DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 61RAZQ7P1596668
Authentication-Results: delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com
Authentication-Results: delorie.com; spf=pass smtp.mailfrom=cygwin.com
DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 61RAZQ7P1596668
Authentication-Results: delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=Zrah13ex
X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 96D5A4BA23FC
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1772188525;
	bh=zVzAesW6htrddek/F/soaUeZhGrGX18jujPgiATQ2cg=;
	h=Date:To:Subject:In-Reply-To:References:List-Id:List-Unsubscribe:
	 List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:
	 From;
	b=Zrah13exOZ+ALWm9DRGIBKNSBbtsVtdlayHSS1h9nkwxY97A+M8cKhlgDHOgUdnFr
	 AIrwwSK0A7O+FO32teAiFWtgdaYDbRpjnkFYInVgilvAStN0sUm0JEZ0g7/z5B1Bed
	 8efsaxrAmtpGk0Ep5TOjbotyYbeS47kn2J5TBLeg=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 8353E4BA2E10
ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 8353E4BA2E10
ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1772188507; cv=none;
 b=fBCOUy0XJ3pcRc/bmHrHztWgEO2QIdoWqLf3XQSN9qmLJJH7HAJb++igkt4C+naIZQc+6IIyUBDiWwWTboudv81rs8Z5HqVAiQfUhW166EZOsRyqx8euMYnFwSTyPjcxM1LVsfb07IIobonolHgExa/yXO8KeD+92erDm+2RUS4=
ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key;
 t=1772188507; c=relaxed/simple;
 bh=k+rBEanHsAidaJ0yWuQKUbOe1OEfq96tf76iEjE+SUk=;
 h=DKIM-Signature:Date:From:Message-ID:To:Subject:MIME-Version;
 b=qB6eD3CAepk1Ss+USTfRLXoyYIpBFy1fX9XCjnyZjPR5n25BzAiQGYgG13grxtTig9AvMuOMhHeHBz2HszeS1rQTIzPYw+reTA13JkRM5j3yJ2uhOYZZ6uAOPsCqcTzpOBf7dLI8Sbi+WC+9SJ1sZGDycTudEIdMhBaYTuNIJ3s=
ARC-Authentication-Results: i=1; server2.sourceware.org
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8353E4BA2E10
X-Yandex-Fwd: 1
Date: Fri, 27 Feb 2026 13:33:06 +0300
X-Mailer: The Bat! (v11.4.3) Home
Message-ID: <1224869501.20260227133306@yandex.ru>
To: =?utf-8?B?5b6Q5oyB5oGSIFh1IENoaWhlbmc=?= <chiheng DOT xu AT gmail DOT com>,
        cygwin AT cygwin DOT com
Subject: Re: The file /etc/pki/tls/certs/ca-bundle.crt is empty
In-Reply-To: <CAPOVtOu6NVYeXrtX0D9NdarGZcUu-xP=3Ykb7WztpG-Be44Hkw@mail.gmail.com>
References: <CAPOVtOu6NVYeXrtX0D9NdarGZcUu-xP=3Ykb7WztpG-Be44Hkw AT mail DOT gmail DOT com>
MIME-Version: 1.0
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Andrey Repin via Cygwin <cygwin AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
Cc: Andrey Repin <anrdaemon AT yandex DOT ru>
Content-Type: text/plain; charset="utf-8"
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 61RAZQ7P1596668

Greetings, 徐持恒 Xu Chiheng!

> # file /etc/pki/tls/certs/ca-bundle.crt
> /etc/pki/tls/certs/ca-bundle.crt: symbolic link to
> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

> # git clone https://gitlab.com/qemu-project/qemu.git
> Cloning into 'qemu'...
> fatal: unable to access 'https://gitlab.com/qemu-project/qemu.git/':
> error adding trust anchors from file: /etc/pki/tls/certs/ca-bundle.crt

> This will cause curl and git not be able to download https urls, and
> will let git build fail to produce a usable git.

> # git clone https://gitlab.com/qemu-project/qemu.git
> Cloning into 'qemu'...
> warning: templates not found in
> /cygdrive/e/Note/Tool/git-cygwin-clang-bfd-release-install/share/git-core/templates
> git: 'remote-https' is not a git command. See 'git --help'.
> fatal: remote helper 'https' aborted session

> Temporary fix(link to a previous working tls-ca-bundle.pem) :
> https://github.com/xu-chiheng/Note/blob/main/.bashrc.d/quirk.sh#L125
> fix_cygwin_tls_certs() {
>     local source=/etc/pki/tls/certs/ca-bundle.crt
>     local target=~/Util/tls-ca-bundle.pem
>     if ! { [ -e "${source}" ] && [ "$(readlink -f "${source}")" =
> "$(readlink -f "${target}")" ] ;}; then
>         rm -rf "${source}" \
>         && ln -s "${target}" "${source}"
>     fi
> }

This likely have a different cause.
Check if your /etc/ssl/certs is empty. If so,
try this command with elevated shell:

/usr/bin/trust extract --format=openssl-bundle --filter=certificates --overwrite --comment /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt



-- 
With best regards,
Andrey Repin
Friday, February 27, 2026 13:28:50

Sorry for my terrible english...

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple