Unable to communicate with https servers

[alexweej]

---

NOTE: This was already reported in #1453 but that was closed due to a bit of a flame war. Let's try again :)

• I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

64-bit

$ git --version --build-options

Sorry, already uninstalled, it was Git-2.16.1.4-64-bit.exe.

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

7, 64-bit.

$ cmd.exe /c ver
Microsoft Windows [Version 6.1.7601]

• What options did you set as part of the installation? Or did you choose the
  defaults?

All defaults, apart from VS Code as the text editor.

# One of the following:
> type "C:\Program Files\Git\etc\install-options.txt"
> type "C:\Program Files (x86)\Git\etc\install-options.txt"
> type "%USERPROFILE%\AppData\Local\Programs\Git\etc\install-options.txt"
$ cat /etc/install-options.txt

Sorry, already uninstalled, can repro if needed but fairly disruptive to my work.

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

MITM https proxy

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

Bash

• What commands did you run to trigger this issue? If you can provide a
  Minimal, Complete, and Verifiable example
  this will help us understand the issue.

git clone
git fetch
git push
etc.

• What did you expect to occur after running these commands?

works

• What actually happened instead?

stderr: Cloning into 'C:\Users\THEPATH'...
fatal: unable to access 'https://THEREPO/url/': error setting certificate verify locations:
  CAfile: /mingw64/ssl/certs/ca-bundle.crt
  CApath: none

• If the problem was occurring with a specific repository, can you provide the
  URL to that repository to help us with testing?

Private Git server.

---

Thanks!

[dscho]

This was already reported in #1453 but that was closed due to a bit of a flame war. Let's try again :)

Thank you for giving this bug another chance of getting resolved.

Sorry, already uninstalled, can repro if needed but fairly disruptive to my work.

Can you reproduce with PortableGit (https://github.com/git-for-windows/git/releases/download/v2.16.1.windows.4/PortableGit-2.16.1.4-64-bit.7z.exe)? That would be the least disruptive to your work.

Also, as before: What does git config --show-origin http.sslCAInfo say?

Note: If you are willing to test a couple of things, I am willing to put in the hours to build custom installers to get to the bottom of this.

And of course I can give you a pretty easy way to work around the issue in your daily work: set the environment variable GIT_SSL_CAINFO to the absolute path C:\Program Files\Git\mingw64\ssl\certs\ca-bundle.crt (or wherever your file actually lives).

[alexweej]

Thanks, I'll try to get someone from my org to follow up ASAP, else I'll come back to this shortly.

Btw RE the ca-bundle.crt path, I don't believe this was ever manually configured. It was always just the default location installed by Git-for-Windows... Is it normal for people to customize this? I didn't see any installation option for it...

Thanks

Alex

[dscho]

Btw RE the ca-bundle.crt path, I don't believe this was ever manually configured. It was always just the default location installed by Git-for-Windows... Is it normal for people to customize this? I didn't see any installation option for it...

It should not be manually configured, except when someone adds custom certificates e.g. to support servers with self-signed certificates.

[abtOliver]

I have the same problem on a Windows 10 machine while on another it works without problems.
I tried it on both machines with Git-2.16.2-64-bit and the predessor Git-2.16.1-64-bit, the outcome is the same on the failing machine: unable to access...

Rolling back to Git-2.14.1-64-bit and everything seems working as expected.

The difference between both Windows 10 machines is, the failing one is located behind a corporate firewall and needs to be connected via proxy servers, no other internet access is possible.

[dscho]

@abtOliver are you sure that you see the exact same error message, including "CAfile: /mingw64/ssl/certs/ca-bundle.crt"?

And: does it work with http.proxy set?

[abtOliver]

@dscho this is the output from a clone command:

$ git clone "https://github.com/abtOliver/GitSmartPHP.git"
Cloning into 'GitSmartPHP'...
fatal: unable to access 'https://github.com/abtOliver/GitSmartPHP.git/': error setting certificate verify locations:
CAfile: /mingw64/ssl/certs/ca-bundle.crt
CApath: none

As you can see it is including the CAfile part.

The http.proxy contains something like this:

$ git config --get-all http.proxy
https://:@proxy01.company.com:8082/
https://:@proxy02.company.com:8082/
https://:@proxy03.company.com:8082/
https://:@proxy04.company.com:8082/
https://:@proxy05.company.com:8082/
https://:@proxy06.company.com:8082/

[abtOliver]

@dscho I found out something very interesting,
If you set http.sslcainfo to another value, the error message still persists with the default CAfile part:

$ git config --global http.sslcainfo "C:\Program Files\Git\mingw64\ssl\certs\somethingElse.crt"

$ git clone "https://github.com/abtOliver/GitSmartPHP.git"
Cloning into 'GitSmartPHP'...
fatal: unable to access 'https://github.com/abtOliver/GitSmartPHP.git/': error setting certificate verify locations:
CAfile: /mingw64/ssl/certs/ca-bundle.crt
CApath: none

[dscho]

Hmm. @abtOliver so the problem might be due to HTTPS proxies not using the correct CA file... I hope to find some time to set something up next week. If you have pointers (or even better, if you find an easy way to configure Apache2 to server as such an HTTPS proxy), I would be most grateful.

[whoisj]

@abtOliver have you tried using the new SChannel support and adding the certificates to your Windows store, instead of relying on http.sslcainfo?

[dscho]

/remind me in 10 days that I wanted to try to test this.

[reminders]

@dscho set a reminder for Mar 14th 2018

[reminders]

👋 @dscho, I wanted to try to test this.

[dscho]

A new snapshot should be available at https://wingit.blob.core.windows.net/files/index.html soon; please test!

[dscho]

@abtOliver could you test this, please?