How to disable git verification of ssl proxy?

shadewither· Mar 22, 2021, 03:06 UTC · lore

git version 2.25.1 / Ubuntu 20.04 http.sslverify=false does not work. git insists on verifying ssl proxy and complains. curl has an option of --proxy-insecure to disable proxy verification, what is the equivalent for git?

$ GIT_CURL_VERBOSE=1 git ...
* Couldn't find host github.com in the .netrc file; using defaults
*   Trying 127.0.0.1:1088...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 1088 (#0)
* found 391 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.3 / ECDHE_RSA_AES_256_GCM_SHA384
* server certificate verification OK
* server certificate status verification SKIPPED
* error fetching CN from cert:The requested data were not available.
* SSL: certificate subject name () does not match target host name '127.0.0.1'
* Closing connection 0
fatal: unable to access 'https://github.com/gdabah/distorm.git/': SSL:
certificate subject name () does not match target host name
'127.0.0.1'

-- yours, shdwthr@gmail.com

Jeff King· Mar 26, 2021, 08:43 UTC · re: shadewither · lore

Re: How to disable git verification of ssl proxy?

On Mon, Mar 22, 2021 at 11:06:31AM +0800, shadewither wrote:

Show 5 quoted lines

> git version 2.25.1 / Ubuntu 20.04
> http.sslverify=false does not work. git insists on verifying ssl proxy
> and complains.
> curl has an option of --proxy-insecure to disable proxy verification,
> what is the equivalent for git?

I don't think there is one. Peeking at the curl source code, --proxy-insecure is setting CURLOPT_PROXY_SSL_VERIFYPEER and CURLOPT_PROXY_SSL_VERIFYHOST both to 0.

So I think we'd need to plumb through an http.proxysslverify option that is equivalent to http.sslverify, but using the PROXY variants with curl_easy_setopt().

-Peff