Question

我正在EC2上托管一个gitblit服务器。我用Start SSL制作了自己的证书我能够：

通过https（浏览器）访问gitblit网站
从localhost克隆（服务器本身）

当我尝试使用mac os git客户端从终端克隆存储库到我的电脑时我得到了

export $GIT_CURL_VERBOSE=1
git clone https://user@mydomain.com/git/testing123.git
cloning into 'testing123'...
* Couldn't find host mydomain.com in the .netrc file; using defaults
* About to connect() to mydomain.com port 443 (#0)
*   Trying xxx.xxx.xxx.xxx...
* Connected to mydomain.com (xxx.xxx.xxx.xxx) port 443 (#0)
* Connected to mydomain.com (xxx.xxx.xxx.xxx) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /opt/local/share/curl/curl-ca-bundle.crt
  CApath: none
* Unknown SSL protocol error in connection to mydomain.com:443 
* Closing connection #0
error: Unknown SSL protocol error in connection to mydomain.com:443  while accessing https://user@mydomain.com/git/testing123.git/info/refs
fatal: HTTP request failed

使用openssl我得到了

OpenSSL> s_client -tls1_2 -connect mydomain.com:443
CONNECTED(00000003)
140735107039708:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1372280840
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
error in s_client

因为我必须创建自己的密钥库，因为我的服务器不需要x11，我存储了

serverKeyStore.jks

mydomain的私钥
mydomain class 1 primary intermediate cert
startcom CA
startcom class 1主要intermadiate CA

serverTrustStore.jks

startcom CA
startcom class 1主要客户端CA
startcom class 1主服务器CA

我不知道这是否正确。如果我不得不把自己存放到商店来做这项工作，相信我，我愿意。我用Google搜索得非常努力，以至于我差点撞到了互联网的终点（我们都知道那里有很多山羊x_X）。所以我不知道还能做什么。

版本：

git 1.7.11.1
OpenSSL 1.0.1e 11 Feb 2013

curl 7.26.0 (x86_64-apple-darwin11.3.0) libcurl/7.26.0 OpenSSL/1.0.1e zlib/1.2.8 libidn/1.25
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smtp smtps telnet tftp 
Features: IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP

Answer 1

尝试注释掉这一行

#server.certificateAlias = localhost

或将其更改为如下所示

server.certificateAlias = "Your domain cert alias in key store"

Gitblit：与mydomain相关的未知SSL协议错误：443

1 个答案: