在git for Windows的最新更新(事实上,我进行了新安装)之后,我无法再通过https连接到特定的远程存储库。它位于使用
自签名证书也已过期一段时间
它曾与git for Windows 2.16.x(iirc)配合使用,并继续与cygwin和mysys2(分别报告版本2.17.0和2.20.1)中的并行安装配合使用。
以下是我尝试过的(不是同时尝试的):
-
我已经设置了配置选项
http.sslverify=false
git config -l --show-origin
并证实了这一切都不是真的。特别是在本地repo的.git/config中,它应该覆盖任何默认或显式的系统或全局设置,这是错误的。
-
我换了房间
http.sslbackend
选择
sChannel
然后回到
openssl
夏奈尔
无法完全阻止该机制检查证书,所以我想确保我没有意外地仍在使用它。(显然,这是新安装中的默认机制。)
-
我还下载了证书,并通过编辑指示openssl使用它
~/.ssl/config
; 不幸的是,这只会导致git(或者更确切地说,openssl)以证书过期为由拒绝证书。
-
我将环境变量GIT_SSL_NO_VERIFY设置为“true”,它将覆盖所有配置设置。
-
GIT_TRACE_CURL=path
,
GIT_TRACE
和
GIT_CURL_VERBOSE
要获得调试输出,除了openssl尝试验证证书但失败之外,没有显示任何令人惊讶的内容,只要它尝试验证证书,这是正确的。例如,跟踪文件将包含该行
Info: SSL certificate problem: self signed certificate
其他git(分别是openssl)安装似乎跳过了整个证书检查,尽管这是我们在这种情况下所需要的。
这是虫子吗?有什么想法吗?
编辑:该问题与https代理设置有关。在我的环境中,我使用HTTPS代理,但必须直接访问repo服务器。我有https\u代理,但没有为此设置任何\u代理变量。为了排除我使用的所有其他环境设置
env -i
garbage
部件为文字,以表明它不是有效的主机):
git config -l |grep -i ssl
http.sslverify=false
http.sslverify=false
http.sslverify=false
http.sslverify=false
http.sslbackend=openssl
env -i PATH="$PATH" GIT_CURL_VERBOSE=1 GIT_TRACE=2 no_proxy="[repo host FQDN]"
https_proxy="https://garbage"
git fetch
16:41:53.953829 exec-cmd.c:236 trace: resolved executable dir: D:/Programs/Git/mingw64/bin
16:41:53.955829 git.c:418 trace: built-in: git fetch
16:41:53.980831 run-command.c:643 trace: run_command: GIT_DIR=.git git remote-https origin
https://[FQDN/path-to-git]
16:41:54.001834 exec-cmd.c:236 trace: resolved executable dir: D:/Programs/Git/mingw64/libexec/git-core
16:41:54.003834 git.c:675 trace: exec: git-remote-https origin
https://[FQDN/path-to-git]
16:41:54.003834 run-command.c:643 trace: run_command: git-remote-https origin
https://[FQDN/path-to-git]
16:41:54.028836 exec-cmd.c:236 trace: resolved executable dir: D:/Programs/Git/mingw64/libexec/git-core
* Couldn't find host [repo host FQDN] in the _netrc file; using defaults
* Trying [repo host IP address]...
* TCP_NODELAY set
* Connected to [repo host FQDN] ([repo host IP address]) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: D:/Programs/Git/mingw64/ssl/certs/ca-bundle.crt
CApath: none
* SSL certificate problem: self signed certificate
* Closing connection 0
fatal: unable to access '
https://[FQDN/path-to-git]
': SSL certificate problem: self signed certificate
如果
https_proxy
https://
CApath: none
,除了curl承认
no_proxy
env -i PATH="$PATH" GIT_CURL_VERBOSE=1 GIT_TRACE=2 no_proxy="[repo host FQDN]"
https_proxy=""
git fetch
17:04:56.884616 exec-cmd.c:236 trace: resolved executable dir: D:/Programs/Git/mingw64/bin
17:04:56.886616 git.c:418 trace: built-in: git fetch
17:04:56.911616 run-command.c:643 trace: run_command: GIT_DIR=.git git remote-https origin
https://[FQDN/path-to-git]
17:04:56.931616 exec-cmd.c:236 trace: resolved executable dir: D:/Programs/Git/mingw64/libexec/git-core
17:04:56.932616 git.c:675 trace: exec: git-remote-https origin
https://[FQDN/path-to-git]
17:04:56.932616 run-command.c:643 trace: run_command: git-remote-https origin
https://[FQDN/path-to-git]
17:04:56.957616 exec-cmd.c:236 trace: resolved executable dir: D:/Programs/Git/mingw64/libexec/git-core
*
Uses proxy env variable no_proxy == '[repo host FQDN]'
* Couldn't find host [repo host FQDN] in the _netrc file; using defaults
* Trying [repo host IP address]...
* TCP_NODELAY set
* Connected to [repo host FQDN] ([repo host IP address]) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: D:/Programs/Git/mingw64/ssl/certs/ca-bundle.crt
CApath: none
*
SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
[... certificate details incl. past expiration date; successful communication]
