{"thread":{"id":"24215","subject":"git access using SSL certificates","startedAt":"2010-06-28T14:54:44Z","lastAt":"2010-06-29T00:46:31Z","messageCount":5,"participants":["Shantanu Pavgi","Ilari Liusvaara"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"144387","messageId":"CB7586D8-2C18-4BE9-9B32-3D02AA5F37ED@uab.edu","threadId":"24215","inReplyTo":null,"subject":"git access using SSL certificates","fromName":"Shantanu Pavgi","fromEmail":"pavgi@uab.edu","sentAt":"2010-06-28T14:54:44Z","receivedAt":"2010-06-28T14:54:44Z","isPatch":false,"sender":{"key":"pavgi@uab.edu","avatar":null},"body":"\nHi,\n\nI have configured a bare Git repository over HTTPS and client needs to have a SSL certificate-key to access the repository. I am able to access this repository using Firefox by loading client certificate in the Firefox, but it is not working with git command line client. \n\nI tried setting http.sslCert and http.sslKey configuration options, but it is not working. Following were steps in accessing the repository. Am I missing something in my configuration? Any pointers on how to share git using SSL certificates would be really helpful. \n\nThanks,\nShantanu. \n\n\n* Try git-clone using HTTPS without client certs \n{{{\nmercury:tempgit-ssh2 shantanu$ git clone https://condor-node2.lab.ac.uab.edu/git/fifa2010 --verbose\nInitialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/\nerror: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs\n\nfatal: HTTP request failed\n}}}\n\n* Try git-clone using ssh\n{{{\nmercury:tempgit-ssh2 shantanu$ git clone ssh://ssp@condor-node2.lab.ac.uab.edu/srv/gitpubrepos/fifa2010 --verbose\nInitialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/\nssp@condor-node2.lab.ac.uab.edu's password: \nremote: Counting objects: 7, done.\nremote: Compressing objects: 100% (4/4), done.\nremote: Total 7 (delta 0), reused 0 (delta 0)\nReceiving objects: 100% (7/7), done.\n}}}\n\n* Change git remote url \n{{{\nmercury:fifa2010 shantanu$ git remote rm origin\nmercury:fifa2010 shantanu$ git remote add origin https://condor-node2.lab.ac.uab.edu/git/fifa2010 \n}}}\n\n* Try git-pull with HTTPS without certs \n{{{\nmercury:fifa2010 shantanu$ git pull\nerror: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs\n\nfatal: HTTP request failed\n}}}\n\n* Try git-pull using certificates \n{{{\nmercury:fifa2010 shantanu$ git config http.sslCert ~/Desktop/certs/usercerts/bob-svn/ssp.crt \nmercury:fifa2010 shantanu$ git config http.sslKey ~/Desktop/certs/usercerts/bob-svn/ssp.key \nmercury:fifa2010 shantanu$ git pull\nerror: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs\n\nfatal: HTTP request failed\n}}}\n"},{"id":"144412","messageId":"16FCDB06-9C82-4CBF-BD25-A10BD3E829DE@uab.edu","threadId":"24215","inReplyTo":"CB7586D8-2C18-4BE9-9B32-3D02AA5F37ED@uab.edu","subject":"Re: git access using SSL certificates","fromName":"Shantanu Pavgi","fromEmail":"pavgi@uab.edu","sentAt":"2010-06-28T20:23:30Z","receivedAt":"2010-06-28T20:23:30Z","isPatch":false,"sender":{"key":"pavgi@uab.edu","avatar":null},"body":"\nForgot to mention version info in my earlier email: \nServer/Public repo: CentOS 5.4 with Git 1.7.1 installed from source \nClient in earlier mail: Mac OS X 10.6 Git 1.6.5.2 \n\nOn Mac  git-push: \n{{{\nmercury:fifa2010 shantanu$ git push --verbose\nPushing to https://condor-node2.lab.ac.uab.edu/git/fifa2010\nerror: Cannot access URL https://condor-node2.lab.ac.uab.edu/git/fifa2010/, return code 52\nerror: failed to push some refs to 'https://condor-node2.lab.ac.uab.edu/git/fifa2010'\n}}}\n\nOn Debian with Git 1.5.6.5:\ngit-push\n{{{\natlab@debian:~/fifa2010$ git push\nerror: Cannot access URL https://condor-node2.lab.ac.uab.edu/git/fifa2010/, return code 52\nerror: failed to push some refs to 'https://condor-node2.lab.ac.uab.edu/git/fifa2010'\n}}}\n\nOn Debian with Git 1.5.6.5: \ngit-pull \n{{{\natlab@debian:~/fifa2010$ git pull origin master\nerror: GnuTLS recv error (-12): A TLS fatal alert has been received.\nfatal: Couldn't find remote ref master\n}}}\n\nIt works on the same server system (CentOS 5.4 Git 1.7.1) using SSL certificates though.   \n\nAny help/suggestions?  \n\n--\nThanks,\nShantanu. \n \n\nOn Jun 28, 2010, at 9:54 AM, Shantanu Pavgi wrote:\n\n> \n> Hi,\n> \n> I have configured a bare Git repository over HTTPS and client needs to have a SSL certificate-key to access the repository. I am able to access this repository using Firefox by loading client certificate in the Firefox, but it is not working with git command line client. \n> \n> I tried setting http.sslCert and http.sslKey configuration options, but it is not working. Following were steps in accessing the repository. Am I missing something in my configuration? Any pointers on how to share git using SSL certificates would be really helpful. \n> \n> Thanks,\n> Shantanu. \n> \n> \n> * Try git-clone using HTTPS without client certs \n> {{{\n> mercury:tempgit-ssh2 shantanu$ git clone https://condor-node2.lab.ac.uab.edu/git/fifa2010 --verbose\n> Initialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/\n> error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs\n> \n> fatal: HTTP request failed\n> }}}\n> \n> * Try git-clone using ssh\n> {{{\n> mercury:tempgit-ssh2 shantanu$ git clone ssh://ssp@condor-node2.lab.ac.uab.edu/srv/gitpubrepos/fifa2010 --verbose\n> Initialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/\n> ssp@condor-node2.lab.ac.uab.edu's password: \n> remote: Counting objects: 7, done.\n> remote: Compressing objects: 100% (4/4), done.\n> remote: Total 7 (delta 0), reused 0 (delta 0)\n> Receiving objects: 100% (7/7), done.\n> }}}\n> \n> * Change git remote url \n> {{{\n> mercury:fifa2010 shantanu$ git remote rm origin\n> mercury:fifa2010 shantanu$ git remote add origin https://condor-node2.lab.ac.uab.edu/git/fifa2010 \n> }}}\n> \n> * Try git-pull with HTTPS without certs \n> {{{\n> mercury:fifa2010 shantanu$ git pull\n> error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs\n> \n> fatal: HTTP request failed\n> }}}\n> \n> * Try git-pull using certificates \n> {{{\n> mercury:fifa2010 shantanu$ git config http.sslCert ~/Desktop/certs/usercerts/bob-svn/ssp.crt \n> mercury:fifa2010 shantanu$ git config http.sslKey ~/Desktop/certs/usercerts/bob-svn/ssp.key \n> mercury:fifa2010 shantanu$ git pull\n> error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs\n> \n> fatal: HTTP request failed\n> }}}\n> \n> \n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at  http://vger.kernel.org/majordomo-info.html\n"},{"id":"144415","messageId":"20100628204425.GA13640@LK-Perkele-V2.elisa-laajakaista.fi","threadId":"24215","inReplyTo":"16FCDB06-9C82-4CBF-BD25-A10BD3E829DE@uab.edu","subject":"Re: git access using SSL certificates","fromName":"Ilari Liusvaara","fromEmail":"ilari.liusvaara@elisanet.fi","sentAt":"2010-06-28T20:44:25Z","receivedAt":"2010-06-28T20:44:25Z","isPatch":false,"sender":{"key":"ilari.liusvaara@elisanet.fi","avatar":null},"body":"On Mon, Jun 28, 2010 at 03:23:30PM -0500, Shantanu Pavgi wrote:\n> \n> Forgot to mention version info in my earlier email: \n> Server/Public repo: CentOS 5.4 with Git 1.7.1 installed from source \n> Client in earlier mail: Mac OS X 10.6 Git 1.6.5.2 \n\nToo old. 1.6.6 is minimum version requirement for smart HTTP push.\nTry upgrading.\n\n> Debian with Git 1.5.6.5:\n\nToo old. That's quite old version... Upgrade.\n\n-Ilari\n"},{"id":"144424","messageId":"6E28EE29-0FFA-4467-AE10-76ED2AEF79A5@uab.edu","threadId":"24215","inReplyTo":"20100628204425.GA13640@LK-Perkele-V2.elisa-laajakaista.fi","subject":"Re: git access using SSL certificates","fromName":"Shantanu Pavgi","fromEmail":"pavgi@uab.edu","sentAt":"2010-06-28T22:39:03Z","receivedAt":"2010-06-28T22:39:03Z","isPatch":false,"sender":{"key":"pavgi@uab.edu","avatar":null},"body":"\nTried with Git 1.7.1 on Mac: Doesn't work, same error. \nTried from another CentOS box with Git 1.7.1 and it worked fine. \n\nIn all failed cases apache logs indicate: <timestamp> [error] Re-negotiation request failed. \n\n--\nThanks,\nShantanu Pavgi. \n\n\nOn Jun 28, 2010, at 3:44 PM, Ilari Liusvaara wrote:\n\n> On Mon, Jun 28, 2010 at 03:23:30PM -0500, Shantanu Pavgi wrote:\n>> \n>> Forgot to mention version info in my earlier email: \n>> Server/Public repo: CentOS 5.4 with Git 1.7.1 installed from source \n>> Client in earlier mail: Mac OS X 10.6 Git 1.6.5.2 \n> \n> Too old. 1.6.6 is minimum version requirement for smart HTTP push.\n> Try upgrading.\n> \n>> Debian with Git 1.5.6.5:\n> \n> Too old. That's quite old version... Upgrade.\n> \n> -Ilari\n"},{"id":"144428","messageId":"20100629004631.GA14854@LK-Perkele-V2.elisa-laajakaista.fi","threadId":"24215","inReplyTo":"6E28EE29-0FFA-4467-AE10-76ED2AEF79A5@uab.edu","subject":"Re: git access using SSL certificates","fromName":"Ilari Liusvaara","fromEmail":"ilari.liusvaara@elisanet.fi","sentAt":"2010-06-29T00:46:31Z","receivedAt":"2010-06-29T00:46:31Z","isPatch":false,"sender":{"key":"ilari.liusvaara@elisanet.fi","avatar":null},"body":"On Mon, Jun 28, 2010 at 05:39:03PM -0500, Shantanu Pavgi wrote:\n> \n> Tried with Git 1.7.1 on Mac: Doesn't work, same error. \n> Tried from another CentOS box with Git 1.7.1 and it worked fine. \n> \n> In all failed cases apache logs indicate: <timestamp> [error] Re-negotiation\n> request failed. \n \nRenegotiation failed? There has been TLS security hole regarding to\nrenegotiation, and many patched TLS implementations do not allow renegotiation\nunless the other side is patched too.\n\nMaybe only one of the sides is patched? Both should be patched. One way to\nfind out if server is patched is to connect with client (e.g. Gnutls 2.10)\nthat supports safe renegotiation and disallow connecting to unpatched servers\nand see if it connects or not.\n\n-Ilari\n"}]}