git send-email fails SSL certificate verification

[Joel Stanley]

When using git send-email via the Gmail SMTP servers, I get the following error:

STARTTLS failed! SSL connect attempt failed with unknown error error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed at /usr/lib/git-core/git-send-email line 1241.

The git configuration is as follows:

[sendemail "gmail"]
    smtpencryption = tls
    smtpserver = smtp.gmail.com
    smtpuser = <email address hidden>
    smtpserverport = 587

A related Fedora bug is at https://bugzilla.redhat.com/show_bug.cgi?id=1043194
They sent a patch to the git mailing list which has some discussion http://thread.gmane.org/gmane.comp.version-control.git/240472

ProblemType: Bug
DistroRelease: Ubuntu 13.10
Package: git-email 1:1.9~rc1-1
ProcVersionSignature: Ubuntu 3.11.0-15.25-generic 3.11.10
Uname: Linux 3.11.0-15-generic x86_64
ApportVersion: 2.12.5-0ubuntu2.2
Architecture: amd64
Date: Mon Feb 10 16:38:52 2014
MarkForUpload: True
PackageArchitecture: all
SourcePackage: git
UpgradeStatus: No upgrade log present (probably fresh install)

[Joel Stanley (shenki)]

The entire thread is at: https://<email address hidden>/msg42105.html

If I revert this change, or set smtpsslcertpath = '/etc/ssl/certs' in my .gitconfig, the issue goes away.

[Anders Kaseorg (andersk)]

It sounds like you have some understanding of the problem, so I suggest pointing it out upstream (perhaps in reply to that thread).

[Joel Stanley (shenki)]

This has been fixed in git 1:1.9.1-1

[Sedat Dilek (dileks)]

I am using git (1:1.9.1-0ppa1~precise1) here on Ubuntu/precise AMD64 and was not able to send a patch to linux-fsdevel via GoogleMail.

The above workaround helped me (for the sake of completeness the snippet from my dot-gitconfig):

[ ~/.gitconfig]
...
[sendemail]
        smtpserver = smtp.gmail.com
        smtpserverport = 587
        smtpencryption = tls
        smtpuser = <email address hidden>
        smtpsslcertpath = '/etc/ssl/certs'
...

Anders can you offer a backport, please. THX in advance.

[Sedat Dilek (dileks)]

Reading and verifying above bug-reports I have here in 'git-send-email.perl':

[ /usr/lib/git-core/git-send-email ]
...
sub ssl_verify_params {
...
        if (!defined $smtp_ssl_cert_path) {
                # use the OpenSSL defaults
                return (SSL_verify_mode => SSL_VERIFY_PEER());
...

So, the real problems seems to be to have a higher version of libio-socket-ssl-perl (here on precise: 1.53-1).

From git (1.9.1-1) changelog:
...
  [ Jonathan Nieder ]
  * git-email: Recommends: libio-socket-ssl-perl (>= 1.951) since
    earlier versions do not use OpenSSL's defaults when ca_path
    and ca_file are unset.
...

- Sedat -

[Anders Kaseorg (andersk)]

The only difference between 1.9.1-0ppa1~precise1 and 1.9.1-1 is that 1.9.1-1 recommends libio-socket-ssl-perl (>= 1.951). The changelog for IO::Socket::SSL lists:

1.951 2013/7/3
- better document builtin defaults for key,cert,CA and how they are depreceated
- use Net::SSLeay::CTX_set_default_verify_paths to use openssl's builtin
  defaults for CA unless CA path/file was given (or IO::Socket::SSL builtins
  used)

Precise’s libio-socket-ssl-perl is too old, and I’m not going to add a newer one to the PPA because it could have unforeseen effects on packages other than Git.

[Sedat Dilek (dileks)]

What is your suggestion?
Fix local/global gitconfig?

Or revert that change?
...
- $smtp_ssl_cert_path = "/etc/ssl/certs";
+ # use the OpenSSL defaults
+ return (SSL_verify_mode => SSL_VERIFY_PEER());
...

I can understand your concerns in case of a higher version of libio-socket-ssl-perl, but a user-friendly solution would be kind for git-precise-ppa users.

[Anders Kaseorg (andersk)]

I’m pushing 1:1.9.1-1~ppa0~precise2 with that change reverted to the candidate PPA:
  https://launchpad.net/~git-core/+archive/candidate
Sedat, once it builds (should be within two hours or so), can you let me know if it works for you?

[Sedat Dilek (dileks)]

Without the smtpsslcertpath-line in my local ~/.gitconfig and the new git-core packages everything works like expected.

[ /etc/apt/sources.list.d/git-core-candidate-precise.list ]
       deb http://ppa.launchpad.net/git-core/candidate/ubuntu precise main
deb-src http://ppa.launchpad.net/git-core/candidate/ubuntu precise main

$ dpkg -l | grep git-core
ii git-core 1:1.9.1-1~ppa0~precise2 fast, scalable, distributed revision control system (obsolete)

[Sedat Dilek (dileks)]

Hmm, your changelog has no reference to this bug-no.
And I would name the Ubuntu package libio-socket-ssl-perl instead of IO::Socket::SSL.

[ Snip ]
  * Revert commit v1.8.5.5~5^2 (send-email: /etc/ssl/certs/ directory may
    not be usable as ca_path), which requires IO::Socket::SSL 1.951, and
    remove the associated versioned Recommends.
[Snap]