Set Up SSL CA Certificates for Various Git Providers on IBM i

git_ssl_setup.sh

#!/QOpenSys/usr/bin/ksh

set -e

export LC_ALL=C LANG=C

OPENSSL=$(which openssl 2> /dev/null)
if [ "$OPENSSL" = "" ]
then
  echo "openssl not found"
  exit 1
elif [ "$OPENSSL" = '/QOpenSys/usr/bin/openssl' ]
then
  case $(uname -v)$(uname -r) in
    [1-6]*) echo "Sorry, these releases are not supported"; exit 1 ;;
    
    71) CERTDIR=/QOpenSys/QIBM/ProdData/SC1/OpenSSL/openssl-0.9.8j/certs ;;
    *)  CERTDIR=/QOpenSys/QIBM/ProdData/SC1/OpenSSL/certs ;;
  esac
else 
  CERTDIR=/QOpenSys/etc/ssl/certs
fi

C_REHASH=$(dirname $OPENSSL)/c_rehash

PERL=$(which perl 2> /dev/null)
if [ "$PERL" = "" ]
then
  echo "perl not found"
  exit 1
fi

if which curl > /dev/null 2>&1
then
  CURL='curl --insecure --silent --location'
elif which wget > /dev/null 2>&1
then
  CURL='wget --no-check-certificate -qO-'
else
  echo "You need to install either curl or wget. Perhaps they're just not in your PATH?"
  exit 1
fi

# Create a directory to hold certificates
if [ "$CERTTMP" = "" ]
then
  CERTTMP=/tmp/certs.$$
  rm -r $CERTTMP > /dev/null 2>&1 || :
  mkdir -p $CERTTMP
  CLEANUP=Y
fi

# GitHub and BitBucket uses DigiCert certificates
# Downloaded from https://www.digicert.com/digicert-root-certificates.htm      
for cert in DigiCertHighAssuranceEVRootCA DigiCertSHA2ExtendedValidationServerCA GeoTrustRSACA2018 DigiCertGlobalRootCA
do
  $CURL https://www.digicert.com/CACerts/$cert.crt | openssl x509 -inform der -out $CERTTMP/$cert.pem
done

# GitLab uses Comodo certificates
$CURL "https://support.comodo.com/index.php?/Knowledgebase/Article/GetAttachment/970/821027" > $CERTTMP/comodorsadomainvalidationsecureserverca.crt
$CURL "https://support.comodo.com/index.php?/Knowledgebase/Article/GetAttachment/969/821026" > $CERTTMP/comodorsacertificationauthority.crt

# Let's Encrypt certificates
for cert in isrgrootx1 letsencryptauthorityx3
do
  $CURL https://letsencrypt.org/certs/$cert.pem.txt > $CERTTMP/$cert.pem
done

$PERL $C_REHASH $CERTTMP

/QOpenSys/usr/bin/cp -h $CERTTMP/* $CERTDIR

# Clean up if necessary
if [ "CLEANUP" = "Y" ]
then
  rm -r $CERTTMP
fi

I used kadler's script and am able to work with github with one exception: the dotsync repo.

Had to turn off SSL validation for that:
git config --global http.sslVerify false

The certs looked fine though.. can't figure out why it errorred. Here's the error I was getting:

$ git clone https://github.com/dotphiles/dotsync
Cloning into 'dotsync'...
fatal: unable to access 'https://github.com/dotphiles/dotsync/': Unknown SSL protocol error in connection to github.com:443