# git access using SSL certificates 5 messages from 2010-06-28 to 2010-06-29. Participants: Shantanu Pavgi, Ilari Liusvaara. Thread: https://gitlist.dev/t/24215 ## Shantanu Pavgi, 2010-06-28 14:54 Subject: git access using SSL certificates Message-ID: URL: https://gitlist.dev/e/CB7586D8-2C18-4BE9-9B32-3D02AA5F37ED%40uab.edu ``` Hi, I have configured a bare Git repository over HTTPS and client needs to have a SSL certificate-key to access the repository. I am able to access this repository using Firefox by loading client certificate in the Firefox, but it is not working with git command line client. I tried setting http.sslCert and http.sslKey configuration options, but it is not working. Following were steps in accessing the repository. Am I missing something in my configuration? Any pointers on how to share git using SSL certificates would be really helpful. Thanks, Shantanu. * Try git-clone using HTTPS without client certs {{{ mercury:tempgit-ssh2 shantanu$ git clone https://condor-node2.lab.ac.uab.edu/git/fifa2010 --verbose Initialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/ error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs fatal: HTTP request failed }}} * Try git-clone using ssh {{{ mercury:tempgit-ssh2 shantanu$ git clone ssh://ssp@condor-node2.lab.ac.uab.edu/srv/gitpubrepos/fifa2010 --verbose Initialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/ ssp@condor-node2.lab.ac.uab.edu's password: remote: Counting objects: 7, done. remote: Compressing objects: 100% (4/4), done. remote: Total 7 (delta 0), reused 0 (delta 0) Receiving objects: 100% (7/7), done. }}} * Change git remote url {{{ mercury:fifa2010 shantanu$ git remote rm origin mercury:fifa2010 shantanu$ git remote add origin https://condor-node2.lab.ac.uab.edu/git/fifa2010 }}} * Try git-pull with HTTPS without certs {{{ mercury:fifa2010 shantanu$ git pull error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs fatal: HTTP request failed }}} * Try git-pull using certificates {{{ mercury:fifa2010 shantanu$ git config http.sslCert ~/Desktop/certs/usercerts/bob-svn/ssp.crt mercury:fifa2010 shantanu$ git config http.sslKey ~/Desktop/certs/usercerts/bob-svn/ssp.key mercury:fifa2010 shantanu$ git pull error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs fatal: HTTP request failed }}} ``` ## Shantanu Pavgi, 2010-06-28 20:23 Subject: Re: git access using SSL certificates Message-ID: <16FCDB06-9C82-4CBF-BD25-A10BD3E829DE@uab.edu> URL: https://gitlist.dev/e/16FCDB06-9C82-4CBF-BD25-A10BD3E829DE%40uab.edu In-Reply-To: ``` Forgot to mention version info in my earlier email: Server/Public repo: CentOS 5.4 with Git 1.7.1 installed from source Client in earlier mail: Mac OS X 10.6 Git 1.6.5.2 On Mac git-push: {{{ mercury:fifa2010 shantanu$ git push --verbose Pushing to https://condor-node2.lab.ac.uab.edu/git/fifa2010 error: Cannot access URL https://condor-node2.lab.ac.uab.edu/git/fifa2010/, return code 52 error: failed to push some refs to 'https://condor-node2.lab.ac.uab.edu/git/fifa2010' }}} On Debian with Git 1.5.6.5: git-push {{{ atlab@debian:~/fifa2010$ git push error: Cannot access URL https://condor-node2.lab.ac.uab.edu/git/fifa2010/, return code 52 error: failed to push some refs to 'https://condor-node2.lab.ac.uab.edu/git/fifa2010' }}} On Debian with Git 1.5.6.5: git-pull {{{ atlab@debian:~/fifa2010$ git pull origin master error: GnuTLS recv error (-12): A TLS fatal alert has been received. fatal: Couldn't find remote ref master }}} It works on the same server system (CentOS 5.4 Git 1.7.1) using SSL certificates though. Any help/suggestions? -- Thanks, Shantanu. On Jun 28, 2010, at 9:54 AM, Shantanu Pavgi wrote: > > Hi, > > I have configured a bare Git repository over HTTPS and client needs to have a SSL certificate-key to access the repository. I am able to access this repository using Firefox by loading client certificate in the Firefox, but it is not working with git command line client. > > I tried setting http.sslCert and http.sslKey configuration options, but it is not working. Following were steps in accessing the repository. Am I missing something in my configuration? Any pointers on how to share git using SSL certificates would be really helpful. > > Thanks, > Shantanu. > > > * Try git-clone using HTTPS without client certs > {{{ > mercury:tempgit-ssh2 shantanu$ git clone https://condor-node2.lab.ac.uab.edu/git/fifa2010 --verbose > Initialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/ > error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs > > fatal: HTTP request failed > }}} > > * Try git-clone using ssh > {{{ > mercury:tempgit-ssh2 shantanu$ git clone ssh://ssp@condor-node2.lab.ac.uab.edu/srv/gitpubrepos/fifa2010 --verbose > Initialized empty Git repository in /Users/shantanu/tempgit-ssh2/fifa2010/.git/ > ssp@condor-node2.lab.ac.uab.edu's password: > remote: Counting objects: 7, done. > remote: Compressing objects: 100% (4/4), done. > remote: Total 7 (delta 0), reused 0 (delta 0) > Receiving objects: 100% (7/7), done. > }}} > > * Change git remote url > {{{ > mercury:fifa2010 shantanu$ git remote rm origin > mercury:fifa2010 shantanu$ git remote add origin https://condor-node2.lab.ac.uab.edu/git/fifa2010 > }}} > > * Try git-pull with HTTPS without certs > {{{ > mercury:fifa2010 shantanu$ git pull > error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs > > fatal: HTTP request failed > }}} > > * Try git-pull using certificates > {{{ > mercury:fifa2010 shantanu$ git config http.sslCert ~/Desktop/certs/usercerts/bob-svn/ssp.crt > mercury:fifa2010 shantanu$ git config http.sslKey ~/Desktop/certs/usercerts/bob-svn/ssp.key > mercury:fifa2010 shantanu$ git pull > error: Empty reply from server while accessing https://condor-node2.lab.ac.uab.edu/git/fifa2010/info/refs > > fatal: HTTP request failed > }}} > > > -- > To unsubscribe from this list: send the line "unsubscribe git" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html ``` ## Ilari Liusvaara, 2010-06-28 20:44 Subject: Re: git access using SSL certificates Message-ID: <20100628204425.GA13640@LK-Perkele-V2.elisa-laajakaista.fi> URL: https://gitlist.dev/e/20100628204425.GA13640%40LK-Perkele-V2.elisa-laajakaista.fi In-Reply-To: <16FCDB06-9C82-4CBF-BD25-A10BD3E829DE@uab.edu> ``` On Mon, Jun 28, 2010 at 03:23:30PM -0500, Shantanu Pavgi wrote: > > Forgot to mention version info in my earlier email: > Server/Public repo: CentOS 5.4 with Git 1.7.1 installed from source > Client in earlier mail: Mac OS X 10.6 Git 1.6.5.2 Too old. 1.6.6 is minimum version requirement for smart HTTP push. Try upgrading. > Debian with Git 1.5.6.5: Too old. That's quite old version... Upgrade. -Ilari ``` ## Shantanu Pavgi, 2010-06-28 22:39 Subject: Re: git access using SSL certificates Message-ID: <6E28EE29-0FFA-4467-AE10-76ED2AEF79A5@uab.edu> URL: https://gitlist.dev/e/6E28EE29-0FFA-4467-AE10-76ED2AEF79A5%40uab.edu In-Reply-To: <20100628204425.GA13640@LK-Perkele-V2.elisa-laajakaista.fi> ``` Tried with Git 1.7.1 on Mac: Doesn't work, same error. Tried from another CentOS box with Git 1.7.1 and it worked fine. In all failed cases apache logs indicate: [error] Re-negotiation request failed. -- Thanks, Shantanu Pavgi. On Jun 28, 2010, at 3:44 PM, Ilari Liusvaara wrote: > On Mon, Jun 28, 2010 at 03:23:30PM -0500, Shantanu Pavgi wrote: >> >> Forgot to mention version info in my earlier email: >> Server/Public repo: CentOS 5.4 with Git 1.7.1 installed from source >> Client in earlier mail: Mac OS X 10.6 Git 1.6.5.2 > > Too old. 1.6.6 is minimum version requirement for smart HTTP push. > Try upgrading. > >> Debian with Git 1.5.6.5: > > Too old. That's quite old version... Upgrade. > > -Ilari ``` ## Ilari Liusvaara, 2010-06-29 00:46 Subject: Re: git access using SSL certificates Message-ID: <20100629004631.GA14854@LK-Perkele-V2.elisa-laajakaista.fi> URL: https://gitlist.dev/e/20100629004631.GA14854%40LK-Perkele-V2.elisa-laajakaista.fi In-Reply-To: <6E28EE29-0FFA-4467-AE10-76ED2AEF79A5@uab.edu> ``` On Mon, Jun 28, 2010 at 05:39:03PM -0500, Shantanu Pavgi wrote: > > Tried with Git 1.7.1 on Mac: Doesn't work, same error. > Tried from another CentOS box with Git 1.7.1 and it worked fine. > > In all failed cases apache logs indicate: [error] Re-negotiation > request failed. Renegotiation failed? There has been TLS security hole regarding to renegotiation, and many patched TLS implementations do not allow renegotiation unless the other side is patched too. Maybe only one of the sides is patched? Both should be patched. One way to find out if server is patched is to connect with client (e.g. Gnutls 2.10) that supports safe renegotiation and disallow connecting to unpatched servers and see if it connects or not. -Ilari ```