Make git revert to SSLv3 when TLSv1 fails with "Ignored Unknown Record"

Viewed 7881

Can't use git:

git clone https://github.com/foo/bar

fails:

fatal: unable to access 'https://github.com/foo/bar': Unknown SSL  protocol error in connection to github.com:443

How can I force git to use SSLv3? I tried to compile git from source, but there is no setting beyond: --with-openssl (default). Adding the following line before line 408 in remote-curl.c doesn't work either:

 curl_easy_setopt(slot->curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3);

Here are some clues:

  • case 1: When my browser tries to get to https://github.com/foo/bar, it first tries TLSv1. Handshake seems to be OK: Server key exchange, server hello done (at Wireshark). But it follows by "Ignored Unknown Record" from server and finally "Connection Reset" from server. Then A new connection but with SSLv3 kicks in and every thing is fine (see picture).

  • case 2: curl fails using TLSv1

    curl https://github.com/foo/bar
    

    fails:

    curl: (35) Unknown SSL protocol error in connection to github.com:443
    

    Setting --sslv3 fixes the problem.

  • case 3: Take this one

    sudo add-apt-repository  ppa:cassou/emacs
    

    fails:

    pycurl.error: (35, 'gnutls_handshake() failed: A TLS packet with unexpected length was received.')
    

Edit: curl 7.22.0 (i686-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1.

Edit: debug information

Cloning into 'bar'...
* Couldn't find host github.com in the .netrc file; using defaults
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.252.130... * Connected to github.com (192.30.252.130) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
    CApath: /etc/ssl/certs
* Unknown SSL protocol error in connection to github.com:443
* Closing connection #0
fatal: unable to access 'https://github.com/foo/bar/': Unknown SSL       protocol error in connection to github.com:443
1 Answers
Related