Like most others, our repository server needs to disable SSLv3 (and v2) ASAP.
However, doing so seems to break our git-clients -- at least, on RHEL5 (connections from my FreeBSD desktop work fine). Even the most recent git (2.1.2) fails, and upgrading OpenSSL libraries to the latest from the vendor did not help.
However! The same git-client works just fine against github.com -- and github.com already has SSLv3 disabled too. By trial and error, I set our server's (Apache) SSL-configuration to match that of github:
SSLProtocol ALL -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCipherSuite "AES128-SHA AES256-SHA RC4-SHA"
sslscan against our server and github, I get the identical list of ciphers accepted and rejected. But git continues to fail:
% git clone https://git.example.net/git/puppet-hiera Cloning into 'puppet-hiera'... * Couldn't find host git.example.net in the .netrc file, using defaults * About to connect() to git.example.net port 443 * Trying 10.89.8.27... * connected * Connected to git.example.net (10.89.8.27) port 443 * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * Unknown SSL protocol error in connection to git.example.net:443 * Closing connection #0 fatal: unable to access 'https://git.example.net/git/puppet-hiera/': Unknown SSL protocol error in connection to git.example.net:443
Now, the only perceptible difference remaining between our server's SSL and GitHub's is that
sslscan is able to output details of GitHub's certificate, but fails to obtain those from our server.
When I connect to our git-server from my FreeBSD desktop, the same
git clone command works. Instead of failing, after outputting
CApath: none, I see:
CApath: none * SSL connection using AES128-SHA * Server certificate: subject: C=US; postalCode= ............
and the cloning succeeds. How do I configure our server so that git works with it even from the old RHEL5-systems -- as it does against GitHub-servers?
Update: trying to access our server with simply
curl, I got a similar error over SSL-compatibility. However, I was able to overcome it by invoking curl with an explicit
--tlsv1 option (also known as
-1). So, the software on RHEL5 systems is capable of the necessary protocols and ciphers -- how do I make it use them by default instead of trying the old ones and failing?