git 连接中出现未知的 SSL 协议错误

Unknown SSL protocol error in connection

提问by b24

I want to push my commits to a Bitbucket repository but this error occurred:

我想将我的提交推送到 Bitbucket 存储库，但发生了此错误：

Fatal: unable to access
'https://[email protected]/myUsername/myRepository.git/':
Unknown SSL protocol error in connection to bitbucket.org:443

采纳答案by Jordfr?s

According to bitbucket knowledgebaseit may also be caused by the owner of the repository being over the plan limit.

根据 bitbucket知识库，这也可能是由存储库的所有者超出计划限制引起的。

If you look further down the page it seems to also be possible to trig this error by using a too old git version (1.7 is needed at the moment).

如果您进一步向下查看页面，似乎也可以通过使用太旧的 git 版本（目前需要 1.7）来触发此错误。

回答by VonC

You can get more information with

您可以通过以下方式获取更多信息

# Windows
set GIT_CURL_VERBOSE=1
set GIT_TRACE_PACKET=2

# Unix
export GIT_CURL_VERBOSE=1
export GIT_TRACE_PACKET=2

And then try a git push.

然后尝试一个git push.

Double-check your proxy settings if you have one.

如果您有代理设置，请仔细检查您的代理设置。

Note: git 2.8 (March 2016) adds more information on an error 35:

注意：git 2.8（2016 年 3 月）添加了有关错误 35 的更多信息：

See commit 0054045(14 Feb 2016) by Shawn Pearce (spearce).
^{(Merged by Junio C Hamano -- gitster--in commit 97c49af, 24 Feb 2016)}

请参阅Shawn Pearce ( ) 的提交 0054045（2016 年 2 月 14 日）。^{（由Junio C Hamano合并-- --在提交 97c49af 中，2016 年 2 月 24 日）}spearce
gitster

remote-curl: include curl_errorstron SSL setup failures

For curlerror 35 (CURLE_SSL_CONNECT_ERROR) users need the additional text stored in CURLOPT_ERRORBUFFERto debug why the connection did not start.
This is curl_errorstrinside of http.c, so include that in the message if it is non-empty.

remote-curl: 包括curl_errorstrSSL 设置失败

对于curl错误 35 ( CURLE_SSL_CONNECT_ERROR) 用户需要存储的附加文本CURLOPT_ERRORBUFFER来调试连接未启动的原因。
这是curl_errorstr在 内部http.c，因此如果它非空，请将其包含在消息中。

---

---

Also check out the common causes for that message:

另请查看该消息的常见原因：

If it was working before, and not working today, it is possible the SSL private key has expired on the BitBucket side (see below, reason #3), but that doesn't seem to be the case here (the certificate is valid until 12/03/2014).

如果它以前工作，今天不工作，则可能 SSL 私钥在 BitBucket 端已过期（见下文，原因 #3），但这里似乎并非如此（证书有效，直到12/03/2014）。

---

---

The Destination Site Does Not Like the Protocol

目标站点不喜欢协议

Firing off a request like the following, results in the Unknown SSL Protocol error:

触发如下请求，会导致 Unknown SSL Protocol 错误：

curl --sslv2 https://techstacks-tools.appspot.com/

Why? Well, in this case it is because the techstacks tools site does not support SSLv2, thus, generating the curl (35) error.

为什么？好吧，在这种情况下，这是因为 techstacks 工具站点不支持 SSLv2，因此会产生 curl (35) 错误。

The Destination Site Does Not Like the Cipher

目标站点不喜欢密码

You could be trying to connect to the site using an ssl cipher that the site is configured to reject.
For example, anonymous ciphers are typically disabled on ssl-encrypted sites that are customer-facing. (Many of us set a blanket rejection policy on any SSL-encrypted web site—regardless of it's purpose.)
The following command string "can" also result in the curl (35) error:

您可能正在尝试使用站点配置为拒绝的 ssl 密码连接到站点。
例如，匿名密码通常在面向客户的 ssl 加密站点上被禁用。（我们中的许多人在任何 SSL 加密的网站上设置了全面拒绝策略 - 无论其目的如何。）
以下命令字符串“can”也会导致 curl (35) 错误：

curl --ciphers ADH-RC4-MD5 https://some_web_site.some_domain.com/

Unfortunately, the type of error response you can get from curl depends largely upon the ssl server. On some sites, you'll receive the Unknown SSL Protocol error but on my techstacks-tools site, I get:

不幸的是，您可以从 curl 获得的错误响应类型在很大程度上取决于 ssl 服务器。在某些站点上，您会收到未知 SSL 协议错误，但在我的 techstacks-tools 站点上，我得到：

curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Kudos to Google because this particular error is a bit more descriptive than the one my websites at work generate because this at least tells you that a ssl socket was started but because of handshake failures, the socket was never able to complete.

Try connecting to the site with a cipher that the site supports. Not sure which cipher to use? Well, let me introduce my cryptonark ssl cipher tester...

感谢 Google，因为这个特定错误比我的网站在工作时生成的错误更具描述性，因为这至少告诉您 ssl 套接字已启动，但由于握手失败，套接字永远无法完成。

尝试使用站点支持的密码连接到站点。不确定要使用哪种密码？好吧，让我介绍一下我的cryptonark ssl密码测试器......

The SSL Private Key Has Expired

SSL 私钥已过期

I came across this one earlier today working with an old WebSeAL site.
In IBM GSKit, you can specify how long the private key password is valid. After reaching a certain date, you will still be able to get webseal started and listening on port 443 (or whatever you set your https-port value to) but you will not be able to successfully negotiate an SSL session.
In today's case, the old WebSEAL instance was using long-expired kdb file with a long expired private key password. Once replaced with the correct, more-up-to-date version, everything worked again.

我今天早些时候在一个旧的 WebSeAL 站点上遇到了这个。
在 IBM GSKit 中，您可以指定私钥密码的有效期。到达某个日期后，您仍然可以启动 webseal 并侦听端口 443（或您将 https-port 值设置为的任何值），但您将无法成功协商 SSL 会话。
在今天的案例中，旧的 WebSEAL 实例使用的是长期过期的 kdb 文件和一个长期过期的私钥密码。一旦替换为正确的、更新的版本，一切都会再次运行。

Improper redirection

不正确的重定向

Some ISP's and DNS providers like to intercept your failed DNS queries in order to redirect you to a search engine results-style page offering you alternative URLs or "Did you mean...?" counter-query results.
If you see an error like this:

一些 ISP 和 DNS 提供商喜欢拦截您失败的 DNS 查询，以便将您重定向到一个搜索引擎结果样式的页面，为您提供替代 URL 或“您的意思是……？” 反查询结果。
如果您看到这样的错误：

 error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol, 

it could be due to you typing the hostname incorrectly or the hostname is not yet tabled in your DNS. You can verify that with a simple "host" or "nslookup".

这可能是由于您输入的主机名不正确或主机名尚未在您的 DNS 中列出。您可以使用简单的“ host”或“ nslookup”来验证。

---

---

Note (August 2015): Git 2.6+ (Q3 2015) will allow to specify the SSL version explicitly:

注意（2015 年 8 月）：Git 2.6+（2015 年第三季度）将允许明确指定 SSL 版本：

http: add support for specifying the SSL version

http: 添加对指定 SSL 版本的支持

See commit 01861cb(14 Aug 2015) by Elia Pinto (devzero2000).
Helped-by: Eric Sunshine (sunshineco).
^{(Merged by Junio C Hamano -- gitster--in commit ed070a4, 26 Aug 2015)}

请参阅Elia Pinto ( ) 的提交 01861cb（2015 年 8 月 14 日）。 帮助者：Eric Sunshine ( )。^{（由Junio C Hamano合并-- --在ed070a4 提交中，2015 年 8 月 26 日）}devzero2000
sunshineco
gitster

http.sslVersion

The SSL version to use when negotiating an SSL connection, if you want to force the default.
The available and default version depend on whether libcurl was built against NSS or OpenSSL and the particular configuration of the crypto library in use. Internally this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl documentation for more details on the format of this option and for the ssl version supported.
Actually the possible values of this option are:

• sslv2
• sslv3
• tlsv1
• tlsv1.0
• tlsv1.1
• tlsv1.2

Can be overridden by the 'GIT_SSL_VERSION' environment variable.
To force git to use libcurl's default ssl version and ignore any explicit http.sslversionoption, set 'GIT_SSL_VERSION' to the empty string.

如果要强制使用默认值，则在协商 SSL 连接时使用的 SSL 版本。
可用和默认版本取决于 libcurl 是针对 NSS 还是 OpenSSL 构建的，以及所使用的加密库的特定配置。这在内部设置了 ' CURLOPT_SSL_VERSION' 选项；有关此选项格式和支持的 ssl 版本的更多详细信息，请参阅 libcurl 文档。
实际上这个选项的可能值是：

• sslv2
• sslv3
• tlsv1
• tlsv1.0
• tlsv1.1
• tlsv1.2

可以被 ' GIT_SSL_VERSION' 环境变量覆盖。
要强制 git 使用 libcurl 的默认 ssl 版本并忽略任何显式http.sslversion选项，请将 'GIT_SSL_VERSION' 设置为空字符串。

回答by Robert Wagner

Setting the following git setting fixed this for me

设置以下 git 设置为我解决了这个问题

git config --global --add http.sslVersion tlsv1.0

git config --global --add http.sslVersion tlsv1.0

I'm guessing the corporate proxy server did not like the default encryption protocol.

我猜公司代理服务器不喜欢默认的加密协议。

回答by Lho Ben

In many cases it is linked to proxy problems. If so just config your git proxy

在许多情况下，它与代理问题有关。如果是这样，只需配置您的 git 代理

git config --global http.proxy HOST:PORT

回答by John Fouhy

I was getting that behind a corporate proxy.

我在公司代理后面得到了它。

Solved by:

解决者：

git config http.sslVerify "false"

git config http.sslVerify "false"

回答by Aggressor

This error also comes up with the Server is down. Email from tech support on the issue:

服务器关闭时也会出现此错误。来自技术支持的电子邮件：

"We experienced an outage where it affected traffic to the website, as well as Mercurial and Git traffic over HTTPS. SSH was unaffected though. Feel free to check this page for more info:

http://status.bitbucket.org/"

“我们经历了一次中断，它影响到网站的流量，以及通过 HTTPS 的 Mercurial 和 Git 流量。不过 SSH 不受影响。请随时查看此页面以获取更多信息：

http://status.bitbucket.org/”

So try again later and it could work itself out. Did for me

所以稍后再试，它可以自行解决。为我做的

回答by AFetter

I get the same problem. With the last version of git and no proxy.

我遇到同样的问题。使用最新版本的 git 并且没有代理。

I fixed it:

我修好了它：

• sign in the GitHub
• enter the interface: "Personal settings", then click "SSH Keys" please confirm whether you have put the 'id_rsa.pub' that generated by the command
• 'ssh-keygen -t rsa ' on windows into github --> GIT BASH
• 'Add SSH key' and put the 'id_rsa.pub' into it.

• 登录 GitHub
• 进入界面：“个人设置”，然后点击“SSH Keys”请确认你是否已经把命令生成的'id_rsa.pub'
• 'ssh-keygen -t rsa' 在 windows 上进入 github --> GIT BASH
• “添加 SSH 密钥”并将“id_rsa.pub”放入其中。

More info: create the key

更多信息： 创建密钥

copy the key

复制密钥

回答by Ahmed Adel Ismail

I faced this issue while i was using version control in Android Studio 2.1.3, the scenario i faces was as follows :

我在 Android Studio 2.1.3 中使用版本控制时遇到了这个问题，我面临的场景如下：

1- i opened the IDE and clicked on the "update / pull" icon (Ctrl+T)

1-我打开IDE并单击“更新/拉动”图标（Ctrl + T）

2- it did not ask for the Master password and it failed, gave me this error :

2-它没有要求提供主密码并且失败了，给了我这个错误：

Unknown SSL protocol error in connection to bitbucket.org:443

3- i tried to fetch the repository (right click > git > repository > fetch)

3-我试图获取存储库（右键单击> git > 存储库> 获取）

4- it asked me for the master password and i entered it

4-它问我主密码，我输入了它

5- it tried to fetch but it failed again and again and again

5-它试图获取但一次又一次地失败

6- i restartedAndroid studio

6-我重新启动了Android工作室

7- i tried to fetch the repository (right click > git > repository > fetch)

7- 我试图获取存储库（右键单击 > git > 存储库 > 获取）

8- it asked me for the master password and i entered it

8-它问我主密码，我输入了它

9- now things are OK, every thing goes fine

9-现在一切正常，一切顺利

Conclusion:

结论：

maybe Android Studio needs the Master password first before any git actions, else it will keep failing even if it asked for Master password later on, i don't know, this is the scenario that happened to me

也许Android Studio在任何git操作之前首先需要主密码，否则即使稍后要求主密码它也会继续失败，我不知道，这是发生在我身上的场景

回答by Wildan Muhlis

This error happen to me when push big amount of sources (Nearly 700Mb), then I try to push it partially and it was successfully pushed.

当推送大量源（近 700Mb）时，这个错误发生在我身上，然后我尝试部分推送它并成功推送。

回答by Tugrul ASLAN

I had the same issue, tried all changing SSL settings that are provided here. If you are in the corporate network and ssh keys used in such tools like Gerrit. 1. Get your ssh key, 2. Visit Bitbucket and navigate to Profile >> Settings >> SSH Keys >> Add Key.

我遇到了同样的问题，尝试了此处提供的所有更改 SSL 设置。如果你在公司网络和 ssh 密钥中使用像 Gerrit 这样的工具。1. 获取您的 ssh 密钥， 2. 访问 Bitbucket 并导航到 Profile >> Settings >> SSH Keys >> Add Key。

After ssh key addition, try to push again.

添加ssh密钥后，再次尝试推送。