Git push to bitbucket fails with RPC error 56

[georgechauvet]

Attempting to push changes from my local git repository to bitbucket is consistently failing with error:

error: RPC failed; curl 56 OpenSSL SSL_read: error:140943FC:SSL routines:ssl3_re

Any ideas?

[Theodora Boudale · Accepted solution]

Hi @georgechauvet ,

It is possible that this error is related to the cipher deprecation, as Hana already mentioned.

Could you please let us know:

1. What is the output of the following command from your machine?

GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/

2. What is the operating system of that machine?

3. What is the version of Git and curl you are using?

git --version
curl --version

My initial suggestion would be to upgrade Git and curl.

If you're using a Git GUI client, I would suggest updating it to the latest version.

A temporary workaround until we get this resolved, would be to set up an SSH key for your Bitbucket account and use SSH instead of HTTPS when cloning/pulling from/pushing to repos:

• https://support.atlassian.com/bitbucket-cloud/docs/set-up-an-ssh-key/

Please feel free to let me know if you have any questions.

Kind regards,
Theodora

[georgechauvet]

Thanks for your response. It probably is an old version of git as it looks like it is trying to use TLSv1.2, but we have:

1. What is the output of the following command from your machine?

vshuttle>> GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/
* Couldn't find host bitbucket.org in the _netrc file; using defaults
* timeout on name lookup is not supported
* Trying 104.192.141.1...
* Connected to bitbucket.org (104.192.141.1) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: C:/Program Files/Git/mingw32/ssl/certs/ca-bundle.crt
CApath: none
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: businessCategory=Private Organization; jurisdictionC=US; juris dictionST=Delaware; serialNumber=3928449; C=US; ST=California; L=San Francisco; O=Atlassian, Inc.; OU=Bitbucket; CN=bitbucket.org
* start date: Mar 27 00:00:00 2020 GMT
* expire date: May 23 12:00:00 2022 GMT
* subjectAltName: bitbucket.org matched
* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Ext ended Validation Server CA
* SSL certificate verify ok.
> GET /info/refs?service=git-upload-pack HTTP/1.1
Host: bitbucket.org
User-Agent: git/2.7.1.windows.2
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US, *;q=0.9
Pragma: no-cache

< HTTP/1.1 404 Not Found
< Cache-Control: no-cache
< Content-Type: text/plain; charset=utf-8
< X-B3-Traceid: 8e606fde9171acc8
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< Date: Wed, 25 Nov 2020 21:35:20 GMT
< X-Server: 4fc4712df295
< X-Content-Type-Options: nosniff
< Connection: close
< X-Version: 2ec855ae3f-dirty
< Content-Length: 31
<
* Closing connection 0
remote: Repository info/refs not found
fatal: repository 'https://bitbucket.org/' not found
vshuttle>>

2. What is the operating system of that machine?

Microsoft Windows XP, Professional, Version 2002, Service Pack 3 (!) using git bash

Also experienced on Windows 10 Pro, 20H2, 24/07/2020, 19042.630 with Windows Feature Experience Pack 120.2212.31.0

3. What is the version of Git and curl you are using?

vshuttle>> git --version
git version 2.7.1.windows.2
vshuttle>> curl --version
curl 7.46.0 (i686-w64-mingw32) libcurl/7.46.0 OpenSSL/1.0.2e zlib/1.2.8 libidn/1.32 libssh2/1.6.0 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP
vshuttle>>

I will try upgrading git and curl as you suggest.

[georgechauvet]

Thanks for your response.

My lengthy reply seems to have disappeared, but the TL;DR is that my old version of git and curl do not seem to support TLSv1.3, only TLSv1.2, so that would explain the problem.

git version 2.7.1.windows.2

curl 7.46.0 (i686-w64-mingw32) libcurl/7.46.0 OpenSSL/1.0.2e zlib/1.2.8 libidn/1.32 libssh2/1.6.0 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP

So the solution is probably to try to update them as you suggest.

[georgechauvet]

Unfortunately, it seems that the last version of git for Windows to support Windows XP is 2.10, which seems not to handle TLSv1.3.

git version 2.10.0.windows.1

curl 7.50.1 (i686-w64-mingw32) libcurl/7.50.1 OpenSSL/1.0.2h zlib/1.2.8 libidn/1.33 libssh2/1.7.0 nghttp2/1.13.0 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP HTTP2 Metalink

[Theodora Boudale]

Hi @georgechauvet ,

It is not necessary to use TLSv1.3, we haven't deprecated support for TLSv1.2, only certain cipher suites are no longer supported.

1. Could you please let me know what is the output of the following command from that Windows machine?

GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/

This will show us both the version of TLS and also what cipher suite is used for connecting to Bitbucket.
I'd like us to check whether it's an unsupported one or not, so that we know if we're looking at the right direction.

2. Can you please confirm whether you're using HTTPS for cloning/pulling/pushing to this repo?
I assumed that you were, based on the error message you gave us, but again I'd like to be sure.

3. Are you interacting with this repo via Git Bash (or another command line tool)?
Or are you using a Git GUI client? (if so, which one?)

I am asking because some Git GUI clients come with their own embedded version of Git and may not use the system one.

Please feel free to let me know if you have any questions.

Kind regards,
Theodora

[georgechauvet]

Hello Theodora.

Having upgraded git bash to the last version that works with Windows XP, here's the output I get...

vshuttle>> GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/
* Couldn't find host bitbucket.org in the _netrc file; using defaults
* timeout on name lookup is not supported
* Trying 104.192.141.1...
* Connected to bitbucket.org (104.192.141.1) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: C:/Program Files/Git/mingw32/ssl/certs/ca-bundle.crt
CApath: none
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: businessCategory=Private Organization; jurisdictionC=US; jurisdictionST=Delaware; serialNumber=3928449; C=US; ST=California; L=San Francisco; O=Atlassian, Inc.; OU=Bitbucket; CN=bitbucket.org
* start date: Mar 27 00:00:00 2020 GMT
* expire date: May 23 12:00:00 2022 GMT
* subjectAltName: host "bitbucket.org" matched cert's "bitbucket.org"
* issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA
* SSL certificate verify ok.
> GET /info/refs?service=git-upload-pack HTTP/1.1
Host: bitbucket.org
User-Agent: git/2.10.0.windows.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US, *;q=0.9
Pragma: no-cache

< HTTP/1.1 404 Not Found
< Cache-Control: no-cache
< Content-Type: text/plain; charset=utf-8
< X-B3-Traceid: d0e4ddf7fb95f872
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< Date: Wed, 02 Dec 2020 19:38:34 GMT
< X-Server: 967034710ff1
< X-Content-Type-Options: nosniff
< Connection: close
< X-Version: a43d376ae5-dirty
< Content-Length: 31
<
* Closing connection 0
remote: Repository info/refs not found
fatal: repository 'https://bitbucket.org/' not found

I am indeed trying to use https and the git bash command line interface. I would prefer to use SourceTree most of the time, but that does not seem to be supported on Windows XP.

I may try setting up ssh and see if I can get further.

Best regards

George (Chauvet).

[Theodora Boudale]

Hi George,

Thank you for the info. (I can now also see your earlier lengthy reply, which you mentioned that it disappeared before, not sure what happened there)

Based on the verbose out, it looks that the issue may not be related with the deprecated cipher suites. I see in the output:

* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256

and ECDHE-ECDSA-AES128-GCM-SHA256 is a cipher suite that is supported.

We'll need to do some further troubleshooting to figure out why this is happening -- if you think that's a lot of work though and you prefer to set up SSH and continue with this instead, I definitely understand.

If you'd like us to further investigate this, I'd like to ask:

1. Do you get the same error when you try to clone this specific repo (on the same machine)? This is to understand whether the issue is specific to the push operation or not.
   
   
2. Do you get the same error if you try to clone / push to another Bitbucket repo (on the same machine)? This is to understand whether the issue seems to be specific to the repo or not.
   
   
3. It would be useful to have verbose output of the push command, the output of:

GIT_TRACE_PACKET=1 GIT_TRACE=1 GIT_CURL_VERBOSE=1 git push

IMPORTANT: Please remove ALL lines that start with the word Authorization from the output, prior to sharing it, as this contains encoded credential info.

Feel free to also sanitize the repo URL from the output, if you don't want it to be posted here.

Kind regards,
Theodora

[Hana Kučerová · Accepted solution]

Hi @georgechauvet ,

it seems to me, this error could be connected to this announcement.

Maybe you can try to change the ssl version, which is used when negotiating an SSL connection.

git config http.sslVersion tlsv1.3

But to be honest, I don't have many experiences in this area.

[georgechauvet]

Thanks - I had already tried that, but it seemed to have no effect.

[georgechauvet]

Actually my git/curl seem too old to support TLSv1.3, so that's probably the problem.