Hi Jon,
> 1) Why are there two ssl/certs trees? (e.g. - one is used by git-bash.exe
> and the other git-cmd.exe and cmd/git.exe?)
Please keep in mind that Git for Windows is a hybrid collection of pure Win32 executables and MSys2 executables (MSys2 is a stripped-down Cygwin providing a POSIX emulation layer on top of the Win32 API[*1*]). They are separated into the `/usr/` and the `/mingw64/` directories, respectively (`/mingw32/` for 32-bit). An example for a pure Win32 executable is `git.exe` while Perl and Bash are MSys2 executables. In general, we avoid MSys2 as much as possible: while it provides a nice POSIX emulation layer, it comes at a noticable performance penalty.
So whenever we can get away with using OpenSSL compiled as pure Win32 library, we do so. Cloning via HTTPS falls into that category.
When it comes to `git-svn` -- something that is needed by many users, still, and indeed the motivation for the most prolific contributor helping me with Git for Windows 2.x -- it is not that easy, though: `git-svn` is a Perl script, our Perl is an MSys2 program and therefore uses OpenSSL compiled as MSys2 library.
That is the reason why we have separate ssl/ directory structures. One for MinGW (i.e. pure Win32) programs and one for MSys2 ones.
> 2) Why are INSTALL_DIR/usr/ssl/certs/ca-bundle.crt and
> INSTALL_DIR/mingw64/ssl/certs/ca-bundle.crt different?
We simply use the packages provided by MSys2. The MinGW/MSys2 ca-certificates packages are sometimes out of sync, and that is what you are seeing here.
Now, theoretically it would be possible to reconcile the different ca-certificates packages into a single one. The correct way to go about this would be by contributing to the MSys2 project: that way, not only Git for Windows but really all MSys2-based projects benefit from it.
Ciao,
Johannes
Footnote *1*:
https://msys2.github.io/