If you run this command on Windows:

1

llama-cli -hf unsloth/gemma-4-E4B-it-GGUF

and see an error like this:

1
2

get_repo_commit: error: HTTPLIB failed: SSL server verification failed
error: failed to download model from Hugging Face

the problem is usually not CUDA or llama.cpp itself. More often, the program cannot correctly access the system certificate chain in the current environment, so HTTPS verification fails.

From the log, ggml-rpc.dll and ggml-cpu-alderlake.dll were loaded successfully, which means the runtime environment is mostly fine. The issue is mainly in the model download step.

The easiest workaround: download the model manually

If you just want to get it running quickly, downloading the model manually is usually the most stable option.

1. Open the matching Hugging Face repository page.
2. Download the required .gguf file from Files and versions.
3. After the download finishes, run it with the local file path:

1

llama-cli -m C:\Users\knightli\Downloads\gemma-4-e4b-it.gguf

This bypasses SSL verification during the -hf download step and is useful when you only want to verify that the model can run locally.

If you still want to use -hf automatic download

You can manually specify a certificate file path so the program can find a usable CA bundle in the current session.

cacert.pem can be obtained from the CA Extract page maintained by the curl project:

• Page: https://curl.se/docs/caextract.html
• Direct download: https://curl.se/ca/cacert.pem

If you download it in a browser, open the direct download link and save it as cacert.pem. You can also download it to a fixed directory with PowerShell:

1
2

New-Item -ItemType Directory -Force C:\certs
Invoke-WebRequest -Uri https://curl.se/ca/cacert.pem -OutFile C:\certs\cacert.pem

After the download finishes, set these variables in the command line:

1
2

set SSL_CERT_FILE=C:\certs\cacert.pem
set CURL_CA_BUNDLE=C:\certs\cacert.pem

Then run the original command again:

1

llama-cli -hf unsloth/gemma-4-E4B-it-GGUF

If the issue really comes from the certificate chain, this usually fixes it directly.