我被困在防火墙后面,所以必须使用HTTPS访问我的GitHub存储库。我在Windows XP上使用cygwin 1.7.7。

我试过把遥控器设置为https://username@github.com/username/ExcelANT.git,但按下输入密码的提示,但输入后没有任何反应。 https://username:<密码>github.com/username/ExcelANT.git和克隆空回购从零开始,但每次它给我同样的错误

错误:SSL证书有问题,请检查CA证书是否正确。细节: SSL例程:SSL3_GET_SERVER_CERTIFICATE:访问https://github.com/username/ExcelANT.git/info/refs时证书验证失败

打开GIT_CURL_VERBOSE=1会给我

* About to connect() to github.com port 443 (#0) * Trying 207.97.227.239... * successfully set certificate verify locations: * CAfile: none CApath: /usr/ssl/certs * SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed * Expire cleared * Closing connection #0 * About to connect() to github.com port 443 (#0) * Trying 207.97.227.239... * successfully set certificate verify locations: * CAfile: none CApath: /usr/ssl/certs * SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed * Expire cleared * Closing connection #0 error: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed while accessing https://github.com/username/ExcelANT.git/info/refs

fatal: HTTP request failed

这是我的防火墙有问题吗,cygwin还是什么?

我没有在Git配置中设置HTTP代理,但是它是一个ISA服务器,需要NTLM身份验证,不是基本的,所以除非有人知道如何强制Git使用NTLM,否则我就完了。


当前回答

问题是您的系统上没有安装任何证书颁发机构证书。这些证书不能用cygwin的setup.exe安装。

更新:在cygwin安装Net/ca-certificates包(感谢dirkjot)

有两种解决方案:

实际安装根证书。Curl从Mozilla中为您提取证书。

cacert。Pem文件就是你要找的。该文件包含> 250个CA证书(不知道如何信任这个数量的ppl)。你需要下载这个文件,把它分解成单独的证书,把它们放到/usr/ssl/certs(你的CApath)并索引它们。

以下是如何做到这一点。使用cygwin setup.exe安装curl和openssl包 执行:

<!-- language: lang-bash -->

    $ cd /usr/ssl/certs
    $ curl http://curl.haxx.se/ca/cacert.pem |
      awk '{print > "cert" (1+n) ".pem"} /-----END CERTIFICATE-----/ {n++}'
    $ c_rehash

重要提示:为了使用c_rehash,你也必须安装openssl-perl。

Ignore SSL certificate verification. WARNING: Disabling SSL certificate verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a Man-in-the-Middle Attack. Be sure you fully understand the security issues and your threat model before using this as a solution. $ env GIT_SSL_NO_VERIFY=true git clone https://github...

其他回答

我在Solaris Express 11上也遇到过同样的问题。我花了一些时间,但我设法找到了需要放置证书的地方。根据“/etc/openssl/openssl.cnf”,证书路径为“/etc/openssl/certs”我放置了使用Alexey的上述建议生成的证书。

你可以在命令行上使用openssl验证事情是否正常工作:

openssl s_client -connect github.com:443

问题是您的系统上没有安装任何证书颁发机构证书。这些证书不能用cygwin的setup.exe安装。

更新:在cygwin安装Net/ca-certificates包(感谢dirkjot)

有两种解决方案:

实际安装根证书。Curl从Mozilla中为您提取证书。

cacert。Pem文件就是你要找的。该文件包含> 250个CA证书(不知道如何信任这个数量的ppl)。你需要下载这个文件,把它分解成单独的证书,把它们放到/usr/ssl/certs(你的CApath)并索引它们。

以下是如何做到这一点。使用cygwin setup.exe安装curl和openssl包 执行:

<!-- language: lang-bash -->

    $ cd /usr/ssl/certs
    $ curl http://curl.haxx.se/ca/cacert.pem |
      awk '{print > "cert" (1+n) ".pem"} /-----END CERTIFICATE-----/ {n++}'
    $ c_rehash

重要提示:为了使用c_rehash,你也必须安装openssl-perl。

Ignore SSL certificate verification. WARNING: Disabling SSL certificate verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a Man-in-the-Middle Attack. Be sure you fully understand the security issues and your threat model before using this as a solution. $ env GIT_SSL_NO_VERIFY=true git clone https://github...

如果你使用的是基于debian的操作系统,你可以简单地运行

安装ca-certificates

对于那些使用Msys/MinGW GIT的用户,添加这个

  export GIT_SSL_CAINFO=/mingw32/ssl/certs/ca-bundle.crt 

我在必须管理的协作开发平台上配置Git时遇到了同样的问题。

解决方法:

I've Updated the release of Curl installed on the server. Download the last version on the website Download page of curland follow the installation proceedings Installation proceedings of curl Get back the certificate of the authority which delivers the certificate for the server. Add this certificate to the CAcert file used by curl. On my server it is located in /etc/pki/tls/certs/ca-bundle.crt. Configure git to use this certificate file by editing the .gitconfig file and set the sslcainfo path. sslcainfo= /etc/pki/tls/certs/ca-bundle.crt On the client machine you must get the certificate and configure the .gitconfig file too.

我希望这对你们中的一些人有所帮助。