问题
我在连接 Atlassian Stash 时遇到问题，它需要我公司颁发的证书。当我使用 Firefox（具有证书）连接时，它将允许我访问该网站，但是当我尝试使用 bash 克隆 git 存储库（在 Pop_OS！20.04 上，基于相同的 Ubuntu 版本）时，我得到出现以下错误：
> git clone https://cmstash.cm.website.com/scm/cded/prototyping.git
Cloning into 'prototyping'...
fatal: unable to access 'https://cmstash.cm.website.com/scm/cded/prototyping.git/': gnutls_handshake() failed: Handshake failed
我如何设置证书
我有 3 个文件4125B9-ca.crt，4125B9.crt和4125B9.key.这些被放置在/usr/share/ca-certificates/work/.然后我运行并在运行时sudo update-ca-certificates --fresh选择文件。这给出了警告：.crtsudo dpkg-reconfigure ca-certificates
warning: skipping 4125B9-ca.pem,it does not contain exactly one certificate or CRL
我是如何调试问题的
我尝试了不同的命令来测试连接，出于安全原因，一些信息已被删除。
我从openssl开始s_client：
> sudo openssl s_client -connect cmstash.cm.website.com:443 -CAfile /etc/ssl/certs/ca-certificates.crt -tls1_2
CONNECTED(00000003)
[depth 1 & 2 removed]
depth=0 CN = *.website.com, O = [O removed], OU = IT-Department, OU = CM, [C & L removed]
verify return:1
140405633332544:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/recor /rec_layer_s3.c:1543:SSL alert number 40
---
Certificate chain
[Certificate chain removed]
---
Server certificate
-----BEGIN CERTIFICATE-----
[Certificate removed]
-----END CERTIFICATE-----
[Subject and Issuer removed]
---
Acceptable client certificate CA names
[acceptable client certificate names removed]
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4110 bytes and written 447 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID:
Session-ID-ctx:
Master-Key: [Master Key removed]
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1600242853
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
---
看到可接受的客户端证书 CA 名称后，我将其与我的证书进行了检查，但 CA 名称是相同的。
然后我尝试使用curl：
curl -iv --ciphers DEFAULT@SECLEVEL=1 https://cmstash.website.com
* Trying 212.203.27.120:443...
* TCP_NODELAY set
* Connected to cmstash.cm.website.com ([IP removed]) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: DEFAULT@SECLEVEL=1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS alert, handshake failure (552):
* error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
此后没有给我更多信息，我尝试过gnutls：
gnutls-cli -d 0 -V cmstash.cm.website.com:443
- Status: The certificate is trusted.
- Server's trusted authorities:
[Authorities removed]
- Successfully sent 0 certificate(s) to server.
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [40]: Handshake failed
这似乎是一个 TLS 问题，与 git 没有直接关系。遗憾的是，错误消息只说明握手失败，但没有说明原因或方式。
其他信息
- 该网站不支持SSLv3或TLS1.3，所以我使用了TLS1.2
- 该证书有效，在 Firefox 中使用时确实有效