Develop Reference

How does GIT client deals with wrong SSL settings of repository?

For my personal pet-project I wrote on Java application, which pulls code from GIT repository through https and performs some analysis. However when I started testing it against code store in corporate repository I got “PKIX path building failed” and “unable to find valid certification path to requested target” errors.
Quick googling showed that the main cause of the problem is incorrect SSL settings in the infrastructure like self-signed certificate, for example.
I found possible workarounds to avoid this error:
Add host certificate manually into JRE trusted certificates.
Dynamically add the certificate to trusted certificates from applications resource files during its startup.
During startup of the app disable SSL validations at all, but this makes application vulnerable to "man in the middle" attacks.
But that's not the question.
When I was working with this corporate repository with standard GIT client (through https too) I've never got any issues with SSL or certificates. So the question is - how does official GIT client avoids this problem with self signed certificate in the chain?

Git itself does not do anything with any of this.
Git uses helpers—external programs and libraries—when talking to other Git providers. Those programs and libraries are responsible for all of this. So if you use git fetch or git push—note that git pull uses git fetch—and you use these with a URL that begins with https://, Git uses a system-provided HTTPS library,1 usually called "libcurl" or just curl. If you use an ssh:// URL, Git uses the system-provided ssh.
The Pro Git Book includes a chapter on Git Internals, with one section dedicated to Environment Variables. When using libcurl, these variables are particularly useful:
GIT_CURL_VERBOSE prints out the same stuff that curl -v prints.
GIT_SSL_NO_VERIFY turns off SSL certificate verification. So the default must be to do that verification, which (of course) will have issues with self-signed certificates.
When I was working with this corporate repository with standard GIT client (through https too) I've never got any issues with SSL or certificates.
That's interesting and curious; perhaps invoking Git with GIT_CURL_VERBOSE set will show what's going on here, or perhaps not. Or, perhaps the libcurl that was used to build your particular Git uses some CA files that your Java libraries do not.
1The details for this will depend on how your Git binaries were built. If you like, you can get the source code for Git and build it yourself, and thus have control over which library is used.

Connection issue with AWS DynamoDb from docker container

My client program is to get the records from DynamoDb table. My binary is working as expected on host machine, but if I run the same binary in Linux container, it's returning this error:
Unable to connect to endpoint
Do I need to change anything in client code or container settings?

This might be a bit late, but in case someone else is trying to run AWS through docker, by default it checks the SSL certificates when it connects. So you need to initialise the AWS client configuration with:
Aws::Client::ClientConfiguration config;
config.verifySSL = false;

It might be an SSL issue, if you see exceptions and/or logs mentioning about some sort of SSL certificate or connection error.
The short summary is that your linux box need to trust Amazon's root CA, which you can test by visiting https://dynamodb.eu-west-3.amazonaws.com.
Here is more detailed documentation to diagnose and resolve certificate related issues: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ats-certs.html

netbeans 8.0 incorrect credentials to repository using ssh

When I try to connect to my EC2 server, using Netbeans(Git-Remote-Push), I get "incorrect credentials coonecting to repository at SSH://xx.xx.xxx.xx/git-repo"
In my ide.log, I get the following message:
"WARNING [org.netbeans.modules.progress.spi.InternalHandle]: Cannot call progress on a task that was never started at org.netbeans.modules.git.client.GitProgressSupport.setProgressMessage(GitProgressSupport.java:247)
INFO [org.netbeans.modules.git.ui.repository.remote.SelectUriStep]: Auth failed when accessing ssh://54.77.226.97/git-repo
com.jcraft.jsch.JSchException: Algorithm negotiation fail"
Steps I have taken to overcome the problem.
I can connect using git-bash OK
I have ussed ssh-keygen to generate the keys
I have downloaded JCE 8 unlimited strength policy files.
Any help much appreciated, thanks

"Algorithm negotiation fail" means that the SSH-Client implementation netbeans uses and the server implementation, cannot find a mutual algorithm to encrypt/compress.
Reason could be that an administrator doesn't want the server to support insecure or doubtful algorithms from now on. So you have to find an update for Netbeans.

WebScarab : Getting a PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException while connecting via https

Hope you are doing well.I know there are many answers alike to the issue that i am going to ask but still no one seems to help.
Please help!!!
Issue:-
I am trying to connect to a secure website(HTTPS) using WebScarab, so that i can capture the traffic.Http is working fine for me.
For this i am using WebScarab as a proxy.
'client.getHostConfiguration().setProxy("127.0.0.1", 8008);'
but everytime i gets an exception (
SunCertPathBuilderException
) as stated above.
I have tried adding the website certificate to the Java using Keytool utility also.
I then added a proxy (reverse) entry in WebScarab (127.0.0.1 , 443) and changed the program to use it as a proxy server.
'client.getHostConfiguration().setProxy("127.0.0.1", 443);'
Then i got the following exception :-
org.apache.commons.httpclient.ProtocolException: The server stbeehive.oracle.com failed to respond with a valid HTTP response.
I also tried creating a .p12 certificate (for the website which i want to connect to) and importing it to WebScarab.
But inspite of all these methods i am not able to get the proper response.
I am using WebScarab as a proxy for firefox to capture its traffic and it is working fine (for both http and https).
Please help me as i have run out of ideas now :(

Are you using WebScarab or WebScarab-NG?
Please try WebScarab "classic", rather than the -NG variant. NG was a failed experiment, and no real effort was put into validating the client-side certificate functionality.
Also, what version of Java are you using, what operating system, 32 bit or 64-bit, etc, etc
Regards,
Rogan

SOAP request in Java works locally but not on server

I have a webapp that sends a SOAP request to a 3rd party server. When the request is made on my local computer it works without a problem, but when I deploy my application to my server I get an error with the following causes:
com.sun.xml.messaging.saaj.SOAPExceptionImpl: java.security.PrivilegedActionException: com.sun.xml.messaging.saaj.SOAPExceptionImpl: Message send failed
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: algorithm check failed: MD2withRSA is disabled
I've searched around but I can't find anything relevant to my situation. It's probably worth noting that the request I'm making is to an https url. My computer is running Windows XP and the server is running Slackware Linux. Any ideas what might be causing the server to reject the request?

Check your Java versions on your local machine, and your server.
From here, it seems the jvm 6u17 disabled MD2 as it is insecure, and whatever you connect to is using MD2

MD2withRSA is highly vulnerable and therefore deactivated in Sun... aeh Oracle's JVM. You should ask the owner of the remote service, whether his server supports more secure encryption methods (I think, older Apache HTTPd versions do offer MD2withRSA by default...). In order to resolve this problem without forcing the provider to change the method, you may use your own implementation of the X509TrustManager that accepts the old method.

A Google search on "MD2withRSA" showed this URL as the first hit, that seems to point to a change in a certain Java version. Probably the verasiuons on your local computer and the server do not match.

Newer Java 7 (version 1.7) allows re-enabling MD2 via $JAVA_HOME/jre/lib/security/java.security file. Download and install Java 7 and modify java.security file in text editor as follows
1) Remove MD2 from following property
jdk.certpath.disabledAlgorithms= # MD2
2) Ensure following property is commented out
# jdk.tls.disabledAlgorithms=MD5, SHA1, DSA, RSA keySize < 2048
3) Restart java application
Warning: MD2 is disabled by default in Jdk 7 because it is insecure. However, it can be enabled as described above to support older deployments.