so the value becomes directory = <value>.
Save the file.

Alternative — clear all entries and whitelist any repository (use double quotes to avoid the same PowerShell quoting problem):

git config --global --unset-all safe.directory
git config --global --add safe.directory "*"

Verify the entries no longer produce warnings:

git config --get-all safe.directory

Fix the OpenSSL certificate error

Identify which Git the IDE is using: Settings | Version Control | Git → Path to Git executable.
Check the current SSL configuration:
```
git --version
git config --list --show-origin | findstr /i ssl
```
Note the values of http.sslCAInfo and http.sslBackend, and which config file they come from.
Fetch the current PEM chain the remote actually presents (from any machine with openssl installed):
```
openssl s_client -servername git.example.com -connect git.example.com:443 -showcerts
```
Copy every -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- block from the output.
Append those PEM blocks to the CA bundle Git is using. The default path for the bundled Git on Windows is C:\Program Files\Git\mingw64\ssl\certs\ca-bundle.crt; the file git config --list --show-origin reported for http.sslCAInfo (if set) overrides that default.
Retry the push. If the error persists after editing the bundle, confirm the SSL backend is OpenSSL rather than schannel:
```
git config --global http.sslBackend openssl
```

Background on obtaining the Let's Encrypt root and intermediate certificates: Where can I download the trusted root CA certificates for Let's Encrypt.