{"thread":{"id":"61846","subject":"Technical information about http.sslBackend schannel","startedAt":"2024-07-25T17:48:12Z","lastAt":"2024-08-13T13:20:45Z","messageCount":2,"participants":["PEMBERTON Brian D * DCBS","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"499372","messageId":"CO6PR09MB7381B7819CC314C878A73FF2E6AB2@CO6PR09MB7381.namprd09.prod.outlook.com","threadId":"61846","inReplyTo":null,"subject":"Technical information about http.sslBackend schannel","fromName":"PEMBERTON Brian D * DCBS","fromEmail":"brian.d.pemberton@dcbs.oregon.gov","sentAt":"2024-07-25T17:38:03Z","receivedAt":"2024-07-25T17:48:12Z","isPatch":false,"sender":{"key":"brian.d.pemberton@dcbs.oregon.gov","avatar":null},"body":"Hi,\n\nI am in the process of migrating our SVN repos to Git for my agency.  Our infrastructure team is requesting to have more information about what the http.sslBackend schannel setting does than what it stated in the documentation, as it seems necessary to connect (clone,push) to our remote. \n\n`\nhttp.sslBackend\nName of the SSL backend to use (e.g. \"openssl\" or \"schannel\"). This option is ignored if cURL lacks support for choosing the SSL backend at runtime.\n`\n\nMy understanding is that it enables Git to connect to the Windows cert store, (sorry if this is windows specific, I thought to start here, sense the subject is SSL) \n\nI wanted to reach out to the mailing list to see if I can draw on your knowledge about this setting and about it's technical details that I can communicate to my infrastructure team. \n\n\n\n\n"},{"id":"500780","messageId":"3d235ec1-5294-c9ff-0b9a-fa443e570b79@gmx.de","threadId":"61846","inReplyTo":"CO6PR09MB7381B7819CC314C878A73FF2E6AB2@CO6PR09MB7381.namprd09.prod.outlook.com","subject":"Re: Technical information about http.sslBackend schannel","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2024-08-13T13:20:39Z","receivedAt":"2024-08-13T13:20:45Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Brian,\n\nOn Thu, 25 Jul 2024, PEMBERTON Brian D * DCBS wrote:\n\n> I am in the process of migrating our SVN repos to Git for my agency.\n> Our infrastructure team is requesting to have more information about\n> what the http.sslBackend schannel setting does than what it stated in\n> the documentation, as it seems necessary to connect (clone,push) to our\n> remote.\n>\n> `\n> http.sslBackend\n> Name of the SSL backend to use (e.g. \"openssl\" or \"schannel\"). This\n> option is ignored if cURL lacks support for choosing the SSL backend at\n> runtime.\n> `\n>\n> My understanding is that it enables Git to connect to the Windows cert\n> store, (sorry if this is windows specific, I thought to start here,\n> sense the subject is SSL)\n\nThe name `schannel` is short for \"Secure Channel\" and refers to the native\nTransport Layer Security (TLS, formerly known as SSL, for more details see\nhttps://en.wikipedia.org/wiki/Transport_Layer_Security) support of Windows\nthat is required to transfer data via the HTTPS protocol. For details, see\nhttps://learn.microsoft.com/en-us/windows/win32/secauthn/secure-channel.\n\nThe name `openssl` stands for the OpenSSL library (whose home page is at\nhttps://www.openssl.org/), which offers an open source implementation of\nthe algorithms required for TLS.\n\nGit itself does not use either of these libraries directly. Instead, it\nleans on libcurl (https://curl.se/) which implements a variety of\nprotocols and optionally uses a variety of TLS implementations.\n\nNow, what does this mean for you in practice?\n\nAs you likely expect, the various TLS implementations all come with their\nstrengths and weaknesses. Here are but two of them:\n\n- OpenSSL is historically much faster at adopting new technology. For\n  example, it implemented TLS 1.3 much earlier than Secure Channel.\n\n- Secure Channel integrates much better with Windows. For example, if you\n  direct your web browser to a site with a self-signed certificate and use\n  the convenient GUI facility to add that to the Windows certificate\n  store, Secure Channel will automatically know about this. OpenSSL does\n  not, and will require you to jump through quite a few hoops to access\n  that site.\n\nSeeing as you write from a `.gov` address, I suspect that the fact that\nSecure Channel is part of the operating system (and hence is certified in\nthe same ways) will be of most interest to you.\n\nI hope this helps!\n\nCiao,\nJohannes\n"}]}