{"thread":{"id":"49309","subject":"Multiple GIT Accounts & HTTPS Client Certificates - Config","startedAt":"2018-09-10T08:09:05Z","lastAt":"2018-09-13T04:17:19Z","messageCount":5,"participants":["Sergei Haller","Randall S. Becker","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"357778","messageId":"CAPO0KtU=do8nmJggP4-k1BingdseZUuRjWraGjuN01VoEYU=1Q@mail.gmail.com","threadId":"49309","inReplyTo":null,"subject":"Multiple GIT Accounts & HTTPS Client Certificates - Config","fromName":"Sergei Haller","fromEmail":"sergei@sergei-haller.de","sentAt":"2018-09-10T08:09:01Z","receivedAt":"2018-09-10T08:09:05Z","isPatch":false,"sender":{"key":"sergei@sergei-haller.de","avatar":"https://gravatar.com/avatar/176a0882204e4ac7cbe519527b25b5cace790fe49daa4d60770586558d61085a?d=mp&s=160"},"body":"Hi folks,\n\nmy problem is basically the following: my git server (https) requires\nauthentication using a clent x509 certificate.\n\nAnd I have multiple x509 certificates that match the server.\n\nwhen I access the https server using a browser, the browser asks which\ncertificate to use and everything is fine.\n\nWhen I try to access the git server from the command line (git pull or\nsimilar), the git will pick one of the available\ncertificates (randomly or alphabetically) and try to access the server with\nthat client certificate. Ending in the situation\nthat git picks the wrong certificate.\n\nI can workaround by deleting all client certificates from the windows\ncertificate store except the \"correct\" one => then git\ncommand line will pick the correct certificate (the only one available) and\neverything works as expected.\n\nWorkaround is a workaround, I need to use all of the certificates\nrepeatedly for different repos and different other\naplications (non-git), so I've been deliting and reinstalling the\ncertificates all the time in the last weeks...\n\nHow can I tell git cmd (per config option??) to use a particular client\ncertificate for authenticating to the https server\n(I could provide fingerprint or serial number or sth like that)\n\ncurrent environment: windows 10 and git version 2.18.0.windows.1\n\nWould be absolutely acceptable if git would ask interactively which client\ncertificate to use (in case its not configurable)\n\n(I asked this question here before:\nhttps://stackoverflow.com/questions/51952568/multiple-git-accounts-https-client-certificates-config\n)\n\n\nThanks!\n\n\n\n-- \nsergei@sergei-haller.de\n.\n"},{"id":"357783","messageId":"001901d4490a$528d7590$f7a860b0$@nexbridge.com","threadId":"49309","inReplyTo":"CAPO0KtU=do8nmJggP4-k1BingdseZUuRjWraGjuN01VoEYU=1Q@mail.gmail.com","subject":"RE: Multiple GIT Accounts & HTTPS Client Certificates - Config","fromName":"Randall S. Becker","fromEmail":"rsbecker@nexbridge.com","sentAt":"2018-09-10T13:29:32Z","receivedAt":"2018-09-10T13:29:46Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On September 10, 2018 4:09 AM, Sergei Haller wrote:\n> my problem is basically the following: my git server (https) requires\n> authentication using a clent x509 certificate.\n> \n> And I have multiple x509 certificates that match the server.\n> \n> when I access the https server using a browser, the browser asks which\n> certificate to use and everything is fine.\n> \n> When I try to access the git server from the command line (git pull or similar),\n> the git will pick one of the available certificates (randomly or alphabetically)\n> and try to access the server with that client certificate. Ending in the\n> situation that git picks the wrong certificate.\n> \n> I can workaround by deleting all client certificates from the windows\n> certificate store except the \"correct\" one => then git command line will pick\n> the correct certificate (the only one available) and everything works as\n> expected.\n> \n> Workaround is a workaround, I need to use all of the certificates repeatedly\n> for different repos and different other aplications (non-git), so I've been\n> deliting and reinstalling the certificates all the time in the last weeks...\n> \n> How can I tell git cmd (per config option??) to use a particular client\n> certificate for authenticating to the https server (I could provide fingerprint\n> or serial number or sth like that)\n> \n> current environment: windows 10 and git version 2.18.0.windows.1\n> \n> Would be absolutely acceptable if git would ask interactively which client\n> certificate to use (in case its not configurable)\n> \n> (I asked this question here before:\n> https://stackoverflow.com/questions/51952568/multiple-git-accounts-\n> https-client-certificates-config\n> )\n\nWould you consider using SSH to authenticate? You can control which private key you use based on your ~/.ssh/config entries, which are case sensitive. You can choose the SSH key to use by playing with the case of the host name, like:\n\ngithub.com\nGithub.com\ngitHub.com\n\neven if your user is \"git\" in all cases above. It is a bit hacky but it is part of the SSH spec and is supported by git and EGit (as of 5.x).\n\nCheers,\nRandall\n\n--\nRandall S. Becker\nManaging Director, Nexbridge Inc.\nLinkedIn.com/in/randallbecker\n+1.416.984.9826\n\n\n\n"},{"id":"357855","messageId":"CAPO0KtW8HGjdRcb7cStBqK1LA4f7jjxgXaDKOLhXpYAE_o+08w@mail.gmail.com","threadId":"49309","inReplyTo":"001901d4490a$528d7590$f7a860b0$@nexbridge.com","subject":"Re: Multiple GIT Accounts & HTTPS Client Certificates - Config","fromName":"Sergei Haller","fromEmail":"sergei@sergei-haller.de","sentAt":"2018-09-11T07:29:55Z","receivedAt":"2018-09-11T07:29:58Z","isPatch":false,"sender":{"key":"sergei@sergei-haller.de","avatar":"https://gravatar.com/avatar/176a0882204e4ac7cbe519527b25b5cace790fe49daa4d60770586558d61085a?d=mp&s=160"},"body":"no, using SSH is not an option. I have no control over the server\nsetup whatsoever.\n\nThx!\n\nOn Mon, Sep 10, 2018 at 3:29 PM, Randall S. Becker\n<rsbecker@nexbridge.com> wrote:\n> On September 10, 2018 4:09 AM, Sergei Haller wrote:\n>> my problem is basically the following: my git server (https) requires\n>> authentication using a clent x509 certificate.\n>>\n>> And I have multiple x509 certificates that match the server.\n>>\n>> when I access the https server using a browser, the browser asks which\n>> certificate to use and everything is fine.\n>>\n>> When I try to access the git server from the command line (git pull or similar),\n>> the git will pick one of the available certificates (randomly or alphabetically)\n>> and try to access the server with that client certificate. Ending in the\n>> situation that git picks the wrong certificate.\n>>\n>> I can workaround by deleting all client certificates from the windows\n>> certificate store except the \"correct\" one => then git command line will pick\n>> the correct certificate (the only one available) and everything works as\n>> expected.\n>>\n>> Workaround is a workaround, I need to use all of the certificates repeatedly\n>> for different repos and different other aplications (non-git), so I've been\n>> deliting and reinstalling the certificates all the time in the last weeks...\n>>\n>> How can I tell git cmd (per config option??) to use a particular client\n>> certificate for authenticating to the https server (I could provide fingerprint\n>> or serial number or sth like that)\n>>\n>> current environment: windows 10 and git version 2.18.0.windows.1\n>>\n>> Would be absolutely acceptable if git would ask interactively which client\n>> certificate to use (in case its not configurable)\n>>\n>> (I asked this question here before:\n>> https://stackoverflow.com/questions/51952568/multiple-git-accounts-\n>> https-client-certificates-config\n>> )\n>\n> Would you consider using SSH to authenticate? You can control which private key you use based on your ~/.ssh/config entries, which are case sensitive. You can choose the SSH key to use by playing with the case of the host name, like:\n>\n> github.com\n> Github.com\n> gitHub.com\n>\n> even if your user is \"git\" in all cases above. It is a bit hacky but it is part of the SSH spec and is supported by git and EGit (as of 5.x).\n>\n> Cheers,\n> Randall\n>\n> --\n> Randall S. Becker\n> Managing Director, Nexbridge Inc.\n> LinkedIn.com/in/randallbecker\n> +1.416.984.9826\n>\n>\n>\n\n\n\n-- \nsergei@sergei-haller.de\n.\n"},{"id":"357856","messageId":"CAPO0KtU5YHtuTEzSAZ8sbtuUuZ_0EV4_LyQdWcDJgH6N05TN+g@mail.gmail.com","threadId":"49309","inReplyTo":"CAPO0KtU=do8nmJggP4-k1BingdseZUuRjWraGjuN01VoEYU=1Q@mail.gmail.com","subject":"Re: Multiple GIT Accounts & HTTPS Client Certificates - Config","fromName":"Sergei Haller","fromEmail":"sergei@sergei-haller.de","sentAt":"2018-09-11T07:42:35Z","receivedAt":"2018-09-11T07:42:38Z","isPatch":false,"sender":{"key":"sergei@sergei-haller.de","avatar":"https://gravatar.com/avatar/176a0882204e4ac7cbe519527b25b5cace790fe49daa4d60770586558d61085a?d=mp&s=160"},"body":"PS: while I was trying to send the mail to this mailing list, there is\nsome update from the stack overflow side:\n\n* I am using sslBackend schannel\n* the private key of my client certificate can be provided by using\nthe http.sslKey config option\n* the private key is on a smart card, so there is no way I can copy it\nover to a file and use the openssl backend (at least no way that I am\naware of :)\n\nso basically this pins down to the fact that schannel implementation\nis picking the wrong key.\n\nWould be great if (one of) the following option was possible:\n\n(a) schannel would ask interactively which certificate to use, if\nthere is more than one that matches the servers request\n(b) key info (e.g. serial number or fingerprint) couldl be provided as\nconfig option\n\nnot sure if (a) or (b) is already possible (in some nightly build or\nsome hidden option?)\n\nI'd be eager to test if necessyry, but I probably wont be able to\nbuild git (so would need some sort of nightly build or something)\n\nPS: the recent realization makes me believe this is a window specific\nproblem. I think I have read somewhere\nabout a separate windows mailing list (but not sure where I saw it)\n\n\nOn Mon, Sep 10, 2018 at 10:09 AM, Sergei Haller <sergei@sergei-haller.de> wrote:\n> Hi folks,\n>\n> my problem is basically the following: my git server (https) requires\n> authentication using a clent x509 certificate.\n>\n> And I have multiple x509 certificates that match the server.\n>\n> when I access the https server using a browser, the browser asks which\n> certificate to use and everything is fine.\n>\n> When I try to access the git server from the command line (git pull or\n> similar), the git will pick one of the available\n> certificates (randomly or alphabetically) and try to access the server with\n> that client certificate. Ending in the situation\n> that git picks the wrong certificate.\n>\n> I can workaround by deleting all client certificates from the windows\n> certificate store except the \"correct\" one => then git\n> command line will pick the correct certificate (the only one available) and\n> everything works as expected.\n>\n> Workaround is a workaround, I need to use all of the certificates\n> repeatedly for different repos and different other\n> aplications (non-git), so I've been deliting and reinstalling the\n> certificates all the time in the last weeks...\n>\n> How can I tell git cmd (per config option??) to use a particular client\n> certificate for authenticating to the https server\n> (I could provide fingerprint or serial number or sth like that)\n>\n> current environment: windows 10 and git version 2.18.0.windows.1\n>\n> Would be absolutely acceptable if git would ask interactively which client\n> certificate to use (in case its not configurable)\n>\n> (I asked this question here before:\n> https://stackoverflow.com/questions/51952568/multiple-git-accounts-https-client-certificates-config\n> )\n>\n>\n> Thanks!\n>\n>\n>\n> --\n> sergei@sergei-haller.de\n> .\n\n\n\n-- \nsergei@sergei-haller.de\n.\n"},{"id":"358025","messageId":"20180913041708.GT432229@genre.crustytoothpaste.net","threadId":"49309","inReplyTo":"CAPO0KtU5YHtuTEzSAZ8sbtuUuZ_0EV4_LyQdWcDJgH6N05TN+g@mail.gmail.com","subject":"Re: Multiple GIT Accounts & HTTPS Client Certificates - Config","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2018-09-13T04:17:08Z","receivedAt":"2018-09-13T04:17:19Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Tue, Sep 11, 2018 at 09:42:35AM +0200, Sergei Haller wrote:\n> PS: while I was trying to send the mail to this mailing list, there is\n> some update from the stack overflow side:\n> \n> * I am using sslBackend schannel\n> * the private key of my client certificate can be provided by using\n> the http.sslKey config option\n> * the private key is on a smart card, so there is no way I can copy it\n> over to a file and use the openssl backend (at least no way that I am\n> aware of :)\n> \n> so basically this pins down to the fact that schannel implementation\n> is picking the wrong key.\n\nGit doesn't provide an option to query a smartcard outside of what your\ntypical TLS implementation provides by default.  Not being a Windows\nuser, I don't know if Schannel provides a way to automatically select\nthe right private key based on which certificate is used, or if that's\noutside its capability.\n\n> PS: the recent realization makes me believe this is a window specific\n> problem. I think I have read somewhere\n> about a separate windows mailing list (but not sure where I saw it)\n\nIf you're talking about Git for Windows, yes, this is probably better\naddressed as an issue there: https://github.com/git-for-windows/git.\n-- \nbrian m. carlson: Houston, Texas, US\nOpenPGP: https://keybase.io/bk2204\n"}]}