when I using this command to pull code:
➜ rt-analysis-multibranch_zhuolian git:(zhuolian) git pull
fatal: unable to access 'https://gitlab.example.com/development/soa-report-analysis.git/': SSL certificate problem: certificate has expired
I am sure the certificate not expired because on other macOS PC I could pull code from the same url. The server side certificate was generate by Let's Encrypt. The macOS Catalina openssl version is:
➜ ~ openssl version
LibreSSL 2.6.5
I tried to using curl, error like this:
➜ rt-analysis-multibranch_zhuolian git:(zhuolian) curl https://gitlab.example.com/development/soa-report-analysis.git
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.
why would this happen? what should I do to fix it? I can access the repo from Google Chrome browser by using the same url.
I finnaly found out that my last time renew the let's encrypt certificate using ISRG Root X1
root certificate by default. the ISRG Root X1
only compatible with macOS 10.12.1. But why the curl command seems to verify the old certificate. why would this happen?
certbot
was used without specifying a particular chain, it defaults to the 'compatibility' chain, because LE thinks that's a good idea. For anything other than certbot you'd have to give details. If you don't know about the issuance but the server is using PEM format files, look at their contents, they may already identify the subject and issuer, otherwise put each PEM block in a separate file and doopenssl x509 -in <onecert -noout -subject -issuer
.If they're in some other format you need to give details. ...openssl s_client -connect theserver:443 -servername theserver -showcerts </dev/null
and capture the output; it will contain several PEM blocks. Put each other than first in a separate file and continue as above. In either case if the last cert (PEM block) has issuer withCN=DST Root CA X3
that's the compatibility chain. To change it, if using certbot you can renew with--preferred-chain 'ISRG Root X1'
. Otherwise depending on the file format you may be able to edit them; give details. ...curl -v any_https_url
will show you what CA-file it is using; you can either modify that, or if it is a system file you can't or don't want to modify, copy it, modify the copy, and usecurl --cacert your_fixed_file
. However, I don't know ifgit
uses the same ascurl
or not, so you may need more to fix your real problem.